From 3e40a75d43bb7b52798f955ee5a6271120155e1d Mon Sep 17 00:00:00 2001
From: Bernhard Windisch <bwi@cocoar.dev>
Date: Sat, 11 Jul 2026 22:28:10 +0100
Subject: [PATCH] chore(deps): pin Microsoft.OpenApi to 2.7.5
 (GHSA-v5pm-xwqc-g5wc)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Microsoft.AspNetCore.OpenApi 10.0.x floats Microsoft.OpenApi at [2.0.0, ),
which resolves to 2.0.0 — flagged High by the CI NuGet audit since the
advisory published (circular schema references may terminate OpenAPI
parsing). Both 10.0.8 and 10.0.9 carry the same open range, so bumping
the parent doesn't help; pin the transitive directly to the patched 2.7.5
via a direct reference from Modgud.Api (nearest-wins lifts the whole graph).

Unblocks CI for every open PR; develop itself was last green before the
advisory landed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/dotnet/Directory.Packages.props     | 6 ++++++
 src/dotnet/Modgud.Api/Modgud.Api.csproj | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/src/dotnet/Directory.Packages.props b/src/dotnet/Directory.Packages.props
index 9a77a5ad..f9d7b182 100644
--- a/src/dotnet/Directory.Packages.props
+++ b/src/dotnet/Directory.Packages.props
@@ -26,6 +26,12 @@
     <PackageVersion Include="ITfoxtec.Identity.Saml2.MvcCore" Version="4.18.0" />
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.8" />
+    <!-- Transitive-CVE pin: Microsoft.AspNetCore.OpenApi floats Microsoft.OpenApi
+         at [2.0.0, ), which resolves to the vulnerable 2.0.0
+         (GHSA-v5pm-xwqc-g5wc, circular-schema-reference DoS in parsing).
+         Referenced directly from Modgud.Api so the whole graph lifts to the
+         patched 2.x. Drop this once AspNetCore.OpenApi requires >= 2.7.5. -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.8" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.8" />
     <PackageVersion Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.23.0" />
diff --git a/src/dotnet/Modgud.Api/Modgud.Api.csproj b/src/dotnet/Modgud.Api/Modgud.Api.csproj
index 6df9498d..777f10c2 100644
--- a/src/dotnet/Modgud.Api/Modgud.Api.csproj
+++ b/src/dotnet/Modgud.Api/Modgud.Api.csproj
@@ -22,6 +22,9 @@
     <PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" />
     <PackageReference Include="Serilog.AspNetCore" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
+    <!-- Direct reference solely to pin the transitive above the vulnerable
+         2.0.0 — see the note in Directory.Packages.props. -->
+    <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="Cocoar.JsEval.TsDefinition" />
     <PackageReference Include="Cocoar.Reflectensions" />
     <PackageReference Include="Cocoar.SignalARRR.Server" />