fix: remove version restrictions from rules and fix rate-limit ref resolution#154
Merged
TristanSpeakEasy merged 4 commits intomainfrom Feb 16, 2026
Merged
Conversation
…ecs and fix rate-limit ref resolution
TristanSpeakEasy
added
bug
Contributor
There was a problem hiding this comment.
Pull request overview
This PR broadens OpenAPI rule applicability by removing version pinning from a set of linter rules, and improves correctness of the OWASP rate-limit rules by ensuring responses referenced via $ref are evaluated (instead of being skipped when unresolved). It also adds tests for version filtering behavior in the linter engine.
Changes:
- Remove
Versions()restrictions from 17 rules so they apply to all OpenAPI 3.x versions (including newer 3.2+). - Add
$refresolution logic toowasp-rate-limitandowasp-rate-limit-retry-afterso referenced responses are linted. - Add
TestLinter_VersionFilteringto validate prefix matching and nil/empty version behavior.
Reviewed changes
Copilot reviewed 38 out of 38 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| openapi/linter/rules/parameter_description.go | Versions() now returns nil (applies to all versions). |
| openapi/linter/rules/parameter_description_test.go | Metadata test now asserts Versions() is nil. |
| openapi/linter/rules/owasp_string_restricted.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_string_restricted_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_string_limit.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_string_limit_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_security_hosts_https_oas3.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_security_hosts_https_oas3_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_rate_limit.go | Versions() removed; adds $ref resolution attempt for responses. |
| openapi/linter/rules/owasp_rate_limit_test.go | Adds $ref response coverage test; metadata expects nil versions. |
| openapi/linter/rules/owasp_rate_limit_retry_after.go | Versions() removed; adds $ref resolution attempt for 429 response. |
| openapi/linter/rules/owasp_rate_limit_retry_after_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_protection_global_unsafe_strict.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_protection_global_unsafe_strict_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_protection_global_unsafe.go | Clarifies comments around security: [] semantics. |
| openapi/linter/rules/owasp_protection_global_safe.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_protection_global_safe_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_no_numeric_ids.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_no_numeric_ids_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_no_additional_properties.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_no_additional_properties_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_jwt_best_practices.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_jwt_best_practices_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_integer_limit.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_integer_limit_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_integer_format.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_integer_format_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_array_limit.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_array_limit_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/owasp_additional_properties_constrained.go | Versions() now returns nil. |
| openapi/linter/rules/owasp_additional_properties_constrained_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/oas3_api_servers.go | Versions() now returns nil. |
| openapi/linter/rules/oas3_api_servers_test.go | Metadata test updated to expect nil versions. |
| openapi/linter/rules/host_trailing_slash.go | Versions() now returns nil. |
| openapi/linter/rules/host_trailing_slash_test.go | Metadata test updated to expect nil versions. |
| linter/rule.go | Expands Versions() documentation (exact + prefix matching). |
| linter/document.go | Updates VersionFilter comment/examples and clarifies nil/empty behavior. |
| linter/linter_test.go | Adds TestLinter_VersionFiltering coverage. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
📊 Test Coverage ReportCurrent Coverage: Coverage Change: 📈 +.1% (improved) Coverage by Package
📋 Detailed Coverage by Function (click to expand)
Generated by GitHub Actions |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ThomasRooney
approved these changes
Feb 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
$refresolution inowasp-rate-limitandowasp-rate-limit-retry-afterrules — responses using$refwere silently skipped becauseGetObject()returned nil on unresolved referenceslinter/linter_test.gocovering prefix matching and nil/empty version behaviorTest plan
Versions()returnsnilTestLinter_VersionFilteringcovers prefix matching, nil, and empty version casesTestOwaspRateLimitRule_RefResponsesverifies$refresolution in rate-limit rulemise cipasses (format, lint, test, build)