Can we update the required minimum version of Swashbuckle.AspNetCore.SwaggerGen?

[mbp]

This library depends on Swashbuckle.AspNetCore.SwaggerGen = 10.0.0

However, there is a transitive vulnerability on Microsoft.OpenAPI v2.3.0

Package 'Microsoft.OpenApi' 2.3.0 has a known high severity vulnerability, GHSA-v5pm-xwqc-g5wc

└── MicroElements.Swashbuckle.FluentValidation (v7.1.7)                                                                                                                                                                                       
    └── Swashbuckle.AspNetCore.SwaggerGen (v10.0.0)                                                                                                                                                                                           
      └── Swashbuckle.AspNetCore.Swagger (v10.0.0)                                                                                                                                                                                          
        └── Microsoft.OpenApi (v2.3.0)    

If you update the requirement to depend on Swashbuckle.AspNetCore.SwaggerGen 10.2.1, then this release updated to a non-vulnerable dependency: https://github.com/domaindrivendev/Swashbuckle.AspNetCore/releases/tag/v10.2.1

[avgalex]

Fixed and released in 7.1.8 (now on NuGet). Thanks for the precise report and remediation pointer 🙏

The fix is exactly what you suggested: Swashbuckle.AspNetCore.SwaggerGen was bumped 10.0.0 → 10.2.1 on the net10.0 target, which pulls the patched Microsoft.OpenApi 2.7.5 transitively (verified with dotnet list package --include-transitive), closing GHSA-v5pm-xwqc-g5wc / CVE-2026-49451.

Note on the other target frameworks: the net8.0 / net9.0 builds depend on Swashbuckle.AspNetCore.SwaggerGen 8.1.1, which resolves Microsoft.OpenApi on the v1.x line — outside the advisory range (>= 2.0.0-preview11, <= 2.7.4) — so they were never affected and were left unchanged.

Upgrade to MicroElements.Swashbuckle.FluentValidation 7.1.8 and the transitive Microsoft.OpenApi will resolve to 2.7.5+.