Skip to content

fix(deps): pin Microsoft.OpenApi to 2.7.5 (resolve GHSA-v5pm-xwqc-g5wc)#129

Merged
JerrettDavis merged 2 commits into
mainfrom
fix/microsoft-openapi-vulnerability
Jul 14, 2026
Merged

fix(deps): pin Microsoft.OpenApi to 2.7.5 (resolve GHSA-v5pm-xwqc-g5wc)#129
JerrettDavis merged 2 commits into
mainfrom
fix/microsoft-openapi-vulnerability

Conversation

@JerrettDavis

@JerrettDavis JerrettDavis commented Jul 14, 2026

Copy link
Copy Markdown
Owner

Resolves the Microsoft.OpenApi 2.0.0 high-severity vulnerability (GHSA-v5pm-xwqc-g5wc) by adding an explicit PackageReference to version 2.7.5 in PokManager.ApiService.

dependabot Bot and others added 2 commits July 13, 2026 11:14
@dependabot
chore(deps): Bump the nuget-dependencies group with 6 updates
ef1c3ed 
Bumps MessagePack from 3.1.7 to 3.1.8
Bumps MudBlazor from 9.6.0 to 9.7.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.15.1 to 1.16.0
Bumps SQLitePCLRaw.lib.e_sqlite3 from 3.50.3 to 3.53.3
Bumps TinyBDD from 0.19.27 to 0.19.28
Bumps TinyBDD.Xunit from 0.19.27 to 0.19.28

---
updated-dependencies:
- dependency-name: MessagePack
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: MudBlazor
  dependency-version: 9.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: SQLitePCLRaw.lib.e_sqlite3
  dependency-version: 3.53.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@JerrettDavis @claude
fix(deps): pin Microsoft.OpenApi to 2.7.5 (resolve GHSA-v5pm-xwqc-g5wc …
7592d96 
…vulnerability)

Co-Authored-By: Claude <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 11 package(s) with unknown licenses.
See the Details below.

License Issues

src/Hosting/PokManager.AppHost/PokManager.AppHost.csproj

PackageVersionLicenseIssue Type
MessagePack3.1.8NullUnknown License

src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj

PackageVersionLicenseIssue Type
OpenTelemetry.Instrumentation.Runtime1.16.0NullUnknown License

src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj

PackageVersionLicenseIssue Type
Microsoft.OpenApi2.7.5NullUnknown License

src/Presentation/PokManager.Web/PokManager.Web.csproj

PackageVersionLicenseIssue Type
MudBlazor9.7.0NullUnknown License
SQLitePCLRaw.lib.e_sqlite33.53.3NullUnknown License

tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj

PackageVersionLicenseIssue Type
TinyBDD0.19.28NullUnknown License
TinyBDD.Xunit0.19.28NullUnknown License

tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj

PackageVersionLicenseIssue Type
TinyBDD0.19.28NullUnknown License

tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj

PackageVersionLicenseIssue Type
TinyBDD0.19.28NullUnknown License
TinyBDD.Xunit0.19.28NullUnknown License

tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj

PackageVersionLicenseIssue Type
TinyBDD0.19.28NullUnknown License
Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
nuget/MessagePack 3.1.8 UnknownUnknown
nuget/OpenTelemetry.Instrumentation.Runtime 1.16.0 🟢 8.3
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 30 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices🟢 5badge detected: Passing
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Packaging🟢 10packaging workflow detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 23 contributing companies or organizations
nuget/Microsoft.OpenApi 2.7.5 UnknownUnknown
nuget/MudBlazor 9.7.0 UnknownUnknown
nuget/SQLitePCLRaw.lib.e_sqlite3 3.53.3 UnknownUnknown
nuget/TinyBDD 0.19.28 UnknownUnknown
nuget/TinyBDD.Xunit 0.19.28 UnknownUnknown
nuget/TinyBDD 0.19.28 UnknownUnknown
nuget/TinyBDD 0.19.28 UnknownUnknown
nuget/TinyBDD.Xunit 0.19.28 UnknownUnknown
nuget/TinyBDD 0.19.28 UnknownUnknown

Scanned Files

  • src/Hosting/PokManager.AppHost/PokManager.AppHost.csproj
  • src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj
  • src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
  • src/Presentation/PokManager.Web/PokManager.Web.csproj
  • tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj
  • tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj
  • tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj
  • tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj

@JerrettDavis
JerrettDavis merged commit 2c4efc3 into main Jul 14, 2026
17 checks passed
JerrettDavis added a commit that referenced this pull request Jul 21, 2026
@JerrettDavis @claude
fix(deps): pin Microsoft.OpenApi to 2.7.5 to resolve CS0200 with AspN…
daed8d9 
…etCore.OpenApi 10.0.10

The nuget-dependencies group bump pulled Microsoft.OpenApi 3.9.0, whose
IOpenApiMediaType.Example API changed to read-only, breaking the
Microsoft.AspNetCore.OpenApi 10.0.10 source generator (CS0200). Pin
Microsoft.OpenApi back to the 2.7.5 line already known to be compatible
(previously pinned in #129 for GHSA-v5pm-xwqc-g5wc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
JerrettDavis added a commit that referenced this pull request Jul 22, 2026
@JerrettDavis @claude
fix(deps): pin Microsoft.OpenApi to 2.7.5 to resolve CS0200 with AspN…
09d847a 
…etCore.OpenApi 10.0.10

The nuget-dependencies group bump pulled Microsoft.OpenApi 3.9.0, whose
IOpenApiMediaType.Example API changed to read-only, breaking the
Microsoft.AspNetCore.OpenApi 10.0.10 source generator (CS0200). Pin
Microsoft.OpenApi back to the 2.7.5 line already known to be compatible
(previously pinned in #129 for GHSA-v5pm-xwqc-g5wc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
JerrettDavis added a commit that referenced this pull request Jul 22, 2026
@dependabot @JerrettDavis @claude
chore(deps): Bump the nuget-dependencies group with 20 updates (#131)
ebddfed 
* chore(deps): Bump the nuget-dependencies group with 20 updates

Bumps Microsoft.AspNetCore.OpenApi from 10.0.9 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Hosting.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Http.Resilience from 10.7.0 to 10.8.0
Bumps Microsoft.Extensions.Logging from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Options from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.ServiceDiscovery from 10.7.0 to 10.8.0
Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1
Bumps Microsoft.OpenApi from 2.7.5 to 3.9.0
Bumps NSubstitute from 5.3.0 to 6.0.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.16.0 to 1.17.0
Bumps System.Security.Cryptography.Xml from 10.0.9 to 10.0.10
Bumps TinyBDD from 0.19.28 to 0.19.29
Bumps TinyBDD.Xunit from 0.19.28 to 0.19.29

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Hosting.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): pin Microsoft.OpenApi to 2.7.5 to resolve CS0200 with AspNetCore.OpenApi 10.0.10

The nuget-dependencies group bump pulled Microsoft.OpenApi 3.9.0, whose
IOpenApiMediaType.Example API changed to read-only, breaking the
Microsoft.AspNetCore.OpenApi 10.0.10 source generator (CS0200). Pin
Microsoft.OpenApi back to the 2.7.5 line already known to be compatible
(previously pinned in #129 for GHSA-v5pm-xwqc-g5wc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(deps): document Microsoft.OpenApi 2.7.5 pin and ignore 3.x in Dependabot

Explain why the pin exists (AspNetCore.OpenApi 10.0.x source generator is
incompatible with OpenApi 3.x's read-only IOpenApiMediaType.Example) and add
a Dependabot ignore rule so future bumps don't silently reintroduce CS0200.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JerrettDavis <mxjerrett@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JerrettDavis