Upgrading github.com/go-openapi/swag 0.25 to 0.26
Review neededv0.25.5 → v0.26.1Security3New1Changed18Other20
SecurityAdds WithRoot option to sandbox local loading, addressing GHSA-v2xp-g8xf-22pf.GHSA-v2xp-g8xf-22pf ↗
Review neededUpgrade verdict
3 behavior changes and 2 security fixes.
In plain terms
- A new option lets you restrict where the loader may read local files from, closing a security gap.
- The docs now explain the security risks of loading files and how to use the loader safely.
Must act 2 items need code or config changes
What you must change
Security2
Adds WithRoot option to sandbox local loading, addressing GHSA-v2xp-g8xf-22pf.
WithRootDocuments the security implications of using the loader.