Swashbuckle 10.1.4 pulls in Microsoft.OpenApi 2.4.1, which has a known high-severity vulnerability. Pin the latest patched 2.x directly; 3.x is binary-incompatible with Swashbuckle (swagger.json returns 500). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>