Repository navigation
chore: bumps the OpenAPI dependencies to the latest versions - #14340
Conversation
…rity reasons Signed-off-by: Vincent Biret <[email protected]>
GitHub Actions
Failure
Signed-off-by: Vincent Biret <[email protected]>
GitHub Actions
Inactive
There was a problem hiding this comment.
Pull request overview
This PR updates centrally-managed .NET package versions for OpenAPI-related dependencies, aiming to address security concerns by moving to newer releases.
Changes:
- Bumps
Microsoft.AspNetCore.OpenApifrom8.0.14to8.0.30. - Bumps
Microsoft.Azure.WebJobs.Extensions.OpenApifrom1.5.1to1.6.0. - Bumps
Microsoft.OpenApi.Readersfrom1.6.24to1.6.31.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): ccc6a28faf6d
Model: claude-opus-4.8
Overview
The PR bumps three OpenAPI NuGet versions in central package management (dotnet/Directory.Packages.props) for security reasons. Two of the bumps are clean: Microsoft.AspNetCore.OpenApi (8.0.30) is a patch-band bump used by one sample, and Microsoft.Azure.WebJobs.Extensions.OpenApi (1.6.0) has no project consumer and is inert. The remaining bump breaks the paired-version invariant between Microsoft.OpenApi.Readers and Microsoft.OpenApi: Microsoft.OpenApi.Readers 1.6.31 transitively requires Microsoft.OpenApi >= 1.6.31, but the core package is left pinned at 1.6.24, producing a deterministic NU1605 package-downgrade error that fails restore/build of the shipping Microsoft.SemanticKernel.Plugins.OpenApi assembly and all its consumers. The single finding below captures the residual risk; the one-line lockstep fix also satisfies the PR's stated security objective.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 high) across 1 file. Details are attached to the affected lines below.
Affected areas: dotnet/Directory.Packages.props
Vincent Biret (baywet)
changed the title
while working on #14340 I noticed some flaky unit tests are you can see in https://github.com/microsoft/semantic-kernel/actions/runs/32982261836/job/98221741513?pr=14340. This PR refactors the involved tests so they don't run into each other --------- Co-authored-by: Copilot Autofix powered by AI <[email protected]>
GitHub Actions
Inactive
This updates all the OpenAPI related dependencies since Microsoft.OpenAPI has released numerous patches.