FastEndpoints.ClientGen.Kiota dependency has CVE (Microsoft.OpenApi.Kiota.Builder < v1.32.5)

[omon77]

Update FastEndpoints.ClientGen.Kiota dependency Microsoft.OpenApi.Kiota.Builder to v1.31.1 v1.32.5

FastEndpoints.ClientGen.Kiota has dependency on Microsoft.OpenApi.Kiota.Builder library.
Versions below v1.31.1 v1.32.5 have an open CVE: GHSA-2hx3-vp6r-mg3f.

https://www.nuget.org/packages/Microsoft.OpenApi.Kiota.Builder/1.29.0

• FastEndpoints.ClientGen.Kiota v8.1 has dependency on v1.30.0
• FastEndpoints.ClientGen.Kiota v8.2-beta.* has dependency on v1.29.0.

The dependency version for Microsoft.OpenApi.Kiota.Builder needs to be updated to >= v1.32.5.

[dj-nitehawk]

we can't really upgrade kiota builder past v1.29.0 because Microsoft.OpenApi.Kiota.Builder 1.31.1 pulls Microsoft.OpenApi 3.5.1, but Microsoft.AspNetCore.OpenApi 10.0.7 still expects Microsoft.OpenApi 2.x. the ms-openapi source generator emits code for the 2.x api. if we upgrade to Microsoft.OpenApi.Kiota.Builder 1.31.1 there are compile errors in the generated code which it emits.

so, the way i see it, this is not fixable until .NET 11 because only Microsoft.AspNetCore.OpenApi 11.x brings Microsoft.OpenApi 3.x support.

besides, i don't think the CVE matters that much in the FE context, because we're generating clients from our own openapi docs, not untrusted externally sourced openapi.json files.

that being said, if someone can figure out a way to sort this out, please open a PR. no hacky/wonky ai generated workarounds please though 😋

[omon77]

Updating that as of 07/27/2026, that the list of affected versions affects everything until v1.32.5.

[pzimmerman-bmi]

Updating that as of 07/27/2026, that the list of affected versions affects everything until v1.32.5.

Yeah I get this is an external dependency that currently causes issues but every kiota package is causing a security error and this is especially noticable if you have "warnings as errors" turned on.

[omon77]

Updating that as of 07/27/2026, that the list of affected versions affects everything until v1.32.5.

Yeah I get this is an external dependency that currently causes issues but every kiota package is causing a security error and this is especially noticable if you have "warnings as errors" turned on.

It's a bigger issue for us, our CI/CD builds are blocked when the dependency has a vulnerability.

[pzimmerman-bmi]

Updating that as of 07/27/2026, that the list of affected versions affects everything until v1.32.5.

Yeah I get this is an external dependency that currently causes issues but every kiota package is causing a security error and this is especially noticable if you have "warnings as errors" turned on.

It's a bigger issue for us, our CI/CD builds are blocked when the dependency has a vulnerability.

For us too, having it on affects anything downstream that builds the code.

[dj-nitehawk]

maybe a warning suppression could work for the time being:

<!-- Directory.Build.props or csproj -->
<PropertyGroup>
  <NuGetAudit>true</NuGetAudit>
  <NuGetAuditSuppress>GHSA-2hx3-vp6r-mg3f</NuGetAuditSuppress>
</PropertyGroup>

[EelcoLos]

I feel though there's a transitive solution, kiota itself did not have the issue filed, so i created one there

[omon77]

We use a 3rd party platform for vulnerability scanning as part of our CI/CD pipeline. If the version of the library is marked as vulnerable, the tool fails the build.

[EelcoLos]

@omon77 @pzimmerman-bmi (cc: @dj-nitehawk ) I've been working with M$ and they're trying to release a 1.29.1 version of kiota of the PR i made there (mentioned above). After it's released, I can create a PR here to align the correct version