bump to v2025-06-15

[azrosen92]

References the new generated openapi spec file for v2025-06-15

[dryrunsecurity]

This pull request includes a workflow that fetches an OpenAPI spec from raw.githubusercontent.com using an unpinned, mutable 'main' branch, creating a supply-chain risk where a compromised upstream repo or branch could inject a malicious spec; the workflow also lacks integrity checks (e.g., pinned commit hashes or checksums) to mitigate this. Consider pinning the URL to an immutable commit and/or adding verification to reduce the risk.

Potential Supply Chain Risk from Hardcoded External URL in .speakeasy/workflow.yaml

Vulnerability

Potential Supply Chain Risk from Hardcoded External URL

Description

The workflow configuration hardcodes a URL to fetch an OpenAPI specification from raw.githubusercontent.com using a mutable 'main' branch. This introduces a supply chain risk. If the source repository ('Gusto/Gusto-Partner-API') is compromised, a malicious OpenAPI specification could be injected. This malicious specification could then be used to generate a compromised SDK or lead to incorrect and potentially exploitable API configurations in downstream systems that consume the generated SDK.

gusto-python-client/.speakeasy/workflow.yaml

Lines 3 to 9 in ef1198c

	sources:
	Gusto-App-Int-OAS:
	inputs:
	- location: https://raw.githubusercontent.com/Gusto/Gusto-Partner-API/main/generated/app-integrations/api.v2025-06-15.app-integrations.yaml
	authHeader: Authorization
	authSecret: $openapi_doc_auth_token
	overlays:

Potential Supply Chain Risk from Hardcoded External URL in .speakeasy/workflow.yaml

Vulnerability

Potential Supply Chain Risk from Hardcoded External URL

Description

The workflow configuration hardcodes a URL to fetch an OpenAPI specification from raw.githubusercontent.com using a mutable branch reference ('main'). This introduces a supply chain risk. If the 'Gusto/Gusto-Partner-API' repository were compromised, a malicious OpenAPI specification could be injected into the 'main' branch. This malicious specification would then be fetched by the Speakeasy workflow, potentially leading to the generation of a compromised SDK or incorrect/malicious API configurations in downstream systems. The current configuration does not include any integrity checks (like checksums) for the fetched resource, nor does it pin to an immutable commit hash, which would mitigate this risk.

gusto-python-client/.speakeasy/workflow.yaml

Lines 15 to 21 in ef1198c

	location: registry.speakeasyapi.dev/gusto/ruby-sdk/gusto-app-int-oas
	Gusto-OAS:
	inputs:
	- location: https://raw.githubusercontent.com/Gusto/Gusto-Partner-API/refs/heads/main/generated/embedded/api.v2025-06-15.embedded.yaml
	authHeader: Authorization
	authSecret: $openapi_doc_auth_token
	overlays:

---

All finding details can be found in the DryRun Security Dashboard.

[satanas]

🚢