aj/TaskTracker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(api): pin Microsoft.OpenApi 2.11.0 to fix GHSA-v5pm-xwqc-g5wc

Browse Source 
Swashbuckle 10.1.4 pulls in Microsoft.OpenApi 2.4.1, which has a known
high-severity vulnerability. Pin the latest patched 2.x directly; 3.x
is binary-incompatible with Swashbuckle (swagger.json returns 500).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
aj
2026-07-17 21:12:43 -04:00
co-authored by Claude Fable 5
parent 2c91e0360a
commit 9b2625de10
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TaskTracker.Api/TaskTracker.Api.csproj
+1
View File
@@ -10,6 +10,7 @@
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
<PrivateAssets>all</PrivateAssets>
</PackageReference>
<PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
<PackageReference Include="Swashbuckle.AspNetCore" Version="10.1.4" />
</ItemGroup>