chore(deps): bump github.com/pb33f/libopenapi from 0.38.6 to 0.38.7

[dependabot]

Bumps github.com/pb33f/libopenapi from 0.38.6 to 0.38.7.

Release notes

Sourced from github.com/pb33f/libopenapi's releases.

v0.38.7 improves composed bundling by correctly lifting external Security Scheme references—including bare-file and component-fragment refs—into components.securitySchemes, with safeguards against misclassifying wrapper maps or complete OpenAPI documents. Arazzo engines can now inject a context-aware SleepFunc through EngineConfig, enabling replay-safe retry delays in durable workflow runtimes and deterministic tests while preserving existing behavior by default. This release also adds regression coverage for empty Security Requirement objects and updates golang.org/x/sync to v0.22.0.

@​kriptoburak @​khalidDaoud

Commits

• 0837c9b coverage
• 1338994 coverage
• dd2a700 fix: compose external security scheme refs during bundling (#932)
• a1e9b6a Bump golang.org/x/sync from 0.21.0 to 0.22.0
• 01d2e4d arazzo: make the retry sleeper injectable via EngineConfig.SleepFunc
• af8d024 test: cover empty security requirements
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: dependencies, go. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

🔍 CI Pipeline Status

✅ Lint: success
✅ Test: success
✅ Coverage: success
✅ Build: success
✅ Integration: success

---

📊 Coverage Report: Available in checks above
🔗 Artifacts: Test results and coverage reports uploaded

[SebastienMelki]

@dependabot rebase\n\nReview note: dependency bump itself looks low risk and OpenAPI-targeted tests pass, but the branch is stale/diverged from current main. Please rebase and rerun CI before merge.

[SebastienMelki]

Reviewed after Dependabot rebase: libopenapi patch bump; fresh CI is green.