oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)
From v1.13.2 through v1.18.0, oasdiff did not enforce –allow-external-refs=false (library: openapi3.Loader.IsExternalRefsAllowed = false) when loading a spec from a git revision (the rev:path form, e.g. main:openapi.yaml). External $refs were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.