Update the go-openapi/swag family to v0.27.1

[dims]

This updates github.com/go-openapi/swag and its submodules from v0.25.4 to v0.27.1. It also updates github.com/go-openapi/jsonpointer to v1.0.0, which swag v0.27.1 requires, and github.com/go-openapi/jsonreference to v1.0.0 so the whole go-openapi set moves together.

The swag maintainers published two security advisories on 2026-07-19 that affect v0.25.4.

• GHSA-xh24-9qpg-8w28. Deeply nested JSON input can crash a program that parses it with the jsonutils module, because the parser had no recursion limit.
• GHSA-hwp8-w8pv-xq8f. A small YAML document that uses many anchors and aliases can use a very large amount of memory in the yamlutils module.

kube-openapi does not feed untrusted input into the affected functions, so this update is a precaution. It also avoids warnings from dependency scanners once the advisories reach the vulnerability databases.

The new go-openapi versions all require go 1.25.0, so the go directive in go.mod moves from 1.24.0 to 1.25.0. A second commit raises the CI minimum to match. It removes go 1.24 from the test matrix and raises the go directive cap in the verify step to 1.25.0. This is safe for every supported kubernetes release branch. The .go-version files show that release-1.33 builds with Go 1.25.11, release-1.34 and release-1.35 build with Go 1.25.12, and master builds with Go 1.26.5. A dependency with a go 1.25.0 directive builds on those branches even where the branch go.mod directive is still 1.24.0, because the toolchain in use satisfies the requirement.

Two more notes for reviewers:

• The swag/jsonname module is no longer needed. jsonpointer v1.0.0 now contains that code.
• The new swag/pools module appears as an indirect dependency.

I ran go build ./... and go test ./... on the root module and on the test/integration module. All tests pass.

NONE

[Jefftree]

/approve
/cc @liggitt

Overall these look like advisory fixes plus API additions, and I don't see any breaking compat changes. Leaving /lgtm to @liggitt, these go-openapi libraries have traditionally needed closer scrutiny than I'm confident giving on my own. Here's a summary of the changes:

• swag v0.25.4 → v0.27.1 (compare, 63 commits):
  • security fixes in jsonutils (GHSA-xh24-9qpg-8w28), yamlutils (GHSA-hwp8-w8pv-xq8f), and loading (GHSA-v2xp-g8xf-22pf)
  • new pools module (#215), jsonname removed and moved to jsonpointer (#216)
  • conv and mangling unchanged
• jsonpointer v0.21.0 → v1.0.0 (compare, 125 commits):
  • the jsonname code moved in from swag (#141)
  • new NameProvider/Option (#122), RFC 6901 "-" suffix support (#121), nil-Set panic fix (22474992b)
• jsonreference v0.20.2 → v1.0.0 (compare, 96 commits):
  • reference.go (the public file) is license-header, reordering, and doc changes only.
• testify v2.0.2 → v2.6.0 (compare, 226 commits):
  • test-only dep, not imported outside tests

[dims]

/assign @liggitt

[liggitt]

• GHSA-xh24-9qpg-8w28. Deeply nested JSON input can crash a program that parses it with the jsonutils module, because the parser had no recursion limit.

good grief... how many json parsers do we have 🤦 we fixed that in stdlib and json-iterator years ago 😢

[liggitt]

/lgtm
/approve

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dims, Jefftree, liggitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [Jefftree]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment