From f1dc282312489d3c08027378aef08d21bcc8c68b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 6 Nov 2026 03:07:12 +0000 Subject: [PATCH] docs: sync after #806 (Microsoft.OpenApi pin version) #806 raised the direct Microsoft.OpenApi pin from 2.12.2 to 2.13.0; the 'currently 2.12.2' claims in docs/security-findings.md (DEP-1) and docs/roadmap.md (externally blocked) now name 2.13.0. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_015i2XpadaZfbLcuyc9KPLdV --- docs/roadmap.md | 2 +- docs/security-findings.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/roadmap.md b/docs/roadmap.md index 7df549f1..e52ebf8a 100644 --- a/docs/roadmap.md +++ b/docs/roadmap.md @@ -386,7 +386,7 @@ first verify it with the documented 500-parallel test, then commit. The gut-feel Not our problem, but documented so it isn't tried again: - **Microsoft.OpenApi 3.x** — Swashbuckle 10.2.3 requires the 2.x surface (transitive floor 2.7.5). - The pin on 2.x (currently 2.12.2) remains necessary. Only follow after a Swashbuckle major. + The pin on 2.x (currently 2.13.0) remains necessary. Only follow after a Swashbuckle major. - **TypeScript 7** — `typescript-eslint` aborts hard on load; support is only planned from TS ≥ 7.1. Side-by-side TS 6+7 or sacrificing the lint gate were both rejected. - **Spectre.Console 0.57.2** — `Spectre.Console.Cli` ends stably at 0.55.0 and pins the core to diff --git a/docs/security-findings.md b/docs/security-findings.md index 82355cfc..6862f27e 100644 --- a/docs/security-findings.md +++ b/docs/security-findings.md @@ -495,7 +495,7 @@ any package bump to keep this section honest. ### DEP-1 — Microsoft.OpenApi HIGH (GHSA-v5pm-xwqc-g5wc) — FIXED `Swashbuckle.AspNetCore` 10.1.7 (and `WireMock.Net.OpenApiParser` in the test graph) pulled `Microsoft.OpenApi` 2.4.1, vulnerable to an uncontrolled-recursion DoS on circular schema -refs. Overridden with a direct pin, currently 2.12.2 (still 2.x → Swashbuckle Models-namespace stays +refs. Overridden with a direct pin, currently 2.13.0 (still 2.x → Swashbuckle Models-namespace stays compatible). - [NodePilot.Api.csproj](../src/NodePilot.Api/NodePilot.Api.csproj) — `Microsoft.OpenApi` (version in [Directory.Packages.props](../Directory.Packages.props))