Bump Microsoft.OpenApi from 2.6.1 to 3.9.0

[dependabot]

Updated Microsoft.OpenApi from 2.6.1 to 3.9.0.

Release notes

Sourced from Microsoft.OpenApi's releases.

3.9.0

3.9.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (1591007)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (eacc2fc)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (821053b)

Bug Fixes

• adds explicit error message for invalid json pointers (63fc55d)
• adds explicit error message for invalid json pointers (bc93efe)
• default mapping is not being serialized with the correct shape (fe4a25f)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (07b525f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (0ace243)
• validate required properties of security scheme before serialization (#​2952) (f31b192)

3.8.0

3.8.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (2f8b3d2)
• library: support schema keywords on references (434b2f8)
• library: support schema keywords on references (66a9d04), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (3764142)
• handling of nullable enums for 3.0 (#​2920) (beb68f5)
• library: keep v3 schema references ref-only (c938727)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (08160c8)
• use async method for crypto flush (6e675d9)

3.7.0

3.7.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (78475e3)
• add contains/minContains/maxContains members (1a974f8)
• library: add missing json schema properties (9b1aed6)
• library: add missing json schema properties (82f84e0)

Bug Fixes

• library: always copy unevaluated properties (4907d1c)
• library: avoid false circular refs for external schema re-exports (b635242)
• library: avoid false circular refs for external schema re-exports (7a443c2)
• library: remove unshipped schema extension fallback (cf54bb3)
• library: use version-specific schema keyword callbacks (6e22ec6)
• library: use x-jsonschema schema extensions (eb1891a)

3.6.0

3.6.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (9b4f45b)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

3.5.5

3.5.5 (2026-05-28)

Bug Fixes

• reader: preserve Null flag when nullable appears before type in V3.0/V3.1/V3.2 deserializers (2b9d7f4)

3.5.4

3.5.4 (2026-05-26)

Bug Fixes

• library: handle circular schema references (b3cd42b)
• library: handle circular schema references (91a989f)

3.5.3

3.5.3 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (f97f91a)
• null reference exception for boolean component schemas (fe0b50a)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (05b44be)

Performance Improvements

• schema: optimize boolean schema deserialization (7316e3f)

3.5.2

3.5.2 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 3.2.1 (b0a68fb)
• hidi: update Microsoft.OpenApi.OData to 3.2.1 (8c22ab2), closes #​2811

3.5.1

3.5.1 (2026-03-31)

Bug Fixes

• security scheme references serialization (a5acb89)

3.5.0

3.5.0 (2026-03-20)

Features

• library: add Extensions support for schema references in v3.1/v3.2; add SerializeAsV32 with loop detection (9b422bf)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (ef55b2c)
• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (4b3164a)
• double encoding of json pointer for invalid reference rule (b246cd0)
• encoding of special characters for JSON paths (4c757e1)
• library: do not emit unevaluatedProperties for non-object schemas (852fb4c)
• library: do not emit unevaluatedProperties for non-object schemas (19538aa)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (9bf61de)
• potential double encoding of paths (471a61a)

3.4.0

3.4.0 (2026-03-04)

Features

• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (d969fdc)
• library: Preserve PatternProperties via x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 (16ab5e4)
• securityscheme: add oauth2MetadataUrl support (OpenAPI 3.2) (4509488)

Bug Fixes

• implement unevaluatedProperties as schema per JSON Schema 2020-12 (#​2728) (7c13fb3)
• library: serialize additionalProperties schema in OpenAPI V2 (f3165fa)
• library: serialize additionalProperties schema in OpenAPI V2 documents (3d07756)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (f690681)

3.3.1

3.3.1 (2026-01-22)

Features

• models: add shared Content interface (#​2695) (338566f)

Bug Fixes

• broken binary compatibility due to interface changes in previous version (d96bba7)

3.3.0

3.3.0 (2026-01-21)

Features

• models: add shared Content interface (9e13b25)
• models: add shared Content interface (#​2695) (9e13b25)
• models: support mutualTLS security scheme (a4efdfe)

3.2.0

3.2.0 (2026-01-19)

Features

• hidi validate command now logs warnings (76a3c0f)
• hidi validate command now logs warnings (62e7d56)

Bug Fixes

• discriminator property validation fails any/allOf cases when it shouldn't (fb6cecc)
• discriminator property validation fails any/allOf cases when it shouldn't (a8fb81c)

3.1.3

3.1.3 (2026-01-16)

Bug Fixes

• Support custom tag ordering (008576c)
• Support custom tag ordering (7610d07)

3.1.2

3.1.2 (2026-01-06)

Bug Fixes

• correct error pointer when extension parser throws OpenApiException (43c75a9)
• wrap extension parser calls in try-catch to ensure correct error pointers (50b44aa)

3.1.1

3.1.1 (2025-12-18)

Bug Fixes

• schema: always serialize additionalProperties: false (6651c36)
• schema: always serialize additionalProperties: false (e36fc95)

3.1.0

3.1.0 (2025-12-17)

Features

• Add type: "null" downcasting when in oneOf and anyOf for OpenAPI v3 (782cf8d)

3.0.3

3.0.3 (2025-12-16)

Bug Fixes

• load JSON documents that are preceded by multiple whitespace (6461bac)
• non-seekable json streams would fail to load as a document (2436d73)
• reading streams in an asp.net context would cause async exceptions (f9e5248)

3.0.2

3.0.2 (2025-12-08)

Bug Fixes

• additional properties serialization should not emit a schema in v2 (946cba9)
• additional properties serialization should not emit booleans in v3.1+ (946cba9)

3.0.1

3.0.1 (2025-11-17)

Bug Fixes

• empty strings should be quoted in yaml (8d215f9)
• empty strings should be quoted in yaml (0ca10db)

3.0.0

3.0.0 (2025-11-11)

⚠ BREAKING CHANGES

• adds support for OpenAPI 3.2.0

Note: Please refer to the upgrade guide for a detailed description of the breaking changes.

Note: ASP.net users should remain on version 1.X for ASP.net < 10, and version 2.X for ASP.net 10, this new major version will be implemented in a future version of ASP.net, more information

Features

• adds support for OpenAPI 3.2.0 (765a8dd)

Special thanks

• Matthieu Costabello

2.11.0

2.11.0 (2026-07-15)

Features

• adds support for anchor and id external resolution (557bd6a)
• adds support for anchor and id external resolution (4138e47)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (baf8428)
• schema: resolve bare $dynamicRef via $dynamicAnchor index (#​2913) (a139f83)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (6091f5a)
• support relative URI resolution in $dynamicRef (#​2928) (#​2945) (a8688dc)

Bug Fixes

• adds explicit error message for invalid json pointers (#​2955) (a304e56)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (a8787af)
• differentiate unset value from null value in OpenApiSchema.Const (#​2936) (e08570f)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (bc11356)
• handle nullability more accurately during serialization for 3.0/2.0 (#​2933) (310b6e2)

2.10.0

2.10.0 (2026-07-03)

Features

• add JsonConverter for OpenApiSchema System.Text.Json serialization (#​2915) (465521b)
• library: support schema keywords on references (2749463), closes #​2903

Bug Fixes

• Don't silently skip null assignment to OpenApiDocument.Tags (#​2917) (6a45a82)
• handling of nullable enums for 3.0 (#​2920) (f4778e0)
• library: keep v3 schema references ref-only (8d811c3)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (fb20d46)
• preserve JSON Schema 2020-12 keyword siblings on $ref schemas for OAS 3.1+ (#​2896) (c79a83e)
• use async method for crypto flush (677b519)

2.9.0

2.9.0 (2026-06-10)

Features

• add contains/minContains/maxContains members (fadb422)
• library: add missing json schema properties (db41a3c)

Bug Fixes

• library: always copy unevaluated properties (3951a31)
• library: avoid false circular refs for external schema re-exports (a058913)
• library: avoid false circular refs for external schema re-exports (1bace68)
• library: merge contains compat members into missing properties (7dc45e1)
• library: remove unshipped schema extension fallback (b301827)
• library: use version-specific schema keyword callbacks (f93d76a)
• library: use x-jsonschema schema extensions (ec04a7f)

2.8.0

2.8.0 (2026-06-01)

Features

• reader: remove ParseNode infrastructure (d7c6a9d)
• Significant performance improvements resulting ~40% reduced allocations when parsing JSON descriptions, ~25% for YAML.

2.7.6

2.7.6 (2026-05-28)

Bug Fixes

• reader: preserve nullable Null flag when type appears after nullable in V3.1/V3.2 deserializers (288e95a)

2.7.5

2.7.5 (2026-05-26)

Bug Fixes

• library: handle circular schema references (acd5088)
• library: handle circular schema references (6bcac39)

2.7.4

2.7.4 (2026-04-27)

Bug Fixes

• null reference exception for boolean component schemas (cc13028)
• schema: support boolean schemas in deserializer for OpenAPI 3.1/3.2 (48aaf23)

Performance Improvements

• schema: optimize boolean schema deserialization (fe6f513)

2.7.3

2.7.3 (2026-04-14)

Bug Fixes

• hidi: update Microsoft.OpenApi.OData to 2.2.1 (1e01cd5)
• hidi: update Microsoft.OpenApi.OData to 2.2.1 (c890703), closes #​2812

2.7.2

2.7.2 (2026-03-31)

Bug Fixes

• security requirement reference serialization (0945eec)

2.7.1

2.7.1 (2026-03-20)

Bug Fixes

• a bug where path parameter validation would fail if they contained forbidden JSON pointer characters (2efd2b2)
• library: do not emit unevaluatedProperties for non-object schemas (28d614f)
• library: enforce spec-compliant $ref serialization; add Extensions support for schema references in v3.1/v3.2 (7640a8a)

2.7.0

2.7.0 (2026-03-05)

Features

• add UnevaluatedPropertiesSchema support to IOpenApiSchema (fb691d6)
• library: preserve PatternProperties as x-jsonschema-patternProperties extension for OpenAPI v2/v3.0 serialization (dd5085a)

Bug Fixes

• address PR feedback on UnevaluatedProperties implementation (80fc0f6)
• correct deserialization and test for UnevaluatedPropertiesSchema (a4d66fc)
• library: serialize additionalProperties schema in OpenAPI V2 (99b653c)
• library: serialize additionalProperties schema in OpenAPI V2 (cef7996)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (91e697b)
• optimize parsing V3.1 documents by reducing GetLocation method allocation on hot path(#​2748) (06c58a5)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #44.