chore: bump github.com/meshery/schemas to v1.3.20

[leecalcote]

Symptom

The automated schemas dependency-bump workflow (notify-dependents for the meshery/schemas v1.3.20 release) failed during go mod tidy with:

go: github.com/meshery/meshkit/utils/kubernetes imports
    k8s.io/cli-runtime/pkg/resource imports
    k8s.io/kube-openapi/pkg/spec3 imports
    github.com/go-openapi/swag imports
    github.com/go-openapi/swag/loading tested by
    github.com/go-openapi/swag/loading.test imports
    github.com/go-openapi/testify/enable/yaml/v2 imports
    github.com/go-openapi/testify/v2/assert/yaml: module github.com/go-openapi/testify/v2@latest found (v2.6.0), but does not contain package github.com/go-openapi/testify/v2/assert/yaml

Root cause

Upstream ecosystem breakage in the go-openapi module family, unrelated to the schemas release content:

• github.com/go-openapi/swag/loading v0.25.4 (an indirect dep via k8s.io/kube-openapi) pins github.com/go-openapi/testify/enable/yaml/v2 v2.0.2 in its go.mod.
• enable/yaml/v2 v2.0.2 imports github.com/go-openapi/testify/v2/assert/yaml. That package exists only in testify/v2 v2.0.x; it was deleted in v2.1.2+ (replaced by testify/v2/enable/stubs/yaml).
• go get github.com/meshery/schemas@v1.3.20 transitively raises go-openapi/swag/jsonname to v0.25.5, which raises the MVS-selected testify/v2 above v2.0.2 - while enable/yaml/v2 stays at v2.0.2. The selected enable/yaml/v2 then imports a package no selected (or latest) testify/v2 provides, and go mod tidy cannot converge.

On master (schemas v1.3.17), go mod tidy still converged before this PR - the whole go-openapi group was pinned at the mutually consistent v2.0.2/v0.25.4 set. The breakage is latent: any dependency bump that raises the selected testify/v2 (this schemas bump, or any other upgrade touching the go-openapi group) trips it. Master's committed go.sum did carry a few stale entries (e.g. go-git v5.16.4) that tidy prunes; those are cleaned up here too.

Fix

Two commits:

1. fix: bump go-openapi/swag/loading to v0.25.5 so go mod tidy converges - raises go-openapi/swag/loading v0.25.4 -> v0.25.5 (pulling conv/jsonutils/typeutils/yamlutils to v0.25.5 with it). swag/loading v0.25.5 requires enable/yaml/v2 v2.4.0, which imports testify/v2/enable/stubs/yaml instead of the removed assert/yaml, restoring a consistent module graph. This is the minimal correct fix: no replace directives (meshkit is a library), no pin of testify/v2 (no tagged v2.1.2+ version contains assert/yaml, so a pin cannot work), and only a patch-level move within the v0.25.x swag line rather than jumping to swag v0.26/v0.27.
2. chore: bump github.com/meshery/schemas to v1.3.20 - the bump the workflow attempted, plus the transitive upgrades go get/go mod tidy produce.

Verification

• go mod tidy converges and is idempotent (second run is a no-op)
• go build ./... passes
• go vet ./utils/... passes

Related but distinct: #963 / #1043 track a separate docker/docker/api vs moby/moby/api module-path tidy failure; this PR does not touch that.

[gemini-code-assist]

Code Review

This pull request updates several Go dependencies in go.mod and go.sum, including upgrading github.com/getkin/kin-openapi, github.com/meshery/schemas, golang.org/x/sync, golang.org/x/text, google.golang.org/api, and gorm.io/gorm, alongside various indirect dependencies. Some unused indirect dependencies have also been removed. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.