From f6ea24f81633e474e4de728f46f404ea5520b819 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 11:21:10 +0000
Subject: [PATCH 1/3] chore(deps): Bump the nuget-dependencies group with 20
 updates

Bumps Microsoft.AspNetCore.OpenApi from 10.0.9 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Design from 10.0.9 to 10.0.10
Bumps Microsoft.EntityFrameworkCore.Sqlite from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Hosting.Abstractions from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Http.Resilience from 10.7.0 to 10.8.0
Bumps Microsoft.Extensions.Logging from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.Options from 10.0.9 to 10.0.10
Bumps Microsoft.Extensions.ServiceDiscovery from 10.7.0 to 10.8.0
Bumps Microsoft.NET.Test.Sdk from 18.7.0 to 18.8.1
Bumps Microsoft.OpenApi from 2.7.5 to 3.9.0
Bumps NSubstitute from 5.3.0 to 6.0.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Extensions.Hosting from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.16.0 to 1.17.0
Bumps System.Security.Cryptography.Xml from 10.0.9 to 10.0.10
Bumps TinyBDD from 0.19.28 to 0.19.29
Bumps TinyBDD.Xunit from 0.19.28 to 0.19.29

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Design
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.EntityFrameworkCore.Sqlite
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Hosting.Abstractions
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Logging
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.Options
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.Extensions.ServiceDiscovery
  dependency-version: 10.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: Microsoft.OpenApi
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: NSubstitute
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-dependencies
- dependency-name: System.Security.Cryptography.Xml
  dependency-version: 10.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
- dependency-name: TinyBDD.Xunit
  dependency-version: 0.19.29
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .../PokManager.Application.csproj                  |  2 +-
 .../PokManager.ServiceDefaults.csproj              | 14 +++++++-------
 .../PokManager.Infrastructure.csproj               |  6 +++---
 .../PokManager.ApiService.csproj                   |  4 ++--
 .../PokManager.Web/PokManager.Web.csproj           |  4 ++--
 .../PokManager.Application.Tests.csproj            |  8 ++++----
 .../PokManager.Domain.Tests.csproj                 |  4 ++--
 .../PokManager.Infrastructure.Tests.csproj         |  8 ++++----
 .../PokManager.Web.Tests.csproj                    |  4 ++--
 9 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/src/Core/PokManager.Application/PokManager.Application.csproj b/src/Core/PokManager.Application/PokManager.Application.csproj
index 5bfae17..d80f9e4 100644
--- a/src/Core/PokManager.Application/PokManager.Application.csproj
+++ b/src/Core/PokManager.Application/PokManager.Application.csproj
@@ -7,7 +7,7 @@
   <ItemGroup>
     <PackageReference Include="FluentValidation" Version="12.1.1" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="12.1.1" />
-    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.10" />
   </ItemGroup>
 
   <PropertyGroup>
diff --git a/src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj b/src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj
index d11961f..e83ec88 100644
--- a/src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj
+++ b/src/Hosting/PokManager.ServiceDefaults/PokManager.ServiceDefaults.csproj
@@ -10,13 +10,13 @@
   <ItemGroup>
     <FrameworkReference Include="Microsoft.AspNetCore.App" />
 
-    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.7.0" />
-    <PackageReference Include="Microsoft.Extensions.ServiceDiscovery" Version="10.7.0" />
-    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.16.0" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.16.0" />
+    <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="10.8.0" />
+    <PackageReference Include="Microsoft.Extensions.ServiceDiscovery" Version="10.8.0" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Infrastructure/PokManager.Infrastructure/PokManager.Infrastructure.csproj b/src/Infrastructure/PokManager.Infrastructure/PokManager.Infrastructure.csproj
index 886578f..1c5b055 100644
--- a/src/Infrastructure/PokManager.Infrastructure/PokManager.Infrastructure.csproj
+++ b/src/Infrastructure/PokManager.Infrastructure/PokManager.Infrastructure.csproj
@@ -6,9 +6,9 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.9" />
-    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.9" />
+    <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.10" />
+    <PackageReference Include="Microsoft.Extensions.Options" Version="10.0.10" />
     <PackageReference Include="YamlDotNet" Version="18.1.0" />
   </ItemGroup>
 
diff --git a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
index 5e8431e..4c18500 100644
--- a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
+++ b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
@@ -16,8 +16,8 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
-    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <PackageReference Include="Microsoft.OpenApi" Version="3.9.0" />
   </ItemGroup>
 
 </Project>
diff --git a/src/Presentation/PokManager.Web/PokManager.Web.csproj b/src/Presentation/PokManager.Web/PokManager.Web.csproj
index 74cb532..4ded614 100644
--- a/src/Presentation/PokManager.Web/PokManager.Web.csproj
+++ b/src/Presentation/PokManager.Web/PokManager.Web.csproj
@@ -15,9 +15,9 @@
 
   <ItemGroup>
     <PackageReference Include="MudBlazor" Version="9.7.0" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.10" />
     <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.53.3" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.10">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
diff --git a/tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj b/tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj
index de1c5e7..0b88758 100644
--- a/tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj
+++ b/tests/PokManager.Application.Tests/PokManager.Application.Tests.csproj
@@ -10,10 +10,10 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
     <PackageReference Include="FluentAssertions" Version="8.10.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
-    <PackageReference Include="TinyBDD" Version="0.19.28" />
-    <PackageReference Include="TinyBDD.Xunit" Version="0.19.28" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
+    <PackageReference Include="TinyBDD" Version="0.19.29" />
+    <PackageReference Include="TinyBDD.Xunit" Version="0.19.29" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
diff --git a/tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj b/tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj
index da0ab81..a892b5e 100644
--- a/tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj
+++ b/tests/PokManager.Domain.Tests/PokManager.Domain.Tests.csproj
@@ -10,8 +10,8 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
     <PackageReference Include="FluentAssertions" Version="8.10.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageReference Include="TinyBDD" Version="0.19.28" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="TinyBDD" Version="0.19.29" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
diff --git a/tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj b/tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj
index 795b124..e2223bc 100644
--- a/tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj
+++ b/tests/PokManager.Infrastructure.Tests/PokManager.Infrastructure.Tests.csproj
@@ -10,10 +10,10 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
     <PackageReference Include="FluentAssertions" Version="8.10.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageReference Include="NSubstitute" Version="5.3.0" />
-    <PackageReference Include="TinyBDD" Version="0.19.28" />
-    <PackageReference Include="TinyBDD.Xunit" Version="0.19.28" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="NSubstitute" Version="6.0.0" />
+    <PackageReference Include="TinyBDD" Version="0.19.29" />
+    <PackageReference Include="TinyBDD.Xunit" Version="0.19.29" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
   </ItemGroup>
diff --git a/tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj b/tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj
index ab63c2c..aa0f8d7 100644
--- a/tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj
+++ b/tests/PokManager.Web.Tests/PokManager.Web.Tests.csproj
@@ -11,8 +11,8 @@
     <PackageReference Include="bunit" Version="2.7.2" />
     <PackageReference Include="coverlet.collector" Version="10.0.1" />
     <PackageReference Include="FluentAssertions" Version="8.10.0" />
-    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.7.0" />
-    <PackageReference Include="TinyBDD" Version="0.19.28" />
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
+    <PackageReference Include="TinyBDD" Version="0.19.29" />
     <PackageReference Include="xunit" Version="2.9.3" />
     <PackageReference Include="xunit.runner.visualstudio" Version="3.1.5" />
     <!-- Forced transitive upgrade: bunit 2.7.2 pulls AngleSharp 1.4.0, which is vulnerable

From 09d847a77cae3081cd4aa6a66d6246046ff39719 Mon Sep 17 00:00:00 2001
From: JerrettDavis <mxjerrett@gmail.com>
Date: Tue, 21 Jul 2026 12:25:48 -0500
Subject: [PATCH 2/3] fix(deps): pin Microsoft.OpenApi to 2.7.5 to resolve
 CS0200 with AspNetCore.OpenApi 10.0.10

The nuget-dependencies group bump pulled Microsoft.OpenApi 3.9.0, whose
IOpenApiMediaType.Example API changed to read-only, breaking the
Microsoft.AspNetCore.OpenApi 10.0.10 source generator (CS0200). Pin
Microsoft.OpenApi back to the 2.7.5 line already known to be compatible
(previously pinned in #129 for GHSA-v5pm-xwqc-g5wc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../PokManager.ApiService/PokManager.ApiService.csproj          | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
index 4c18500..7c4d114 100644
--- a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
+++ b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
@@ -17,7 +17,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
-    <PackageReference Include="Microsoft.OpenApi" Version="3.9.0" />
+    <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>
 
 </Project>

From 2784b6a25ac0df5ff74cd846bde0e44b6db1118e Mon Sep 17 00:00:00 2001
From: JerrettDavis <mxjerrett@gmail.com>
Date: Tue, 21 Jul 2026 12:33:53 -0500
Subject: [PATCH 3/3] docs(deps): document Microsoft.OpenApi 2.7.5 pin and
 ignore 3.x in Dependabot

Explain why the pin exists (AspNetCore.OpenApi 10.0.x source generator is
incompatible with OpenApi 3.x's read-only IOpenApiMediaType.Example) and add
a Dependabot ignore rule so future bumps don't silently reintroduce CS0200.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/dependabot.yml                                    | 6 ++++++
 .../PokManager.ApiService/PokManager.ApiService.csproj    | 8 ++++++++
 2 files changed, 14 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a02dc81..25fd5e0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -39,3 +39,9 @@ updates:
       nuget-dependencies:
         patterns:
           - "*"
+    ignore:
+      # Microsoft.OpenApi 3.x breaks Microsoft.AspNetCore.OpenApi 10.0.x source generation
+      # (CS0200 on IOpenApiMediaType.Example). See PokManager.ApiService.csproj comment.
+      # Revisit once a stable AspNetCore.OpenApi release supports Microsoft.OpenApi 3.x.
+      - dependency-name: "Microsoft.OpenApi"
+        versions: [">=3.0.0"]
diff --git a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
index 7c4d114..7790073 100644
--- a/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
+++ b/src/Presentation/PokManager.ApiService/PokManager.ApiService.csproj
@@ -17,6 +17,14 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <!-- Microsoft.OpenApi pinned to 2.7.5 (>= 2.7.5 clears GHSA-v5pm-xwqc-g5wc).
+         DO NOT bump to Microsoft.OpenApi 3.x while on Microsoft.AspNetCore.OpenApi 10.0.x:
+         AspNetCore.OpenApi 10.0.10's OpenApiXmlCommentSupport source generator targets the
+         mutable (pre-3.x) IOpenApiMediaType.Example setter, and Microsoft.OpenApi 3.x makes
+         Example read-only, causing CS0200 in generated code. The only AspNetCore.OpenApi
+         release compatible with Microsoft.OpenApi 3.x is 11.0.0-preview+ (net11.0, requires
+         .NET 11 preview SDK/runtime) — revisit this pin when .NET 11 GA ships a stable
+         release with matching Microsoft.OpenApi 3.x support. -->
     <PackageReference Include="Microsoft.OpenApi" Version="2.7.5" />
   </ItemGroup>