From 3bb53c660c94af3356cc00c9016b702a8a0552a7 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Thu, 2 Jul 2026 13:24:09 +0000
Subject: [PATCH] Pin Microsoft.OpenApi to patched version

---
 Directory.Packages.props | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index c665218..7f99121 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,12 +1,15 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <AspireVersion>13.1.2</AspireVersion>
   </PropertyGroup>
 
   <!-- ASP.NET Core Dependencies -->
   <ItemGroup Label="ASP.NET Core">
     <PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.7" />
+    <!-- Pin to patched version to avoid CVE-2026-49451 (stack overflow on circular schema refs). -->
+    <PackageVersion Include="Microsoft.OpenApi" Version="2.7.5" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
   </ItemGroup>