chore: bump github.com/oasdiff/oasdiff from 1.23.0 to 1.24.0 in /tools/cli

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.23.0 to 1.24.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.24.0

Richer validate, per-endpoint review blocks, kin-openapi v0.143.0

Two new validate lints (duplicate enum values, ambiguous parameter serialization), validation rule IDs now sourced from kin-openapi's stable codes, per-endpoint block extraction so the --open review scales to large specs, and correct source locations for $refs into arbitrary top-level keys. Built on kin-openapi v0.143.0.

CLI changes

validate

• New lint: duplicate enum values (#1023, closes #980). oasdiff validate now warns (duplicate-enum-value) when an enum lists the same value more than once. JSON Schema says enum values SHOULD be unique and kin-openapi does not reject them, so this is an oasdiff-native SHOULD-level check. It visits every schema in the document via WalkSchemas, so components, paths, webhooks, and all sub-schema keywords are covered, and the finding points at the exact JSON Pointer.
• New lint: ambiguous parameter serialization (#1103, closes #1055). Warns (ambiguous-parameter-serialization) when a parameter's schema type union mixes a structured type (array / object) with a scalar, e.g. type: [array, integer]. Style serialization is defined per type, so a server cannot tell whether ?token=5 is the array ["5"] or the integer 5. null is excluded from the check (it carries no serialization of its own) and two scalars are fine.
• Rule IDs now come from kin-openapi's declared codes (#1101, #1106). The IDs validate emits are the stable codes kin-openapi declares on each validation error, gated against a fixed registry so the public ID surface cannot drift silently on a dependency bump. Spellings are unchanged, with one refinement: two errors that previously reported the generic spec-validation-error now report their specific codes, duplicate-required-field and duplicate-tag.

--open review

• Per-endpoint block extraction for large specs (#1068). The side-by-side review slices each change into its own structural block per endpoint, so a very large spec renders the affected operation or schema rather than the whole document. Combined with the origin fix below, a change behind a cross-file $ref, including a $ref to a schema under an arbitrary top-level key, is sliced from the file it actually lives in.

Fixes

• Correct source locations for $refs into arbitrary top-level keys (via kin-openapi v0.143.0). A $ref to a schema stored under a non-components top-level key (./schemas.yaml#/User, the Swagger-2-era "definitions bag") used to lose its origin, so a change to it was reported at the referencing operation. It now reports the schema's own file and line, in -f json sources and in the review.

Go package changes

• Dependency: kin-openapi v0.143.0 (#1105, #1098). Removes the exported openapi3.StringMap[V] type (an internal helper, now just map[string]V), adds T.WalkParameters, preserves origins for $refs into arbitrary top-level keys, and declares stable codes on validation errors (openapi3.CodedError, openapi3.ValidationErrorCodes()). If your Go code referenced openapi3.StringMap, switch to map[string]V.
• Modernization (#1100, #1096). The errors.As dispatch is converted to Go 1.26 errors.AsType, and the flatten package now walks schemas via openapi3.WalkSchemas instead of a hand-rolled traversal.

Plus routine dependency bumps (#1099, #1104).

Commits

• 20e22eb feat(review): per-endpoint structural block extraction for large specs (#1068)
• cfbfbc1 validate: flag a parameter whose type union mixes structured and scalar (#105...
• bc42d62 validate: use kin's validation-error codes instead of deriving rule IDs (#1106)
• 69ff6fc deps: bump kin-openapi to v0.143.0 (#1105)
• d72589e chore(deps): bump actions/setup-go from 6 to 7 in the actions group (#1104)
• 0c7f48d validate: fixed registry of rule IDs; gate derived IDs through it (#1101)
• 4a3ab86 validate: convert errors.As to errors.AsType (#1100)
• 2414729 chore(deps): bump github.com/getkin/kin-openapi from 0.141.0 to 0.142.0 (#1098)
• 3c965e7 chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 (#1099)
• 79f0e57 refactor(flatten): walk schemas via openapi3.WalkSchemas (#1096)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #1399.