fix(readers): bound YAML anchor/alias expansion, configurable via reader settings - #3019

Closed

Vincent Biret (baywet) with Copilot wants to merge 2853 commits into

copilot/supportv1-port-bug-fix

This pull request is big! We're only showing the most recent 250 commits

Commits on Mar 31, 2026

Merge pull request #2803 from microsoft/release-please--branches--main--components--Microsoft.OpenApi
Vincent Biret (baywet)
authored
d4bc21e

Commits on Apr 7, 2026

Bump Microsoft.NET.Test.Sdk from 18.3.0 to 18.4.0
dependabot[bot]
authored
c4bb175

Commits on Apr 8, 2026

Merge pull request #2807 from microsoft/dependabot/nuget/test/Microsoft.OpenApi.Hidi.Tests/multi-4b4f90437e
github-actions[bot]
authored
495a809

Commits on Apr 13, 2026

Commits on Apr 14, 2026

Commits on Apr 15, 2026

Commits on Apr 16, 2026

ci: upgrades repository to net10
Vincent Biret (baywet)
committed
b6ed9eb

Commits on Apr 17, 2026

Commits on Apr 18, 2026

Merge pull request #2829 from microsoft/dependabot/nuget/test/Microsoft.OpenApi.Hidi.Tests/coverlet-20b9a813ee
Vincent Biret (baywet)
authored
60f8f74

Commits on Apr 20, 2026

chore(deps): bump dependabot/fetch-metadata from 3.0.0 to 3.1.0
dependabot[bot]
authored
4071fb3

Commits on Apr 21, 2026

Commits on Apr 22, 2026

chore(deps): bump googleapis/release-please-action from 4 to 5
dependabot[bot]
authored
cb50481

Commits on Apr 23, 2026

Merge pull request #2836 from microsoft/dependabot/github_actions/googleapis/release-please-action-5
Vincent Biret (baywet)
authored
78e17ca

Commits on Apr 27, 2026

fix: null reference exception for boolean component schemas

Vincent Biret (baywet)
and
Copilot
committed
fe0b50a
test(schema): validate empty schema serialization across all OpenAPI versions

Vincent Biret (baywet)
and
Copilot
committed
b6c1fe8
test(schema): add deserialization tests for empty and boolean schemas

Vincent Biret (baywet)
and
Copilot
committed
b9b9b75
test(schema): validate false schema deserializes to not with empty object

Vincent Biret (baywet)
and
Copilot
committed
7d43b15
tests: pass serialization format to disambiguate

Vincent Biret (baywet)
and
Copilot
committed
15c1305
fix(schema): support boolean schemas in deserializer for OpenAPI 3.1/3.2

Vincent Biret (baywet)
and
Copilot
committed
05b44be
docs(schema): document boolean schema serialization and deserialization

Vincent Biret (baywet)
and
Copilot
committed
509f332
perf(schema): optimize boolean schema deserialization

Vincent Biret (baywet)
and
Copilot
committed
7316e3f
test(schema): rename deserialization test for clarity

Vincent Biret (baywet)
and
Copilot
committed
a54c0fd
Merge pull request #2839 from microsoft/fix/true-schema-component
Vincent Biret (baywet)
authored
f97f91a
chore(main): release 3.5.3
release-please-token-provider[bot]
authored
8dce238
Merge pull request #2842 from microsoft/release-please--branches--main--components--Microsoft.OpenApi
Vincent Biret (baywet)
authored
776af11

Commits on Apr 28, 2026

Commits on May 13, 2026

Commits on May 14, 2026

Commits on May 19, 2026

Commits on May 26, 2026

Commits on May 27, 2026

Commits on May 28, 2026

Commits on May 29, 2026

feat(reader): remove ParseNode infrastructure

Vincent Biret (baywet)
and
Copilot
committed
157e72b
chore(reader): prune unused JsonNode helpers

Vincent Biret (baywet)
and
Copilot
committed
83ea307
chore(reader): remove CreateAny helper

Vincent Biret (baywet)
and
Copilot
committed
582563f
chore(benchmark): update performance reports

Vincent Biret (baywet)
and
Copilot
committed
78b6d60
chore: remove unused parameters
Vincent Biret (baywet)
committed
0fec6aa
chore: renames files to match new class name
Vincent Biret (baywet)
committed
f3f7adb
chore: renames files to match new class name
Vincent Biret (baywet)
committed
8cafa7b
Merge pull request #2859 from microsoft/release-please--branches--main--components--Microsoft.OpenApi
Vincent Biret (baywet)
authored
2d0af62
chore(reader): normalize JsonNode variable casing

Vincent Biret (baywet)
and
Copilot
committed
b509007
chore(reader): discard unused callback parameters

Vincent Biret (baywet)
and
Copilot
committed
929b8e4
chore(reader): normalize JsonNode local casing

Vincent Biret (baywet)
and
Copilot
committed
8ae59af
chore: reverts hallucinations
Vincent Biret (baywet)
committed
d1d0fcb
chore: moves using after the copyright
Vincent Biret (baywet)
committed
54cf5dc

Commits on Jun 1, 2026

Commits on Jun 3, 2026

Merge pull request #2870 from microsoft/chore/additional-coverage
Vincent Biret (baywet)
authored
21488c6

Commits on Jun 9, 2026

fix(library): avoid false circular refs for external schema re-exports

Vincent Biret (baywet)
and
Copilot
committed
7a443c2
feat(library): add missing json schema properties

Vincent Biret (baywet)
and
Copilot
committed
82f84e0
fix(library): use version-specific schema keyword callbacks

Vincent Biret (baywet)
and
Copilot
committed
6e22ec6
docs(library): add json schema spec links

Vincent Biret (baywet)
and
Copilot
committed
c62769a
fix(library): use x-jsonschema schema extensions

Vincent Biret (baywet)
and
Copilot
committed
eb1891a
fix(library): remove unshipped schema extension fallback

Vincent Biret (baywet)
and
Copilot
committed
cf54bb3
feat: add contains/minContains/maxContains members
Romain V (Poltuu)
committed
1a974f8
chore(library): use constants for new schema keywords

Vincent Biret (baywet)
and
Copilot
committed
9672f95
chore(benchmark): refresh performance reports

Vincent Biret (baywet)
and
Copilot
committed
68f9bd2
fix(library): always copy unevaluated properties

Vincent Biret (baywet)
and
Copilot
committed
4907d1c
test(library): consolidate unevaluated properties extension tests

Vincent Biret (baywet)
and
Copilot
committed
9cf0916
Merge pull request #2880 from microsoft/feat/missing-json-schema-properties
Vincent Biret (baywet)
authored
9b1aed6
Merge pull request #2873 from microsoft/fix/invalid-circular-ref
Vincent Biret (baywet)
authored
b635242
Merge branch 'main' into Poltuu/main
Vincent Biret (baywet)
committed
5c152ae
chore(library): use schema contains constants in readers

Vincent Biret (baywet)
and
Copilot
committed
8990afa
chore(library): serialize contains keywords as v3 extensions

Vincent Biret (baywet)
and
Copilot
committed
fe5ecbb
chore(benchmark): refresh performance reports

Vincent Biret (baywet)
and
Copilot
committed
7927d30
chore(library): add v3 contains extension deserialization

Vincent Biret (baywet)
and
Copilot
committed
24c2a0b
Merge pull request #2876 from Poltuu/main
Vincent Biret (baywet)
authored
78475e3
chore(deps): bump dotnet-sdk from 10.0.300 to 10.0.301
dependabot[bot]
authored
3c058fd
Bump the microsoftextensions group with 6 updates
dependabot[bot]
authored
b1104e2
Merge pull request #2885 from microsoft/dependabot/dotnet_sdk/dotnet-sdk-10.0.301
github-actions[bot]
authored
0138361
Merge pull request #2886 from microsoft/dependabot/nuget/performance/resultsComparer/microsoftextensions-8095708293
github-actions[bot]
authored
37991b4

Commits on Jun 15, 2026

docs: fixes comment for Responses property
Vincent Biret (baywet)
authored
24469a7

Commits on Jun 16, 2026

Merge pull request #2891 from microsoft/baywet-patch-1
Vincent Biret (baywet)
authored
68e16e8

Commits on Jun 18, 2026

Commits on Jun 23, 2026

Commits on Jun 24, 2026

Commits on Jun 26, 2026

Commits on Jun 29, 2026

fix: Don't silently skip null assignment to OpenApiDocument.Tags
Youssef Fahmy (Youssef1313)
authored
3764142

Commits on Jul 2, 2026

Commits on Jul 3, 2026

fix: handling of nullable enums for 3.0 (#2920)
Youssef Fahmy (Youssef1313)
authored
beb68f5

Commits on Jul 6, 2026

chore(main): release 3.8.0 (#2902)
release-please-token-provider[bot]
authored
bac87f2

Commits on Jul 7, 2026

feat: adds support for anchor and id external resolution

Vincent Biret (baywet)
and
Copilot
authored
1591007

Commits on Jul 9, 2026

Merge pull request #2931 from microsoft/fix/default-mapping-serialization
Vincent Biret (baywet)
authored
1aeb913

Commits on Jul 13, 2026

fix: handle nullability more accurately during serialization for 3.0/2.0 (#2933)
Youssef Fahmy (Youssef1313)
authored
0ace243

Commits on Jul 14, 2026

Commits on Jul 15, 2026

Commits on Jul 16, 2026

Commits on Jul 17, 2026

Route NuGet restore through the CFS central package feed

Gavin Barron (gavinbarron)
and
Copilot
committed
eac3d66

Commits on Jul 20, 2026

Commits on Jul 21, 2026

chore(deps): Fix System.Security.Cryptography.Xml vulnerabilities (#2983)

Gavin Barron (gavinbarron)
and
Copilot
authored
8f4a60b

Commits on Jul 22, 2026

Commits on Jul 23, 2026

Commits on Jul 27, 2026

chore(deps): bump actions/upload-code-coverage from 1.4.0 to 1.4.1
dependabot[bot]
authored
f64aff7

Commits on Jul 28, 2026

Commits on Jul 29, 2026

Commits on Jul 30, 2026

Merge pull request #2997 from microsoft/dependabot/github_actions/github/codeql-action-4.37.3
github-actions[bot]
authored
c6e940a

Commits on Jul 31, 2026

chore(deps): bump actions/setup-java from 5 to 5.6.0
dependabot[bot]
authored
f9a0fb1

Commits on Aug 3, 2026

Commits on Aug 6, 2026

chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4
dependabot[bot]
authored
28e43a8

Commits on Aug 7, 2026

Commits on Aug 8, 2026

Merge pull request #3001 from microsoft/dependabot/github_actions/actions/setup-java-5.7.0
github-actions[bot]
authored
91c5d41

Commits on Aug 10, 2026

Commits on Aug 11, 2026

Commits on Aug 12, 2026

chore(main): release 3.10.0 (#2976)

authored
25f1974
Pin GitHub Actions to full-length commit SHAs (#3016)
Dan Fiedler (danfiedler-msft)
authored
97e7327
ci/nuget deploy cfs take 2 (#3015)
Vincent Biret (baywet)
authored
b7a7308
chore: retarget branch history to support/v1

Copilot
and
Vincent Biret (baywet)
authored
95a77d8
fix(readers): bound YAML anchor/alias expansion to prevent OOM (billion laughs)

Copilot
and
Vincent Biret (baywet)
authored
71b6174
refactor(readers): move YAML expansion limits into OpenApiReaderSettings

Copilot
and
Vincent Biret (baywet)
authored
adec1a0