Bump Microsoft.OpenApi and Microsoft.OpenApi.YamlReader

[dependabot]

Updated Microsoft.OpenApi from 3.8.0 to 3.10.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.10.0

3.10.0 (2026-08-11)

Features

• adds deserialization of the example extension (e5a1080)
• do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
• serialize license identifier as extension for earlier versions (d090989)
• serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

• better nullability round-tripping (655c2c8)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
• deserialize metadata url from extension in earlier version (9387b01)
• marks deprecated properties from the specification as obsolete (787b045)
• marks deprecated properties from the specification as obsolete (953c22a)
• schema: serialize compatibility examples from examples list (5d8ec3a)
• serialize examples as extension in v2/v3 (ff1dbc9)
• serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

Commits viewable in compare view.

Updated Microsoft.OpenApi.YamlReader from 3.8.0 to 3.10.0.

Release notes

Sourced from Microsoft.OpenApi.YamlReader's releases.

3.10.0

3.10.0 (2026-08-11)

Features

• adds deserialization of the example extension (e5a1080)
• do not ignore multiple types when serializing to 3.0 (#​2960) (ebaf27a)
• serialize license identifier as extension for earlier versions (d090989)
• serialize license identifier as extension for earlier versions (60971ba)

Bug Fixes

• better nullability round-tripping (655c2c8)
• bound YAML anchor/alias expansion to prevent OOM (billion laughs) (#​3000) (2179326)
• deserialize metadata url from extension in earlier version (9387b01)
• marks deprecated properties from the specification as obsolete (787b045)
• marks deprecated properties from the specification as obsolete (953c22a)
• schema: serialize compatibility examples from examples list (5d8ec3a)
• serialize examples as extension in v2/v3 (ff1dbc9)
• serialize examples as extension in v2/v3 (edf3c67)

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code Coverage Overview

Languages: C#

C# / code-coverage/dotnet

The overall coverage in commit b6777c3 in the dependabot/nuget/src... branch is 94%. The coverage in commit 8aa8ab6 in the main branch is 95%.

Show a code coverage summary of the most impacted files.

File	main 8aa8ab6	dependabot/nuget/src... b6777c3	+/-
/home/runner/wo.../ArazzoInput.cs	99%	99%	0%

---

_{Updated August 14, 2026 14:54 UTC}