ci: let ASP.NET Core decide when Microsoft.OpenApi moves major - #17
Merged
Conversation
Dependabot proposed Microsoft.OpenApi 2.11.0 -> 3.9.0 and the build went red in a file nobody here wrote: the source generator shipped inside Microsoft.AspNetCore.OpenApi 10.0.x assigns IOpenApiMediaType.Example, which the 3.x major made read-only. Nothing on this side can fix that. The generator is Microsoft's, it is compiled against the 2.x API, and the .targets exposes no way to switch it off — so the ceiling is ASP.NET Core's, not a preference held here. Nothing in the metadata carries it either. The nuspec declares a 2.0.0 floor and no ceiling, so NuGet resolves 3.9.0 without complaint and Dependabot reads an ordinary bump; the incompatibility exists only in the generator's compiled form and in a sentence of the release notes. A limit no tool can see is one that has to be written down, which is what this entry does. Only the major is frozen, and the restraint matters as much as the freeze: the explicit 2.11.0 reference in the OpenApi project is there to stay clear of GHSA-v5pm-xwqc-g5wc, so 2.x updates have to keep arriving. Freezing the dependency outright — as Microsoft.CodeAnalysis.* is frozen above — would have traded a broken build for a silent one, and this is a package whose whole reason for pinning was a security advisory. This is a decision with an expiry date. Microsoft.AspNetCore.OpenApi 11.0.0-preview already depends on Microsoft.OpenApi 3.6.0, so the major arrives on its own the day this repository targets net11.0 — carried in by the framework, with the compiler pointing at whatever OpenApiSchema reshaped. The entry is then deleted rather than revisited. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VZGwf9Cqea1f6sv2sEreQK
17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Freezes the major line of
Microsoft.OpenApifor Dependabot. #9 proposed 2.11.0 → 3.9.0 and turned the build red inside generated code, for a reason nothing on this side can address.Type of change
Changes
ignoreentry in.github/dependabot.yml, scoped toversion-update:semver-majoronMicrosoft.OpenApi.Why it is needed, in short:
Microsoft.AspNetCore.OpenApi10.0.x is compiled against the 2.x API and ships a source generator that writes into this project. Under 3.x that generated code no longer compiles —IOpenApiMediaType.Examplebecame read-only — so the build fails inOpenApiXmlCommentSupport.generated.cs, a file nobody here wrote. The package's.targetsexposes no property to disable the generator, so there is no local fix.The limit is invisible to tooling: the nuspec declares a
2.0.0floor and no ceiling, so NuGet resolves 3.9.0 happily and Dependabot sees a routine bump. The incompatibility exists only in the generator's compiled form and in one sentence of the 3.0.0 release notes ("ASP.net users should remain on […] version 2.X for ASP.net 10"). A constraint no tool can read has to be written down somewhere — hence this entry.Only the major is frozen, deliberately. The explicit
Microsoft.OpenApi2.11.0 reference in the OpenApi project exists to stay clear of GHSA-v5pm-xwqc-g5wc, so 2.x updates must keep arriving. Ignoring the dependency outright — the wayMicrosoft.CodeAnalysis.*is ignored above — would trade a broken build for a silent one on a package that was pinned for a security advisory in the first place.This has an expiry date:
Microsoft.AspNetCore.OpenApi11.0.0-preview already depends onMicrosoft.OpenApi3.6.0, so the major arrives on its own the day this repository targetsnet11.0. The entry is then deleted, not revisited.Testing
dotnet build -c Release— clean, warnings are errors heredotnet test -c Releasetests/PackageSmokeTest/run.shNot run, and not applicable: this touches only
.github/dependabot.yml, which no build step reads and no compiled code references. The file was parsed and the resultingignorelist inspected to confirm the entry is scoped to the major and does not widen the existing freezes.Public API
Documentation
docs/updatedCHANGELOG.mdanddocs/CHANGELOG.fr.mdboth updatedThe reasoning lives in the config file itself, beside the entry it explains, in the same form as the freezes already there.
Related issues
Closes #9.
🤖 Generated with Claude Code
https://claude.ai/code/session_01VZGwf9Cqea1f6sv2sEreQK
Generated by Claude Code