From 595fab944eaf15949d2c1b30fcfeb9a473075a53 Mon Sep 17 00:00:00 2001
From: Andy Butland <abutland73@gmail.com>
Date: Wed, 22 Jul 2026 11:54:12 +0200
Subject: [PATCH] Hold Microsoft.OpenApi at 2.9.0 on the v17 line (do not
 auto-bump)

Microsoft.OpenApi 2.10.0+ reworked OpenAPI 3.0 nullability serialization
(regression confirmed in 2.11.0): nullable, type-less schemas emit
"enum": [null] and nullable oneOf $refs drop "nullable" entirely, which
corrupts the generated Delivery API 3.0 contract (fails OpenApiContractTest)
and misleads client code generation. The v17 line generates OpenAPI 3.0 via
Swashbuckle, so it is affected; the v18 line uses Microsoft.AspNetCore.OpenApi
(3.1) and is not.

Add a HOLD comment to the pin (central + Umbraco.Web.UI inline) so the routine
dependency-update process does not bump it, referencing the upstream tracking
issue https://github.com/microsoft/OpenAPI.NET/issues/2967. 2.9.0 is already
patched for CVE-2026-49451, so holding carries no security cost. Comment-only;
no version change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 Directory.Packages.props                 | 8 ++++++++
 src/Umbraco.Web.UI/Umbraco.Web.UI.csproj | 3 +++
 2 files changed, 11 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index e674b3ee50d6..0f637bb2bc25 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -99,6 +99,14 @@
       Microsoft.AspNetCore.OpenApi and Swashbuckle only require Microsoft.OpenApi >= 2.0.0, which otherwise
       resolves to a vulnerable 2.0.0 (CVE-2026-49451, GHSA-v5pm-xwqc-g5wc). Pin forward to a patched 2.x
       until the referencing packages raise their floor.
+
+      HOLD at 2.9.0 - do not bump. Microsoft.OpenApi 2.10.0+ reworked OpenAPI 3.0 nullability serialization
+      (regression confirmed in 2.11.0): nullable, type-less schemas emit "enum": [null] and nullable oneOf
+      $refs drop "nullable" entirely, which corrupts the generated Delivery API 3.0 contract (fails
+      OpenApiContractTest) and misleads client code generation. 2.9.0 is already CVE-patched, so holding
+      carries no security cost. Tracked upstream at https://github.com/microsoft/OpenAPI.NET/issues/2967;
+      bump only once the 2.x track ships a fix. If a security advisory forces a bump sooner, a Swashbuckle
+      schema-filter workaround will be needed to restore the 3.0 nullable output.
     -->
     <PackageVersion Include="Microsoft.OpenApi" Version="2.9.0" />
     <!--
diff --git a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
index 5927e97ec35e..7ce482c1b7e5 100644
--- a/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
+++ b/src/Umbraco.Web.UI/Umbraco.Web.UI.csproj
@@ -35,6 +35,9 @@
     Directory.Packages.props does not reach it. Reference it directly to force the patched version instead
     of the vulnerable 2.0.0 that Swashbuckle / Microsoft.AspNetCore.OpenApi otherwise resolve
     (CVE-2026-49451, GHSA-v5pm-xwqc-g5wc).
+
+    HOLD at 2.9.0 - do not bump; keep in sync with the central pin in Directory.Packages.props. 2.10.0+
+    regresses OpenAPI 3.0 nullability serialization. See https://github.com/microsoft/OpenAPI.NET/issues/2967.
     -->
     <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
   </ItemGroup>