Swashbuckle 10.1.4 pulls in Microsoft.OpenApi 2.4.1, which has a known
high-severity vulnerability. Pin the latest patched 2.x directly; 3.x
is binary-incompatible with Swashbuckle (swagger.json returns 500).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>