ci: let ASP.NET Core decide when Microsoft.OpenApi moves major

.github/dependabot.yml

@@ -28,6 +28,22 @@ updates:
       - dependency-name: "Microsoft.CodeAnalysis.Common"
       - dependency-name: "Microsoft.CodeAnalysis.Analyzers"
 
+      # Microsoft.OpenApi's major line belongs to ASP.NET Core, not to this repository.
+      # Microsoft.AspNetCore.OpenApi 10.0.x is compiled against the 2.x API and ships a source
+      # generator that writes into this project; under 3.x that generated code stops compiling —
+      # IOpenApiMediaType.Example became read-only — so the bump breaks the build inside a file
+      # nobody here wrote, and nothing on this side can fix it. No metadata records the limit: the
+      # nuspec declares a 2.0.0 floor and no ceiling, so neither NuGet nor Dependabot can see the
+      # incompatibility, and it surfaces only at compile time. That is precisely why the ceiling
+      # has to be stated here.
+      #
+      # Only the major is frozen, and that restraint is the point: the explicit 2.11.0 reference
+      # exists to stay clear of GHSA-v5pm-xwqc-g5wc, so 2.x updates must keep arriving. ASP.NET
+      # Core 11 already depends on Microsoft.OpenApi 3.x, which makes this entry the thing to
+      # delete the day this repository targets net11.0 — not a position to defend.
+      - dependency-name: "Microsoft.OpenApi"
+        update-types: ["version-update:semver-major"]
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule: