From 209657913bfd71610559229fcc877202735eb05f Mon Sep 17 00:00:00 2001 From: Kyle Keirstead Date: Wed, 8 Jul 2026 12:03:58 -0700 Subject: [PATCH 1/2] Pin Microsoft.OpenApi to 2.7.5 to address GHSA-v5pm-xwqc-g5wc Microsoft.AspNetCore.OpenApi transitively pulls Microsoft.OpenApi 2.0.0, which has a known high severity vulnerability (NU1903). Transitive-pin it to the patched 2.7.5 and keep the Microsoft.OpenApi.Readers 1.x consumer on 1.6.29 via VersionOverride. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 1 + documentation/openapi.json | 21 ++++++++----------- eng/dependabot/independent/Packages.props | 1 + eng/dependabot/independent/Versions.props | 1 + ...ics.Monitoring.OpenApiGen.UnitTests.csproj | 1 + 5 files changed, 13 insertions(+), 12 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 9c25c8b1d13..306ebc5e0d8 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -21,6 +21,7 @@ + diff --git a/documentation/openapi.json b/documentation/openapi.json index aefed589a51..575af5e61af 100644 --- a/documentation/openapi.json +++ b/documentation/openapi.json @@ -2079,14 +2079,13 @@ "nullable": true }, "error": { + "type": "object", "oneOf": [ - { - "nullable": true - }, { "$ref": "#/components/schemas/OperationError" } - ] + ], + "nullable": true }, "operationId": { "type": "string", @@ -2100,14 +2099,13 @@ "$ref": "#/components/schemas/OperationState" }, "process": { + "type": "object", "oneOf": [ - { - "nullable": true - }, { "$ref": "#/components/schemas/OperationProcessInfo" } - ] + ], + "nullable": true }, "egressProviderName": { "type": "string", @@ -2143,14 +2141,13 @@ "$ref": "#/components/schemas/OperationState" }, "process": { + "type": "object", "oneOf": [ - { - "nullable": true - }, { "$ref": "#/components/schemas/OperationProcessInfo" } - ] + ], + "nullable": true }, "egressProviderName": { "type": "string", diff --git a/eng/dependabot/independent/Packages.props b/eng/dependabot/independent/Packages.props index 642c5c8f7bc..0483433faf1 100644 --- a/eng/dependabot/independent/Packages.props +++ b/eng/dependabot/independent/Packages.props @@ -10,6 +10,7 @@ + diff --git a/eng/dependabot/independent/Versions.props b/eng/dependabot/independent/Versions.props index 2ad8e490d7d..24e7b337d7e 100644 --- a/eng/dependabot/independent/Versions.props +++ b/eng/dependabot/independent/Versions.props @@ -8,6 +8,7 @@ 12.27.1 4.10.0 1.6.29 + 2.7.5 4.3.2 5.0.0 diff --git a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj index 12695464048..60e8bc7ecf0 100644 --- a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj +++ b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj @@ -12,6 +12,7 @@ + From 358c30eb5037a4e08b9d92461aabd9aa6a47b0bc Mon Sep 17 00:00:00 2001 From: Kyle Keirstead Date: Wed, 8 Jul 2026 23:52:03 -0700 Subject: [PATCH 2/2] Use Microsoft.OpenApi 2.7.5 everywhere; migrate tests off Microsoft.OpenApi.Readers Per PR feedback, drop the VersionOverride/downversioning for the OpenApiGen tests. Migrate the test to the Microsoft.OpenApi 2.x reader/validation API (OpenApiDocument.LoadAsync) and remove the now-unused Microsoft.OpenApi.Readers 1.x package. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 1 - eng/dependabot/independent/Packages.props | 1 - eng/dependabot/independent/Versions.props | 1 - ...ics.Monitoring.OpenApiGen.UnitTests.csproj | 3 +-- .../OpenApiGeneratorTests.cs | 21 ++++++++----------- 5 files changed, 10 insertions(+), 17 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 306ebc5e0d8..45544a15560 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -22,7 +22,6 @@ - diff --git a/eng/dependabot/independent/Packages.props b/eng/dependabot/independent/Packages.props index 0483433faf1..2d16d2a6d6d 100644 --- a/eng/dependabot/independent/Packages.props +++ b/eng/dependabot/independent/Packages.props @@ -11,7 +11,6 @@ - diff --git a/eng/dependabot/independent/Versions.props b/eng/dependabot/independent/Versions.props index 24e7b337d7e..43193f83cac 100644 --- a/eng/dependabot/independent/Versions.props +++ b/eng/dependabot/independent/Versions.props @@ -7,7 +7,6 @@ 12.29.1 12.27.1 4.10.0 - 1.6.29 2.7.5 4.3.2 5.0.0 diff --git a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj index 60e8bc7ecf0..5c05f0a841f 100644 --- a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj +++ b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests.csproj @@ -12,8 +12,7 @@ - - + diff --git a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/OpenApiGeneratorTests.cs b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/OpenApiGeneratorTests.cs index 25e40b09522..003d5c04a72 100644 --- a/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/OpenApiGeneratorTests.cs +++ b/src/Tests/Microsoft.Diagnostics.Monitoring.OpenApiGen.UnitTests/OpenApiGeneratorTests.cs @@ -3,10 +3,8 @@ using Microsoft.Diagnostics.Monitoring.TestCommon; using Microsoft.Diagnostics.Monitoring.TestCommon.Runners; -using Microsoft.OpenApi.Extensions; -using Microsoft.OpenApi.Models; -using Microsoft.OpenApi.Readers; -using Microsoft.OpenApi.Validations; +using Microsoft.OpenApi; +using Microsoft.OpenApi.Reader; using System; using System.Collections.Generic; using System.IO; @@ -80,11 +78,11 @@ public async Task BaselineDifferenceTestAsync() /// Test that the committed OpenAPI document is valid. /// [Fact] - public void BaselineIsValidTest() + public async Task BaselineIsValidTestAsync() { using FileStream stream = new(OpenApiBaselinePath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite); - ValidateDocument(stream); + await ValidateDocumentAsync(stream); } /// @@ -95,7 +93,7 @@ public async Task GeneratedIsValidTestAsync() { using FileStream stream = await GenerateDocumentAsync(); - ValidateDocument(stream); + await ValidateDocumentAsync(stream); } private async Task GenerateDocumentAsync() @@ -119,13 +117,12 @@ private async Task GenerateDocumentAsync() return new FileStream(path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite, 4096, FileOptions.DeleteOnClose); } - private static void ValidateDocument(FileStream stream) + private static async Task ValidateDocumentAsync(Stream stream) { - OpenApiStreamReader reader = new(); - OpenApiDocument document = reader.Read(stream, out OpenApiDiagnostic diagnostic); - Assert.Empty(diagnostic.Errors); + ReadResult result = await OpenApiDocument.LoadAsync(stream, OpenApiConstants.Json); + Assert.Empty(result.Diagnostic.Errors); - IEnumerable errors = document.Validate(ValidationRuleSet.GetDefaultRuleSet()); + IEnumerable errors = result.Document.Validate(ValidationRuleSet.GetDefaultRuleSet()); Assert.Empty(errors); } }