[nevridge]

Summary

Guards the Microsoft.OpenApi 2.x pin against automatic major-version Dependabot PRs and documents why it is pinned. This does not upgrade to 3.x: Microsoft.AspNetCore.OpenApi on .NET 10 cannot use it (details below). The real 3.x upgrade belongs in a separate follow-up issue, which this PR does not create.

Changes

• .github/dependabot.yml (nuget block): added an ignore for Microsoft.OpenApi with update-types: ["version-update:semver-major"] only. It is the only ignore entry, and nuget-minor-patch is untouched. A comment names the removal trigger: revisit when the project decides to move to .NET 11.
• TaskFlow.Api/TaskFlow.Api.csproj: added a comment above the Microsoft.OpenApi 2.7.5 reference. It says 2.7.5 is the patched 2.x release for CVE-2026-49451, that 3.x is blocked by the Microsoft.AspNetCore.OpenApi source generator (CS0200), and cites chore(deps): upgrade Microsoft.OpenApi to 3.x (blocked by AspNetCore.OpenApi source generator) #279. The version is unchanged.

No code, test, generated-client, doc or MicrosoftPlatformVersion change.

Findings (investigation for #279)

• CVE-2026-49451 (GHSA-v5pm-xwqc-g5wc, high): patched in 2.7.5 for the 2.x line (vulnerable >= 2.0.0-preview.11, <= 2.7.4) and in 3.5.4 for the 3.x line (vulnerable >= 3.0.0, <= 3.5.3). 2.7.5 is therefore the correct 2.x floor, and any future 3.x move needs >= 3.5.4.
• Microsoft.AspNetCore.OpenApi dependency on Microsoft.OpenApi (from the published nuspecs on nuget.org):
  • 10.0.8 (current): 2.0.0 minimum.
  • 10.0.13 (latest stable 10.x): [2.12.2, 3.0.0), capped below 3.0.0.
  • 11.0.0-rc.2.26504.105: [3.10.2, 4.0.0). This is the only line that supports 3.x, and there is no stable 11.0.0 yet.
• Decision: the project stays on .NET 10, so the ignore stays until the .NET 11 decision is revisited.
• Floor mismatch to watch: moving MicrosoftPlatformVersion to 10.0.13 or later would force the Microsoft.OpenApi pin up to 2.12.2 or later. This PR does not change either.
• chore: upgrade Asp.Versioning.Mvc to v10.0.0 #165 (Asp.Versioning.Mvc to v10.0.0, open): the migration may add Asp.Versioning.OpenApi, which has its own Microsoft.OpenApi dependency. The two pieces of work are decoupled here. Revisit the link if chore: upgrade Asp.Versioning.Mvc to v10.0.0 #165 adds that package.
• Follow-up: the 3.x upgrade should get its own issue, carrying the same removal trigger.

Verification (local)

Gate	Result
dotnet build TaskFlow.sln -c Release	PASS: 0 errors, 4 warnings (all NU1903, see below)
dotnet test (CI coverlet command)	PASS: 417/417, 91.6% line coverage (gate: 75%)
dotnet format TaskFlow.sln --verify-no-changes	PASS
dotnet list TaskFlow.sln package --vulnerable	PASS: no vulnerable packages
/openapi/v1.json on this branch vs main	Identical (68,458 bytes each; only servers[0].url differs, which is the port each instance ran on)
npm run gen:api against the running API	4 files generated, no content change (only LF/CRLF noise, reverted)

The OpenAPI document diff and gen:api were run before the rebase and the final comment rewording. Neither touches C# or the csproj.

Existing finding, not caused by this PR

dotnet list package --vulnerable --include-transitive reports SQLitePCLRaw.lib.e_sqlite3 2.1.11 (GHSA-2m69-gcr7-jv3q, high), pulled in through Microsoft.EntityFrameworkCore.Sqlite. It also shows as the NU1903 build warning. This diff touches no package versions, so it cannot have introduced it, but I did not run the scan against main to confirm. It needs its own issue. The direct-package check from the acceptance criteria passes.

Notes

• docker-compose.dcproj is skipped by dotnet list package because it uses package.config.
• The ignore has no automatic expiry, so the comment in dependabot.yml is the only reminder to revisit it.

Closes #279