chore: upgrade to libopenapi v0.41.1 and github.com/pb33f/go-yaml

[daveshanley]

Brings the validator up to libopenapi v0.41.1. That includes the move to github.com/pb33f/go-yaml and one fix for a libopenapi behavior change that broke two tests.

Dependencies

• libopenapi v0.38.6 → v0.41.1. v0.41.1 adds the bundler fix for [BUG] [v0.38] Bundler duplicates a schema (Name__<dir>) when one file is referenced from both allOf and properties libopenapi#644 on top of v0.41.0.
• go.yaml.in/yaml/v4 → github.com/pb33f/go-yaml v0.1.0, pb33f's fork. libopenapi's models carry the fork's yaml.Node, so the validator must use the same module. The package is still yaml, so 23 files change their import path and nothing else.
• jsonpath v0.8.4, testify v0.1.1 and ordered-map v2.3.2 all use the same module.
• Go 1.26: libopenapi requires it, so go.mod does too.

CI

• The build job now reads the Go version from go.mod. It was pinned to 1.25. Checkout now runs before setup-go so the file exists when setup-go reads it.
• golangci-lint v2.8 → v2.12. v2.12 is built with Go 1.26 and can lint a Go 1.26 module. Locally, golangci-lint run ./... reports 0 issues.

Fix: referenced schemas and their root document

These two tests pass against libopenapi v0.38.6 and fail from v0.39 on:

• TestSingleSchemaCompilePreferred_ResolvedExternalReferenceUsesSingleSchemaCompiler
• TestCompileSchemaForValidation_NestedResourceRenderFailure

What changed in libopenapi. v0.39 started attributing schemas to the file their content came from. For a component-level $ref, Schema().GetIndex() now names the target file (models.yaml). The schema's root node deliberately stays the authored $ref node in the referring file (openapi.yaml).

Why the validator failed. buildSchemaDocumentResources searched for that node in the target file's document. It wasn't there, so the function returned schema node was not found in its root document.

The fix. schemaRootLocation looks for the node in the schema's index first. If it isn't there, it tries the parent proxy's index, which libopenapi documents as the file the $ref was written in. The function then builds the resource set from whichever document holds the node. That restores the v0.38.6 resource layout: an entry pointer into openapi.yaml, plus the reachable models.yaml resource.

Tests

• go build, go vet, golangci-lint and go test -race ./... all pass.
• TestSchemaRootLocation covers the node being in the schema's own document, and being in no candidate document with a parent proxy that has no index.
• New code is at 100%. Overall coverage matches main (98.6%), and the previously uncovered blocks are unchanged.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.27%. Comparing base (f309f59) to head (4a37d8f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #324   +/-   ##
=======================================
  Coverage   98.27%   98.27%           
=======================================
  Files          75       75           
  Lines        9192     9203   +11     
=======================================
+ Hits         9033     9044   +11     
  Misses        132      132           
  Partials       27       27           

Flag	Coverage Δ
unittests	98.27% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.