Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Bumps the go-openapi-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) | `0.23.1` | `0.24.0` |
| [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt) | `0.26.3` | `0.26.4` |
| [github.com/go-openapi/swag/jsonutils](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/loading](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/mangling](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |


Updates `github.com/go-openapi/jsonpointer` from 0.23.1 to 0.24.0
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.23.1...v0.24.0)

Updates `github.com/go-openapi/strfmt` from 0.26.3 to 0.26.4
- [Release notes](https://github.com/go-openapi/strfmt/releases)
- [Commits](go-openapi/strfmt@v0.26.3...v0.26.4)

Updates `github.com/go-openapi/swag/jsonutils` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/loading` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/mangling` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.26.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/jsonutils
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/loading
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/mangling
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps the golang-org-dependencies group with 1 update: [golang.org/x/text](https://github.com/golang/text).


Updates `golang.org/x/text` from 0.38.0 to 0.40.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.38.0...v0.40.0)

---
updated-dependencies:
- dependency-name: golang.org/x/text
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: golang-org-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps the go-openapi-dependencies group with 1 update in the / directory: [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer).


Updates `github.com/go-openapi/jsonpointer` from 0.24.0 to 1.0.0
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.24.0...v1.0.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Apply suggested fix to mixin.go from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

* Apply suggested fix to mixin.go from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

* Apply suggested fix to mixin.go from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

* Apply suggested fix to mixin.go from Copilot Autofix

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com>

Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/strfmt](https://github.com/go-openapi/strfmt).


Updates `github.com/go-openapi/strfmt` from 0.26.4 to 0.27.0
- [Release notes](https://github.com/go-openapi/strfmt/releases)
- [Commits](go-openapi/strfmt@v0.26.4...v0.27.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/strfmt
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps the development-dependencies group with 1 update in the / directory: [actions/setup-go](https://github.com/actions/setup-go).


Updates `actions/setup-go` from 6.5.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@924ae3a...b7ad1da)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>

…sis (#220)

Flattening and schema analysis resolve remote and relative $ref through the spec
package loader, which by default is unsandboxed. A caller processing an untrusted
specification had no way to confine that loading, exposing arbitrary file read
and SSRF (the same class of issue addressed in go-openapi/spec).

Add an injectable, option-aware loader to the two paths that actually load
documents:

  - FlattenOpts.PathLoaderWithOptions, forwarded through ExpandOpts. This covers
    the whole flatten feature, since ExpandSpec, ResolveRefWithBase and
    DeepestRef all go through ExpandOpts.
  - SchemaOpts.PathLoaderWithOptions, threaded through AnalyzedSchema and the
    recursive Schema() calls; inferFromRef now uses spec.ExpandSchemaWithOptions
    (new in spec v0.22.8) instead of the default-settings ExpandSchema. Flatten's
    Schema() call sites propagate the loader too.

Set either to a confined loader (e.g. built with loading.WithRoot /
loading.WithHTTPClient, or a restricted loader from go-openapi/loads) to safely
process untrusted specs. Left nil, behavior is unchanged.

The New() analyzer and the diff package were audited and do not load external
documents (in-memory cataloguing and definition-map lookups only), so they need
no loader.

Bumps spec to v0.22.8 (for ExpandSchemaWithOptions) and aligns swag to v0.27.3;
the testintegration module moves to spec v0.22.8 and loads v0.24.1.

Signed-off-by: Frederic BIDON <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>