From 9b2625de10bc60316451bb0aa7df830d4c68d979 Mon Sep 17 00:00:00 2001
From: AJ Isaacs <ajisaacs27@gmail.com>
Date: Fri, 17 Jul 2026 21:12:43 -0400
Subject: [PATCH] chore(api): pin Microsoft.OpenApi 2.11.0 to fix
 GHSA-v5pm-xwqc-g5wc

Swashbuckle 10.1.4 pulls in Microsoft.OpenApi 2.4.1, which has a known
high-severity vulnerability. Pin the latest patched 2.x directly; 3.x
is binary-incompatible with Swashbuckle (swagger.json returns 500).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 TaskTracker.Api/TaskTracker.Api.csproj | 1 +
 1 file changed, 1 insertion(+)

diff --git a/TaskTracker.Api/TaskTracker.Api.csproj b/TaskTracker.Api/TaskTracker.Api.csproj
index 605cb23..0b7d811 100644
--- a/TaskTracker.Api/TaskTracker.Api.csproj
+++ b/TaskTracker.Api/TaskTracker.Api.csproj
@@ -10,6 +10,7 @@
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
+    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="10.1.4" />
   </ItemGroup>