fix(security): 升级 kin-openapi 到 0.131.0 (CVE-2025-30153)

[fly333sky]

🔒 安全修复：CVE-2025-30153

升级 kin-openapi 到 0.131.0。

影响判断

本仓 go.mod 第 8 行声明 github.com/getkin/kin-openapi v0.127.0，低于 CVE-2025-30153 的修复版本 0.131.0，落在受影响区间（< 0.131.0）。漏洞为 kin-openapi 的 ZipFileBodyDecoder 在校验 multipart/form-data 时可被 ZIP 炸弹攻击耗尽内存，0.131.0 已修复。已将版本升级至 v0.131.0 并执行 go mod tidy 刷新 go.sum，go build ./... 编译通过。go mod tidy 同时调整了 kin-openapi 的传递依赖（移除 invopop/yaml，新增 oasdiff/yaml、oasdiff/yaml3），均为该组件的间接依赖，属本次修复范围。

验证

• 已跑本仓自带测试（通过）

来源

• CVE issue: CVE-2025-30153 #19
• Resolves CVE-2025-30153 #19

由 opensourceways/backlog cve-batch-fix 流水线自动提交（每日定时批量修复）。

[opensourceways-bot]

Welcome To opensourceways Community

Hey @fly333sky , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @TommyLike .

[opensourceways-bot]

CLA Signature Pass

fly333sky, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​getkin/​kin-openapi@​v0.127.0 ⏵ v0.131.0	+1

View full report