From 9ddaab8ae217ff6b0a3ef738ff5ad9649d448aa9 Mon Sep 17 00:00:00 2001
From: avgalex <6c65787870@protonmail.ch>
Date: Wed, 1 Jul 2026 22:09:16 +0300
Subject: [PATCH] release: 7.1.8 (Issue #220 Microsoft.OpenApi security fix +
 Issue #216 media types)

- Bump Swashbuckle.AspNetCore.SwaggerGen 10.0.0 -> 10.2.1 on the net10.0
  target, pulling patched Microsoft.OpenApi 2.7.5 (was transitively 2.3.0).
  Closes the transitive high-severity advisory GHSA-v5pm-xwqc-g5wc /
  CVE-2026-49451 (CWE-674 uncontrolled recursion on circular $ref schemas)
  reported in Issue #220. net8.0/net9.0 use Swashbuckle 8.1.1 -> OpenApi v1,
  outside the advisory range.
- Test project (net10.0): bump Swashbuckle.AspNetCore(.Annotations) to 10.2.1
  and the direct Microsoft.OpenApi pin 2.3.0 -> 2.7.5 (clears Dependabot alert #2).
- Cut stable 7.1.8: drop beta suffix in version.props; CHANGELOG rolls up the
  #216 media-type/file-size work from 7.1.8-beta.1/beta.2 plus the #220 fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                               | 4 ++++
 .../MicroElements.Swashbuckle.FluentValidation.csproj      | 3 ++-
 ...MicroElements.Swashbuckle.FluentValidation.Tests.csproj | 7 ++++---
 version.props                                              | 2 +-
 4 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index bd1cf5f..4f735b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# Changes in 7.1.8
+- Security (Issue #220): closed a transitive high-severity advisory in the published package. `Swashbuckle.AspNetCore.SwaggerGen` on the net10.0 target was bumped `10.0.0` → `10.2.1`, which resolves `Microsoft.OpenApi` to the patched `2.7.5` (was `2.3.0`). This clears **GHSA-v5pm-xwqc-g5wc / CVE-2026-49451** (CWE-674 uncontrolled recursion — a circular `$ref` schema could stack-overflow the OpenAPI reader). The net8.0/net9.0 targets use Swashbuckle 8.1.1 → Microsoft.OpenApi v1 and were never in the advisory range
+- Media type & file size validation for `IFormFile` uploads (Issue #216): stable rollup of everything in `7.1.8-beta.1` and `7.1.8-beta.2` below (new File-level rules `.FileContentType()`, `.MaxFileSize()`, `.MinFileSize()`, `.FileSizeBetween()`; Swashbuckle / NSwag / Microsoft.AspNetCore.OpenApi emit multipart `encoding.contentType` and description annotations)
+
 # Changes in 7.1.8-beta.2
 - All of `7.1.8-beta.1` below, plus: **Microsoft.AspNetCore.OpenApi** now also emits `encoding.contentType` for the file part (Issue #216) — the `FluentValidationOperationTransformer` writes `requestBody.content["multipart/form-data"].encoding.<part>.contentType` so UIs like Scalar/Swagger UI can show the accepted media types, not just the description. Works on net9.0 (inline form schema) and net10.0 (resolves the whole-body `$ref` component to find the part name)
 
diff --git a/src/MicroElements.Swashbuckle.FluentValidation/MicroElements.Swashbuckle.FluentValidation.csproj b/src/MicroElements.Swashbuckle.FluentValidation/MicroElements.Swashbuckle.FluentValidation.csproj
index fcfb705..8132166 100644
--- a/src/MicroElements.Swashbuckle.FluentValidation/MicroElements.Swashbuckle.FluentValidation.csproj
+++ b/src/MicroElements.Swashbuckle.FluentValidation/MicroElements.Swashbuckle.FluentValidation.csproj
@@ -18,7 +18,8 @@
   <Import Project="..\common.props" />
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-    <PackageReference Include="Swashbuckle.AspNetCore.SwaggerGen" Version="10.0.0" />
+    <!-- 10.2.1 pulls patched Microsoft.OpenApi >= 2.7.5 (GHSA-v5pm-xwqc-g5wc / CVE-2026-49451). See issue #220. -->
+    <PackageReference Include="Swashbuckle.AspNetCore.SwaggerGen" Version="10.2.1" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0' Or '$(TargetFramework)' == 'net9.0'">
diff --git a/test/MicroElements.Swashbuckle.FluentValidation.Tests/MicroElements.Swashbuckle.FluentValidation.Tests.csproj b/test/MicroElements.Swashbuckle.FluentValidation.Tests/MicroElements.Swashbuckle.FluentValidation.Tests.csproj
index c529a22..8feaf89 100644
--- a/test/MicroElements.Swashbuckle.FluentValidation.Tests/MicroElements.Swashbuckle.FluentValidation.Tests.csproj
+++ b/test/MicroElements.Swashbuckle.FluentValidation.Tests/MicroElements.Swashbuckle.FluentValidation.Tests.csproj
@@ -20,9 +20,10 @@
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.0.0" />
-    <PackageReference Include="Swashbuckle.AspNetCore.Annotations" Version="10.0.0" />
-    <PackageReference Include="Microsoft.OpenApi" Version="2.3.0" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.1" />
+    <PackageReference Include="Swashbuckle.AspNetCore.Annotations" Version="10.2.1" />
+    <!-- Patched: 2.3.0 is vulnerable to GHSA-v5pm-xwqc-g5wc / CVE-2026-49451. -->
+    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net8.0' Or '$(TargetFramework)' == 'net9.0'">
diff --git a/version.props b/version.props
index d57ff45..554c461 100644
--- a/version.props
+++ b/version.props
@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
     <VersionPrefix>7.1.8</VersionPrefix>
-    <VersionSuffix>beta.2</VersionSuffix>
+    <VersionSuffix></VersionSuffix>
   </PropertyGroup>
 </Project>