Upgrade Microsoft.OpenApi to 3.x when moving to .NET 11
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 38/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- csharp, github-actions, openapi
- 领域
- api, backend-api-design, devops
调研方向
The work is blocked on moving the project to .NET 11 and Microsoft.AspNetCore.OpenApi 11.x becoming stable. Start by checking TaskFlow.Api/TaskFlow.Api.csproj and .github/dependabot.yml, then compare /openapi/v1.json and npm run gen:api before and after the upgrade. Done means using Microsoft.OpenApi 3.5.4 or later, removing the major-version ignore and pin comment, and checking whether #165 adds a dependency constraint.
由索引模型根据 Issue 内容生成。
描述
Follow-up from #279 / #300 (chore(deps): ignore Microsoft.OpenApi major updates and document the 2.x pin).
Problem
Microsoft.OpenApi is pinned to 2.x (2.7.5, the CVE-2026-49451 / GHSA-v5pm-xwqc-g5wc fix for 2.x). The 3.x line cannot be used on .NET 10: Microsoft.AspNetCore.OpenApi on .NET 10 caps Microsoft.OpenApi below 3.0.0, and its source generator fails with CS0200 on IOpenApiMediaType.Example against 3.x.
Dependency ranges, from the published nuspecs on nuget.org:
Microsoft.AspNetCore.OpenApi |
Microsoft.OpenApi dependency |
|---|---|
| 10.0.8 (current) | 2.0.0 minimum |
| 10.0.14 (latest stable 10.x, 2026-10-30) | not re-checked; 10.0.13 was [2.12.2, 3.0.0) |
| 11.0.0-rc.3.26522.148 (latest, 2026-10-30) | not re-checked; rc.2 was [3.10.2, 4.0.0) |
There is no stable 11.0.0 yet. The project is staying on .NET 10 for now, so #300 added a Dependabot ignore for Microsoft.OpenApi major updates (.github/dependabot.yml, nuget block). That ignore has no expiry.
Scope
Upgrade Microsoft.OpenApi to a 3.x release once the project moves to .NET 11 (and Microsoft.AspNetCore.OpenApi 11.x is stable).
- Use 3.5.4 or later. 3.x versions up to 3.5.3 are affected by CVE-2026-49451; 3.5.4 is the patched release.
- Remove the
ignoreforMicrosoft.OpenApiin.github/dependabot.ymland the pin comment inTaskFlow.Api/TaskFlow.Api.csproj. - Re-check that
/openapi/v1.jsonandnpm run gen:apioutput are unchanged or intentionally changed. - Link with #165 (Asp.Versioning.Mvc v10), resolved 2026-10-30 from the nuspec:
Asp.Versioning.OpenApi10.2.3 depends onMicrosoft.OpenApi [2.7.5, 3.0.0), so adopting it on .NET 10 would block this upgrade until Asp.Versioning ships a release that accepts Microsoft.OpenApi 3.x. #165 is therefore on hold. Check for such a release before starting this issue. - Part of #372 (Move to .NET 11).
Blocked by
The decision to move the project to .NET 11. If that decision is never made, this issue can be closed together with the ignore rationale.
Created with Claude Code following #300
- 主要语言
- C#
- 星标
- 1
- 派生
- 0
- 平均合并
- 2 小时 2 分钟
- 30 天内合并 PR
- 98
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
nevridge/TaskFlow 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 65/100
维护者通常 1 天内回复
-
tech-debt
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
查看 nevridge/TaskFlow 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 74/100
juandresrodca/AdminForge#54 ·
-
要トリアージ 辞書
难度 1/5 1-3 小时 新手友好度 86/100
yksr-melt/Meltype#1625 · 1 个 reaction ·
维护者通常 1 天内回复
-
Docs typo未关闭
难度 1/5 1 小时以内 新手友好度 78/100
MonoGame/docs.monogame.github.io#328 · 1 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 70/100
space-wizards/RobustToolbox#7197 ·
维护者通常 1 天内回复
-
documentation high priority
难度 2/5 1-3 小时 新手友好度 76/100
lachydotmcg/capri-desktop#201 ·
维护者通常 1 天内回复