fix: update vervet dependencies

Bumps Go dependencies to their latest minor versions.

getkin/kin-openapi is in v0 and introduced breaking changes in v0.113.0
that this changeset deals with: https://github.com/getkin/kin-openapi#v01130

OpenAPI Extensions are now of type map[string]interface{} instead of a
map embedded in a struct. This impacts the way Reflect Walk has to be
performed.

A few openapi3 types have now an `extra` unexported field which needs to
be ignored when comparing struct with go-cmp.

A mergeMap generic utility function has been introduced to simplify
merging components and avoid code repetition.

collator.go

@@ -133,8 +133,16 @@ func (c *Collator) mergeTags(rv *ResourceVersion) error {
 }
 
 func (c *Collator) mergeComponents(rv *ResourceVersion) error {
+	if rv.Components == nil {
+		return nil
+	}
+
+	if c.result.Components == nil {
+		c.result.Components = &openapi3.Components{}
+	}
+
 	initDestinationComponents(c.result, rv.T)
-	var errs error
+
 	inliner := NewInliner()
 	for k, v := range rv.T.Components.Schemas {
 		ref := "#/components/schemas/" + k
@@ -217,19 +225,19 @@ func (c *Collator) mergeComponents(rv *ResourceVersion) error {
 			c.componentSources[ref] = rv.path
 		}
 	}
-	if errs == nil {
-		err := inliner.Inline(rv.T)
-		if err != nil {
-			errs = multierr.Append(errs, err)
-		}
-	}
-	return errs
+	return inliner.Inline(rv.T)
 }
 
 var cmpComponents = cmp.Options{
 	// openapi3.Schema has some unexported fields which are ignored for the
 	// purposes of content comparison.
-	cmpopts.IgnoreUnexported(openapi3.Schema{}),
+	cmpopts.IgnoreUnexported(
+		openapi3.HeaderRef{},
+		openapi3.ParameterRef{},
+		openapi3.ResponseRef{},
+		openapi3.Schema{},
+		openapi3.SchemaRef{},
+	),
 	// Refs themselves can mutate during relocation, so they are excluded from
 	// content comparison.
 	cmp.FilterPath(func(p cmp.Path) bool {

docs/github.com/snyk/vervet/v5.md

@@ -10,7 +10,7 @@ Package vervet supports opinionated API versioning tools\.
 
 - [Constants](<#constants>)
 - [Variables](<#variables>)
-- [func ExtensionString(extProps openapi3.ExtensionProps, key string) (string, error)](<#func-extensionstring>)
+- [func ExtensionString(extensions map[string]interface{}, key string) (string, error)](<#func-extensionstring>)
 - [func IncludeHeaders(doc *Document) error](<#func-includeheaders>)
 - [func IsExtensionNotFound(err error) bool](<#func-isextensionnotfound>)
 - [func LoadVersions(root fs.FS) ([]*openapi3.T, error)](<#func-loadversions>)
@@ -182,7 +182,7 @@ var ErrNoMatchingVersion = fmt.Errorf("no matching version")
 ## func [ExtensionString](<https://github.com/snyk/vervet/blob/main/resource.go#L275>)
 
 ```go
-func ExtensionString(extProps openapi3.ExtensionProps, key string) (string, error)
+func ExtensionString(extensions map[string]interface{}, key string) (string, error)
 ```
 
 ExtensionString returns the string value of an OpenAPI extension\.

document.go

@@ -78,11 +78,7 @@ func NewDocumentFile(specFile string) (_ *Document, returnErr error) {
 	if err != nil {
 		return nil, err
 	}
-	resolver, err := newRefAliasResolver(&t)
-	if err != nil {
-		return nil, err
-	}
-	err = resolver.resolve()
+	err = newRefAliasResolver(&t).resolve()
 	if err != nil {
 		return nil, err
 	}
@@ -93,6 +89,11 @@ func NewDocumentFile(specFile string) (_ *Document, returnErr error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to load %q: %w", specBase, err)
 	}
+
+	if t.Components == nil {
+		t.Components = &openapi3.Components{}
+	}
+
 	return &Document{
 		T:    &t,
 		path: specFile,
@@ -193,7 +194,7 @@ func (d *Document) LoadReference(relPath, refPath string, target interface{}) (_
 
 // Version returns the version of the document.
 func (d *Document) Version() (Version, error) {
-	vs, err := ExtensionString(d.ExtensionProps, ExtSnykApiVersion)
+	vs, err := ExtensionString(d.Extensions, ExtSnykApiVersion)
 	if err != nil {
 		return Version{}, err
 	}
@@ -202,7 +203,7 @@ func (d *Document) Version() (Version, error) {
 
 // Lifecycle returns the lifecycle of the document.
 func (d *Document) Lifecycle() (Lifecycle, error) {
-	ls, err := ExtensionString(d.ExtensionProps, ExtSnykApiLifecycle)
+	ls, err := ExtensionString(d.Extensions, ExtSnykApiLifecycle)
 	if err != nil {
 		if IsExtensionNotFound(err) {
 			// If it's not marked as deprecated or sunset, assume it's released.

go.mod

@@ -3,58 +3,65 @@ module github.com/snyk/vervet/v5
 go 1.19
 
 require (
-	github.com/bmatcuk/doublestar/v4 v4.2.0
-	github.com/dop251/goja v0.0.0-20220408131256-ffe77e20c6f1
+	github.com/bmatcuk/doublestar/v4 v4.6.0
+	github.com/dop251/goja v0.0.0-20230203172422-5460598cfa32
 	github.com/frankban/quicktest v1.13.0
-	github.com/getkin/kin-openapi v0.93.0
+	github.com/getkin/kin-openapi v0.114.0
 	github.com/ghodss/yaml v1.0.0
-	github.com/go-git/go-git/v5 v5.4.2
+	github.com/go-git/go-git/v5 v5.5.2
 	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/manifoldco/promptui v0.9.0
 	github.com/mitchellh/reflectwalk v1.0.2
 	github.com/olekukonko/tablewriter v0.0.5
-	github.com/urfave/cli/v2 v2.3.0
+	github.com/urfave/cli/v2 v2.24.3
 	github.com/vmware-labs/yaml-jsonpath v0.3.2
-	go.uber.org/multierr v1.7.0
+	go.uber.org/multierr v1.9.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
-	github.com/Microsoft/go-winio v0.5.1 // indirect
-	github.com/ProtonMail/go-crypto v0.0.0-20220113124808-70ae35bab23f // indirect
+	github.com/Microsoft/go-winio v0.6.0 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230201104953-d1d05f4e2bfb // indirect
 	github.com/acomagu/bufpipe v1.0.3 // indirect
-	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.1 // indirect
-	github.com/dlclark/regexp2 v1.4.1-0.20201116162257-a2a8dda75c91 // indirect
-	github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960 // indirect
-	github.com/emirpasic/gods v1.12.0 // indirect
+	github.com/chzyer/readline v1.5.1 // indirect
+	github.com/cloudflare/circl v1.3.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/dlclark/regexp2 v1.8.0 // indirect
+	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg v1.5.0 // indirect
-	github.com/go-git/go-billy/v5 v5.3.1 // indirect
-	github.com/go-openapi/jsonpointer v0.19.5 // indirect
-	github.com/go-openapi/swag v0.19.15 // indirect
+	github.com/go-git/go-billy/v5 v5.4.0 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
 	github.com/go-sourcemap/sourcemap v2.1.3+incompatible // indirect
 	github.com/gorilla/mux v1.8.0 // indirect
-	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/imdario/mergo v0.3.13 // indirect
+	github.com/invopop/yaml v0.2.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
-	github.com/kevinburke/ssh_config v1.1.0 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
 	github.com/kr/pretty v0.3.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-runewidth v0.0.13 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
+	github.com/perimeterx/marshmallow v1.1.4 // indirect
+	github.com/pjbgf/sha1cd v0.2.3 // indirect
+	github.com/rivo/uniseg v0.4.3 // indirect
 	github.com/rogpeppe/go-internal v1.6.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sergi/go-diff v1.2.0 // indirect
-	github.com/stretchr/testify v1.8.0 // indirect
-	github.com/xanzy/ssh-agent v0.3.1 // indirect
-	go.uber.org/atomic v1.9.0 // indirect
-	golang.org/x/crypto v0.0.0-20211202192323-5770296d904e // indirect
-	golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 // indirect
-	golang.org/x/sys v0.0.0-20220114195835-da31bd327af9 // indirect
-	golang.org/x/text v0.3.7 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/skeema/knownhosts v1.1.0 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
+	golang.org/x/crypto v0.5.0 // indirect
+	golang.org/x/mod v0.7.0 // indirect
+	golang.org/x/net v0.5.0 // indirect
+	golang.org/x/sys v0.4.0 // indirect
+	golang.org/x/text v0.6.0 // indirect
+	golang.org/x/tools v0.5.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )