From 767c5a7ce8c5b3bb12aa55eff6f056ae01c27fa8 Mon Sep 17 00:00:00 2001
From: JerrettDavis <mxjerrett@gmail.com>
Date: Thu, 2 Jul 2026 21:52:39 -0500
Subject: [PATCH] fix(deps): pin Microsoft.OpenApi to 2.7.5
 (GHSA-v5pm-xwqc-g5wc)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 Directory.Packages.props                               | 3 +++
 src/FlowLedger.Api/FlowLedger.Api.csproj               | 2 ++
 tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj | 2 ++
 3 files changed, 7 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index e26d166..cda8efa 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -158,5 +158,8 @@
          Forced via a direct PackageReference in FlowLedger.AppHost.csproj. -->
     <PackageVersion Include="MessagePack" Version="3.1.7" />
     <PackageVersion Include="MessagePack.Annotations" Version="3.1.7" />
+    <!-- GHSA-v5pm-xwqc-g5wc: Microsoft.OpenApi 2.0.0 has a high-severity vulnerability.
+         2.7.5 is the patched version. -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>
 </Project>
diff --git a/src/FlowLedger.Api/FlowLedger.Api.csproj b/src/FlowLedger.Api/FlowLedger.Api.csproj
index 51a33e8..e5618ed 100644
--- a/src/FlowLedger.Api/FlowLedger.Api.csproj
+++ b/src/FlowLedger.Api/FlowLedger.Api.csproj
@@ -6,6 +6,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" />
+    <!-- Security override: pin Microsoft.OpenApi to 2.7.5 (GHSA-v5pm-xwqc-g5wc). -->
+    <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="FluentValidation" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" />
     <PackageReference Include="Quartz" />
diff --git a/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj b/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
index af27c88..4299968 100644
--- a/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
+++ b/tests/FlowLedger.Api.Tests/FlowLedger.Api.Tests.csproj
@@ -9,6 +9,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
+    <!-- Security override: pin Microsoft.OpenApi to 2.7.5 (GHSA-v5pm-xwqc-g5wc). -->
+    <PackageReference Include="Microsoft.OpenApi" />
     <PackageReference Include="coverlet.collector">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>