build(deps): bump the tools group across 1 directory with 5 updates

[dependabot]

Bumps the tools group with 4 updates in the /tools directory: github.com/bufbuild/buf, github.com/go-critic/go-critic, github.com/oapi-codegen/oapi-codegen/v2 and github.com/openfga/cli.

Updates github.com/bufbuild/buf from 1.71.0 to 1.72.0

Release notes

Sourced from github.com/bufbuild/buf's releases.

v1.72.0

• Fix buf beta registry webhook create and buf beta registry webhook list to emit proto JSON output.
• Fix HTTPS Basic authentication for remote inputs to use BUF_INPUT_HTTPS_USERNAME for the username.
• Fix IMPORT_USED lint rule silently reporting no unused imports when google/protobuf/descriptor.proto is in the transitive dependency graph.

Changelog

Sourced from github.com/bufbuild/buf's changelog.

[v1.72.0] - 2026-07-17

• Fix buf beta registry webhook create and buf beta registry webhook list to emit proto JSON output.
• Fix HTTPS Basic authentication for remote inputs to use BUF_INPUT_HTTPS_USERNAME for the username.
• Fix IMPORT_USED lint rule silently reporting no unused imports when google/protobuf/descriptor.proto is in the transitive dependency graph.

Commits

• 7d6f056 Release v1.72.0 (#4617)
• 46fa3e4 Make upgrade (#4616)
• efe167b Fix buf generate clean to not delete nested output (#4615)
• f6c012f Make upgrade (#4608)
• 67dfe4c Fix IMPORT_UNUSED when descriptor.proto is in the dependency graph (#4602)
• b518200 Fix HTTPS Basic auth for env variables (#4600)
• e2b3f44 Add recommended SDK added/removed audit events (#4601)
• 58b4fc0 Make upgrade (#4599)
• f0f8156 Fix webhook create/list output to use protojson (#4592)
• ce80ea7 Return to development (#4584)
• See full diff in compare view

Updates github.com/go-critic/go-critic from 0.14.3 to 0.14.4

Release notes

Sourced from github.com/go-critic/go-critic's releases.

v0.14.4

What's Changed

• chore: update goStdlib to go1.27 by @​ldez in go-critic/go-critic#1530

Full Changelog: go-critic/go-critic@v0.14.3...v0.14.4

Commits

• 3a1e4fd chore: update goStdlib to go1.27 (#1530)
• See full diff in compare view

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.7.1 to 2.8.0

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

v2.7.2 More fixes for code injection issues

String escaping fixes due to more code injection issues

We've had two more code injection issues reported in oapi-codegen, thanks @​Gal3M, @​mrostamipoor for these findings.

• GHSA-jwgf-6xff-4hvp
• GHSA-xrqw-w576-xgj2

These specific issues are now patches in the main branch and in this v2.7.2 release.

You shouldn't blindly trust OpenAPI specs

This code wasn't originally written assuming code generation from random specs from the internet, and it never took any measures to protect itself from malicious specifications, the assumption being that you control your specification, and that you actually look over generated code.

For example, all these RCE exploits rely on using the package init() function in the generated code to run some malicious code at package startup. A way to test for this is to see whether an init() function is emitted, which we currently don't do.

When working with OpenAPI specifications, especially specs you find on remote servers, you should download the spec locally, run some kind of spec validator on it, like openapi-spec-validator, and only then feed it into oapi-codegen. We're very permissive in accepting broken specifications, intentionally, since people feed a lot of garbage input, but this flexibility also makes us weak to these kinds of attacks. There are hundreds of injection sites in oapi-codegen based on my survey.

For the next minor release, v2.8.0, we're going to validate the spec before code generation (oapi-codegen/oapi-codegen#2435), however, since this introduces a new set of failure modes, I don't want to include it in a maintenance release version. The future release is resilient against many forms of injection, and the spec validation has the added benefit that it can generate meaningful error messages for garbage input, where currently, we generate non-compiling code.

Until then, please do sanity checks on your input specifications, on the generated output, and don't fetch specs from the internet in your build, commit both the spec locally into your source control, and go through code review. In our repo, we've hooked up Greptile to catch issues like this, and you should also use some code quality tool. We can't possibly protect against every kind of attack with simple heuristics.

Sponsors

We would like to thank our sponsors for their support during this release.

We'd also like to thank Greptile for allowing our project to use their code review system.

Commits

• de2d8b2 Add sort-handler-registrations flag to opt out of spec-order registration (#2...
• bd52535 Name shared path parameter helper types once, hashing cross-path collisions (...
• ce2e068 feat(#1726): add literal colon support for gin, echo, fiber (#1879)
• 1457922 Fix ValueByDiscriminator() with external refs (#2474)
• 6d3c864 Fix allOf/nullable detection and recursion (#2473)
• 823a7a7 Fix nested allOf/anyOf merging (#2471)
• 9193526 chore(deps): update actions/setup-go action to v7 (.github/workflows) (#2469)
• a07731d Generate shared path-level parameter helper types once (#2466)
• 6574240 Register handlers in spec order (#2465)
• 18ef715 Stringify non-string text/plain responses in strict servers (#2464)
• Additional commits viewable in compare view

Updates github.com/openfga/cli from 0.7.16 to 0.7.19

Release notes

Sourced from github.com/openfga/cli's releases.

v0.7.19

Fixed

• publish distroless Docker image with dockers v2 (#716) (e39700a)

Changed

• bump github.com/openfga/language/pkg/go from 0.3.0 to 0.3.1 (042151f)

[!NOTE] v0.7.18 had issues in the release pipeline so it was never published; the changelog has been merged into v0.7.19.

What's Changed

• chore: pin reusable release workflows by @​SoulPancake in openfga/cli#717
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in openfga/cli#718
• fix: publish distroless Docker image with dockers v2 by @​Siddhant-K-code in openfga/cli#716
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in openfga/cli#721
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in openfga/cli#720
• chore(deps): bump github.com/openfga/language/pkg/go from 0.3.0 to 0.3.1 in the dependencies group by @​dependabot[bot] in openfga/cli#722
• fix(docs): fix formatting inconsistency, outdated Go version, and grammar by @​archy-rock3t-cloud in openfga/cli#663
• release: v0.7.18 by @​openfga-releaser-bot[bot] in openfga/cli#723
• fix: set up buildx driver for dockers_v2 sbom attestation in release by @​SoulPancake in openfga/cli#724
• release: v0.7.19 by @​openfga-releaser-bot[bot] in openfga/cli#725

New Contributors

• @​archy-rock3t-cloud made their first contribution in openfga/cli#663, Thanks @​archy-rock3t-cloud

Full Changelog: openfga/cli@v0.7.17...v0.7.19

v0.7.17

Changed

• drop gocsv to stdlib encoding/csv (#704) (436b74f)

What's Changed

• fix: attach SLSA provenance to draft release via gh release upload by @​SoulPancake in openfga/cli#713
• chore(deps): bump the dependencies group with 2 updates by @​dependabot[bot] in openfga/cli#714
• refactor: drop gocsv to stdlib encoding/csv by @​SoulPancake in openfga/cli#704
• release: v0.7.17 by @​openfga-releaser-bot[bot] in openfga/cli#715

Full Changelog: openfga/cli@v0.7.16...v0.7.17

Changelog

Sourced from github.com/openfga/cli's changelog.

0.7.19 (2026-07-13)

Fixed

• publish distroless Docker image with dockers v2 (#716) (e39700a)

Changed

• bump github.com/openfga/language/pkg/go from 0.3.0 to 0.3.1 (042151f)

[!NOTE] v0.7.18 had issues in the release pipeline so it was never published; the changelog has been merged into v0.7.19.

0.7.17 (2026-06-23)

Changed

• drop gocsv to stdlib encoding/csv (#704) (436b74f)

Commits

• cd511b8 release: v0.7.19 (#725)
• fe382e0 fix: set up buildx driver for dockers_v2 sbom attestation in release (#724)
• 2cd99cd release: v0.7.18 (#723)
• 45e8a57 fix(docs): fix formatting inconsistency, outdated Go version, and grammar (#663)
• 042151f chore(deps): bump github.com/openfga/language/pkg/go (#722)
• 8089d79 chore(deps): bump the dependencies group with 2 updates (#720)
• 2b3818b chore(deps): bump the dependencies group with 2 updates (#721)
• e39700a fix: publish distroless Docker image with dockers v2 (#716)
• f013c4c chore(deps): bump the dependencies group with 2 updates (#718)
• 7ef857a chore: pin reusable workflows to openfga/.github@835baf31562809ad9eb884c73efc...
• Additional commits viewable in compare view

Updates golang.org/x/tools from 0.47.0 to 0.48.0

Commits

• 05f9cb5 go.mod: update golang.org/x dependencies
• 745d7ae gopls: add CompiledAsmFiles in cache.Package
• 797ee67 go/ssa: make Const(unsafe.Pointer, nil).IsNil() true
• 9751125 gopls/internal/test: Completion benchmarks use empty range
• 8786a96 internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2
• 425085f gopls/internal/server: modify return of parseAction
• 30c4f87 go/analysis/passes/nilness: skip magic cgo functions
• 9e6441d gopls/internal/protocol/generate: remove manual rename overwritten
• df96841 gopls/internal/protocol: use Debug log level
• 278f062 gopls/internal/protocol: update to LSP 3.18
• Additional commits viewable in compare view

[coveralls]

coverage: 61.568%. remained the same — dependabot/go_modules/tools/tools-54971cb07e into main