chore(deps): update dependabot to scan /cmd/osgen and fixes CVE-2026-56852 (#1019)

* chore(deps): bump kin-openapi to v0.144.0 and golang.org/x/text to v0.40.0

Fixes CVE-2026-56852 (High, CVSS 7.5): golang.org/x/text v0.14.0 had a
norm.Iter infinite loop on invalid UTF-8 input. The vulnerable library
entered the dependency graph via:

  kin-openapi v0.142.0 → santhosh-tekuri/jsonschema/v6 v6.0.2 → x/text v0.14.0

Bump kin-openapi from v0.142.0 to v0.144.0 and pin x/text to v0.40.0.

Fixes #1000

Signed-off-by: Ryan Yuan <ryan.yuan@crowdstrike.com>

* ci: point Dependabot at the cmd/osgen module

The gomod entry used the singular `directory: "/"` key, which reads one
manifest and cannot express a second, so the nested cmd/osgen module went
unwatched from the day it was added. Its kin-openapi requirement stayed on
0.142.0 long enough for the stale transitive golang.org/x/text to pick up
CVE-2026-56852.

Switch to the plural `directories` key with both module paths listed. Modules
are enumerated rather than globbed because linter testdata fixtures pin old
dependency versions on purpose and must stay out of scope; a glob such as
/cmd/* would eventually sweep them in.

Signed-off-by: Ryan Yuan <ryan.yuan@crowdstrike.com>

* ci: pin the Dependabot window to Tuesday 14:00 Pacific

Both update blocks used a bare `interval: "weekly"`, which lets Dependabot
choose the day and reads any `time` as UTC. Pin the day, time, and timezone so
the batch arrives predictably.

Tuesday 14:00 in Seattle is Wednesday 07:00 in Melbourne during AEST and
Wednesday 09:00 during AEDT, so the batch lands in work hours at both ends.
07:00 Pacific is the floor: the two cities are 17 hours apart for part of the
year, and anything earlier puts Melbourne back on Tuesday.

Signed-off-by: Ryan Yuan <ryan.yuan@crowdstrike.com>

---------

Signed-off-by: Ryan Yuan <ryan.yuan@crowdstrike.com>

Author: ryanyuan

.github/dependabot.yml

@@ -1,16 +1,36 @@
 version: 2
 updates:
+  # Every nested module needs its own entry here. Dependabot only reads the
+  # manifests it is pointed at, so a module missing from this list goes
+  # unwatched: cmd/osgen sat on kin-openapi 0.142.0 that way until the stale
+  # transitive golang.org/x/text picked up CVE-2026-56852. Listed explicitly
+  # rather than globbed so linter testdata fixtures, which pin old versions on
+  # purpose, are never picked up.
   - package-ecosystem: "gomod"
-    directory: "/"
+    directories:
+      - "/"
+      - "/cmd/osgen"
+    # The weekly batch lands Tuesday afternoon in Seattle, which is Wednesday
+    # morning in Melbourne, so it arrives in work hours on both sides. Keep the
+    # time at or after 07:00 Pacific: any earlier and the Melbourne side slips
+    # back to Tuesday for the half of the year when the gap is 17 hours rather
+    # than 19. A timezone is required, or `time` would be read as UTC.
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"
   - package-ecosystem: "github-actions"
     directory: "/"
+    # Same window as the gomod entry above.
     schedule:
       interval: "weekly"
+      day: "tuesday"
+      time: "14:00"
+      timezone: "America/Los_Angeles"
     labels:
       - "dependabot"
       - "dependencies"

CHANGELOG.md

@@ -4,11 +4,19 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ## [4.7.3]
 
+### Changed
+
+- Point Dependabot at the `cmd/osgen` module as well as the repository root. The `gomod` entry in `.github/dependabot.yml` used the singular `directory: "/"` key and so only ever read the root manifest, leaving the nested generator module unwatched since it was introduced. It now uses `directories` with both paths listed explicitly, which is what the singular key cannot express. Modules are listed one by one rather than globbed so that linter testdata fixtures, which pin old dependency versions deliberately, stay out of scope. Any nested module added later needs its own entry ([#1019](https://github.com/opensearch-project/opensearch-go/pull/1019))
+
 ### Fixed
 
 - Fix `opensearchutil.BulkIndexer` retaining a worker's peak batch memory after a traffic burst subsides. `(*worker).flush` released a completed batch with `w.items = w.items[:0]`, which keeps the slice's backing array -- and every `BulkIndexerItem` it holds, including each item's `Body` (an `io.ReadSeeker` over the caller's document bytes) and its `OnSuccess`/`OnFailure` closures -- reachable until a later batch of equal or greater size overwrites the slots. A worker that peaked at N items during a backlog replay stayed pinned at ~N items' worth of document bodies and closures indefinitely, even after traffic dropped. `flush` now `clear`s the item slice before truncating, dropping those references so the GC can reclaim them ([#912](https://github.com/opensearch-project/opensearch-go/issues/912))
 - Fix an unbounded connection/heap leak in node discovery when the cluster has a dedicated cluster manager (`cluster_manager` role with no work roles). The node was filtered out of the `allConns` inventory while the router received the unfiltered added/removed diffs, so `findConnectionByURL` never matched it: a new `*Connection` was created every discovery cycle and the stale one was never evicted, accumulating without bound in the round-robin fallback pool whose `checkDead` health checks repopulated a per-connection `poolRegistry` `sync.Map` each cycle (leak rate scaled with discovery frequency). `allConns` is now the full connection inventory so discovery reuses and evicts symmetrically, and dedicated cluster managers are excluded at request-routing selection instead: `RoundRobinPolicy` skips them in its `DiscoveryUpdate` add path and `multiServerPool.Next()` skips them during selection (including the no-router fallback), both gated on `IncludeDedicatedClusterManagers`. Discovery still bootstraps against a dedicated cluster manager seed via the seed-fallback pool ([#1003](https://github.com/opensearch-project/opensearch-go/pull/1003))
 
+### Dependencies
+
+- Bump `github.com/getkin/kin-openapi` from 0.142.0 to 0.144.0 and `golang.org/x/text` from 0.14.0 to 0.40.0 in `cmd/osgen` in order to resolve CVE-2026-56852. Details in the Pull Request ([#1019](https://github.com/opensearch-project/opensearch-go/pull/1019))
+
 ## [4.7.2]
 
 ### Fixed

cmd/osgen/go.mod

@@ -3,7 +3,7 @@ module github.com/opensearch-project/opensearch-go/v4/cmd/osgen
 go 1.25.9
 
 require (
-	github.com/getkin/kin-openapi v0.142.0
+	github.com/getkin/kin-openapi v0.144.0
 	github.com/google/renameio/v2 v2.0.2
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/mod v0.38.0
@@ -18,6 +18,6 @@ require (
 	github.com/oasdiff/yaml3 v0.0.14 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

cmd/osgen/go.sum

@@ -3,8 +3,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
 github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
-github.com/getkin/kin-openapi v0.142.0 h1:izj0vBdFprMhitfzaX8sTqztsEQyvwhssBoB6n8NO7w=
-github.com/getkin/kin-openapi v0.142.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
+github.com/getkin/kin-openapi v0.144.0 h1:hIRcTH+KjLfkLpYU6bSSfdFpi0fZi1fp+hSPi4aQu9Y=
+github.com/getkin/kin-openapi v0.144.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
 github.com/go-openapi/jsonpointer v0.22.5 h1:8on/0Yp4uTb9f4XvTrM2+1CPrV05QPZXu+rvu2o9jcA=
 github.com/go-openapi/jsonpointer v0.22.5/go.mod h1:gyUR3sCvGSWchA2sUBJGluYMbe1zazrYWIkWPjjMUY0=
 github.com/go-openapi/swag/jsonname v0.25.5 h1:8p150i44rv/Drip4vWI3kGi9+4W9TdI3US3uUYSFhSo=
@@ -32,8 +32,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=