chore(deps): bump the go-dependencies group with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/pb33f/libopenapi and golang.org/x/tools.

Updates github.com/pb33f/libopenapi from 0.34.0 to 0.38.7

Release notes

Sourced from github.com/pb33f/libopenapi's releases.

v0.38.7 improves composed bundling by correctly lifting external Security Scheme references—including bare-file and component-fragment refs—into components.securitySchemes, with safeguards against misclassifying wrapper maps or complete OpenAPI documents. Arazzo engines can now inject a context-aware SleepFunc through EngineConfig, enabling replay-safe retry delays in durable workflow runtimes and deterministic tests while preserving existing behavior by default. This release also adds regression coverage for empty Security Requirement objects and updates golang.org/x/sync to v0.22.0.

@​kriptoburak @​khalidDaoud

v0.38.6

Fixes daveshanley/vacuum#928

v0.38.5

Fixes #597

v0.38.4

Just an internal refactor and deduplication of code, and build speed upgrades. No fixes, no features, no breaking changes,

v0.38.3

Fixes concurrent rendering issues stemming from changes in how the YAML lib has changed between RCs

#594

@​gnuletik

v0.38.2

Bumps to rc6 on yaml and fixed $def handling in bundler.

v0.38.1

Fixes #590 and moved to our own fork of testify

v0.38.0

Improves parse/index performance and memory use with lazy SpecInfo JSON generation, lower-allocation node indexing, faster component-path conversion, and reduced goroutine overhead in small translation/schema paths.

Adds SkipMetadataCollection for consumers that do not need diagnostic index metadata, allowing faster/lighter parsing for large documents.

Tightens YAML handling around duplicate keys, merge/root errors, empty overlays, and YAML v4 rc.5 rendering behavior.

Fixes OpenAPI 3.0 webhooks extraction so same-named scalar values no longer create empty webhook maps.

Improves change detection and generator metadata fidelity, including anchor-insensitive YAML comparisons and preserved/inferred

YAML tags for generated enum/const metadata.

@​asadtariq96

v0.37.3

Address issue #581

v0.37.2

Provides a deeper fix for #575

v0.37.1

Addresses regression identified in #575

... (truncated)

Commits

• 0837c9b coverage
• 1338994 coverage
• dd2a700 fix: compose external security scheme refs during bundling (#932)
• a1e9b6a Bump golang.org/x/sync from 0.21.0 to 0.22.0
• 01d2e4d arazzo: make the retry sleeper injectable via EngineConfig.SleepFunc
• af8d024 test: cover empty security requirements
• f078cc8 tuneups
• 87a6330 fix: rebase external circular refs during inline bundling (vacuum #928)
• 2abedeb Address #597
• d4c45ce tune up build
• Additional commits viewable in compare view

Updates golang.org/x/tools from 0.42.0 to 0.48.0

Commits

• 05f9cb5 go.mod: update golang.org/x dependencies
• 745d7ae gopls: add CompiledAsmFiles in cache.Package
• 797ee67 go/ssa: make Const(unsafe.Pointer, nil).IsNil() true
• 9751125 gopls/internal/test: Completion benchmarks use empty range
• 8786a96 internal/stdlib: update stdlib index for Go 1.27 Release Candidate 2
• 425085f gopls/internal/server: modify return of parseAction
• 30c4f87 go/analysis/passes/nilness: skip magic cgo functions
• 9e6441d gopls/internal/protocol/generate: remove manual rename overwritten
• df96841 gopls/internal/protocol: use Debug log level
• 278f062 gopls/internal/protocol: update to LSP 3.18
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions