ci: stop Dependabot proposing Microsoft.OpenApi 3.x - #704
Merged
Conversation
The 3.0 object model made IOpenApiMediaType.Example read-only, and Microsoft.AspNetCore.OpenApi 10.0.10's source generator still assigns it, so the bump fails in generated code: OpenApiXmlCommentSupport.generated.cs: error CS0200: Property or indexer IOpenApiMediaType.Example cannot be assigned to -- it is read only Nothing in this repository can reach that, so the PR is unfixable rather than merely broken, and Dependabot would reopen it every Monday. The direct Microsoft.OpenApi reference exists only to clear GHSA-v5pm-xwqc-g5wc, which Microsoft.AspNetCore.OpenApi reintroduces by pinning 2.0.0 transitively. Only majors are ignored, so 2.x minors and patches still arrive and a later advisory in that line is not masked -- 2.11.0 is available and will come through on the next run. Same shape as the existing Angular and TypeScript major ignores. Drop it once Microsoft.AspNetCore.OpenApi ships a release built against 3.x, at which point the direct reference should go too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#702 bumps
Microsoft.OpenApi2.7.5 → 3.9.0 and fails the backend build. It is unfixable here, not merely broken.Why it cannot build
3.0 made
IOpenApiMediaType.Exampleread-only.Microsoft.AspNetCore.OpenApi10.0.10's XML comment source generator still assigns it:That file is generated at build time by the ASP.NET Core package. No edit in this repository reaches it, so the only options are to stay on 2.x or drop OpenAPI support.
Why we cannot just drop the direct reference
The csproj comment names the exit condition: the pin exists solely to clear GHSA-v5pm-xwqc-g5wc, because
Microsoft.AspNetCore.OpenApi10.0.10 pins the vulnerableMicrosoft.OpenApi2.0.0 transitively. I checked NuGet — 10.0.10 is still the newest release, so no patched floor exists yet and the pin has to stay.Change
Ignore major updates for
Microsoft.OpenApionly, matching how the npm ecosystem already ignores Angular, Angular Material and TypeScript majors.Minor and patch updates inside 2.x still come through, so a later advisory in that line is not masked. 2.11.0 is available and should arrive on the next run.
Not a silent cap
The ignore carries its reason, the exact compiler error, and the condition for removing it, so whoever sees a 3.x release land does not have to rediscover why it was blocked.
Worth noting the auto-merge workflow behaved correctly here: #702 is a group PR containing a major, and the #344 guard held it for review rather than merging a broken build.
Closes #702.