[fly333sky]

🔒 安全修复：CVE-2025-30153

升级 kin-openapi 到 0.131.0。

影响判断

本仓 go.mod 第 8 行声明 github.com/getkin/kin-openapi v0.127.0（go.sum 第 8-9 行锁定同版本），落在 CVE-2025-30153 受影响区间 (<0.131.0)。该组件被 internal/builder、internal/spec、internal/registry、cmd/cora 等多处引用。已将其升级至修复版本 v0.131.0，并执行 go mod tidy 刷新 go.sum。升级后 go build ./... 编译通过、相关包 go test 全部通过。注：kin-openapi v0.131.0 的传递依赖 yaml 库由 github.com/invopop/yaml 切换为 github.com/oasdiff/yaml 与 github.com/oasdiff/yaml3，由 go mod tidy 自动同步，与本 CVE 修复相关。

验证

• 已跑本仓自带测试（通过）

来源

• CVE issue: CVE-2025-30153 #19
• Resolves CVE-2025-30153 #19

由 opensourceways/backlog cve-batch-fix 流水线自动提交（每日定时批量修复）。

[opensourceways-bot]

Welcome To opensourceways Community

Hey @fly333sky , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @TommyLike .

[opensourceways-bot]

CLA Signature Pass

fly333sky, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​getkin/​kin-openapi@​v0.127.0 ⏵ v0.131.0	+1

View full report