NuGet advisories not tracked by Dependabot: Microsoft.OpenApi reaches the shipped RCL

[deanleigh]

dotnet build reports two high-severity NuGet advisories. Neither is tracked by Dependabot — every one of the 54 alerts on main is npm, so these are invisible on the security tab and only show up as build warnings.

Found while establishing a verification baseline before #138.

The advisories

1. Microsoft.OpenApi 2.4.1 — affects the shipped RCL

• GHSA-v5pm-xwqc-g5wc: circular schema references may terminate OpenAPI parsing
• Vulnerable >= 2.0.0-preview.11, <= 2.7.4, patched in 2.7.5
• Reaches both UpDoc.csproj and TailoredTravel.Web.csproj

Umbraco.Cms.Api.Common (17.5.3)
  └── Swashbuckle.AspNetCore (10.1.7)
      └── Swashbuckle.AspNetCore.Swagger (10.1.7)
          └── Microsoft.OpenApi (2.4.1)

This is the only vulnerable package in the RCL, and it is the one that matters: UpDoc.csproj is what gets packed and published as Umbraco.Community.UpDoc, so consumers inherit the transitive.

2. SQLitePCLRaw.lib.e_sqlite3 2.1.11 — mirror only

• GHSA-2m69-gcr7-jv3q
• Only reaches TailoredTravel.Web, via Umbraco.Cms. Not in the RCL, so it does not ship.

Why this one is worth attention

The vulnerability is in OpenAPI parsing, reached through Swashbuckle — the exact machinery that generates UpDoc's Swagger document, registered in #134 and about to be extended in #138.

#138 adds [ProducesResponseType] across 35 endpoints, which grows the generated schema considerably. Circular schema references are the trigger condition in the advisory, and richer response models are where circular references become possible. That is not a reason to delay #138, but it is a reason to fix this rather than leave it.

Options

1. Wait for Umbraco. The clean fix. Umbraco.Cms.Api.Common bumps Swashbuckle, which bumps Microsoft.OpenApi. No action here beyond tracking.
2. Pin Microsoft.OpenApi to >= 2.7.5 in UpDoc.csproj. Direct PackageReference overriding the transitive. Fixes it now, but adds a pin that has to be removed later — and the last such pin (MimeKit) had to be removed when it turned into a downgrade, per the comment already in the csproj.
3. Accept and document. Lowest effort, but it ships to consumers as a package-level advisory.

Leaning towards 1, with 2 if a release is due before Umbraco moves.

Done when

• Decide between pin and wait
• dotnet list package --vulnerable clean for UpDoc.csproj, or the residue consciously accepted and written down
• Confirm whether the mirror's SQLite advisory needs anything, given it is local-only

Refs #51 (the npm-side equivalent), #134, #138.

[deanleigh]

Correction on scope: the solution build reports five NU1903 advisories, not the two originally recorded here. The extra three appear only when building UpDoc.sln rather than an individual project.

tests/UpDoc.Tests    System.Security.Cryptography.Xml 10.0.6   x3
  GHSA-cvvh-rhrc-wg4q
  GHSA-g8r8-53c2-pm3f
  GHSA-mmjf-rqrv-855v

These are test-project only, so they do not ship and do not reach consumers of the NuGet package. Lower priority than the Microsoft.OpenApi advisory in the RCL, which remains the one that matters.

Baseline for reference: dotnet build UpDoc.sln gives 29 warnings (0 errors) across all four projects; building TailoredTravel.Web alone gives 12.