From 5fe0156f09b014783bdc685fc1996001ada5374a Mon Sep 17 00:00:00 2001
From: Dmitry Kurochkin <kudima03@gmail.com>
Date: Wed, 5 Aug 2026 08:43:43 +0000
Subject: [PATCH] Pin Microsoft.OpenApi to 2.11.0 to fix NU1903 vulnerability

Microsoft.AspNetCore.OpenApi resolves Microsoft.OpenApi to its
minimum-declared version (2.0.0), which is affected by
GHSA-v5pm-xwqc-g5wc. Pinning it directly forces resolution to a
patched version.
---
 ...e.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.csproj | 1 +
 ...tionalSchema.Storage.Abstractions.OpenAPI.Schema.Tests.csproj | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.csproj b/src/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.csproj
index cd01d06..a0b0765 100644
--- a/src/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.csproj
+++ b/src/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.csproj
@@ -18,5 +18,6 @@
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
   </ItemGroup>
 </Project>
diff --git a/src/Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests.csproj b/src/Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests.csproj
index 495ac7f..c45d015 100644
--- a/src/Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests.csproj
+++ b/src/Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests/Pure.RelationalSchema.Storage.Abstractions.OpenAPI.Schema.Tests.csproj
@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.*" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.11.0" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />