Skip to content

docs: sync after #806 (Microsoft.OpenApi pin version) #810

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sev7eNup merged 1 commit into from
Nov 6, 2026
+2 −2
Merged

docs: sync after #806 (Microsoft.OpenApi pin version) #810

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/roadmap.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -386,7 +386,7 @@ first verify it with the documented 500-parallel test, then commit. The gut-feel
Not our problem, but documented so it isn't tried again:

- **Microsoft.OpenApi 3.x** — Swashbuckle 10.2.3 requires the 2.x surface (transitive floor 2.7.5).
The pin on 2.x (currently 2.12.2) remains necessary. Only follow after a Swashbuckle major.
The pin on 2.x (currently 2.13.0) remains necessary. Only follow after a Swashbuckle major.
- **TypeScript 7** — `typescript-eslint` aborts hard on load; support is only planned from TS ≥ 7.1.
Side-by-side TS 6+7 or sacrificing the lint gate were both rejected.
- **Spectre.Console 0.57.2** — `Spectre.Console.Cli` ends stably at 0.55.0 and pins the core to
Expand Down
2 changes: 1 addition & 1 deletion docs/security-findings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,7 +495,7 @@ any package bump to keep this section honest.
### DEP-1 — Microsoft.OpenApi HIGH (GHSA-v5pm-xwqc-g5wc) — FIXED
`Swashbuckle.AspNetCore` 10.1.7 (and `WireMock.Net.OpenApiParser` in the test graph) pulled
`Microsoft.OpenApi` 2.4.1, vulnerable to an uncontrolled-recursion DoS on circular schema
refs. Overridden with a direct pin, currently 2.12.2 (still 2.x → Swashbuckle Models-namespace stays
refs. Overridden with a direct pin, currently 2.13.0 (still 2.x → Swashbuckle Models-namespace stays
compatible).

- [NodePilot.Api.csproj](../src/NodePilot.Api/NodePilot.Api.csproj) — `Microsoft.OpenApi` (version in [Directory.Packages.props](../Directory.Packages.props))
Expand Down
Loading