chore: Update packages, remove resolved Microsoft.OpenApi pin

[DaveSkender]

Problem

tools/Directory.Packages.props and tools/sse-server/Test.SseServer.csproj carry an explicit, self-labeled "temp pin":

<!-- temp pin for vulnerability in Microsoft.AspNetCore.OpenApi v10.0.10 dependency
     see https://github.com/advisories/GHSA-v5pm-xwqc-g5wc for details -->
<PackageVersion Include="Microsoft.OpenApi" Version="2.8.0" />

Microsoft.AspNetCore.OpenApi 10.0.10's own manifest requires Microsoft.OpenApi 2.0.0, which is vulnerable per GHSA-v5pm-xwqc-g5wc (a small OpenAPI document with a circular schema reference can crash parsing via stack overflow). The override pin worked around that by forcing a patched Microsoft.OpenApi version directly. The .csproj copy of the comment was also already stale, still referencing "v10.0.9" after a prior version bump.

Why prioritized

Found directly in the codebase while surveying the org for maintenance work — a self-documented "temp pin" is exactly the kind of workaround this routine is meant to catch and clear once the underlying reason for it goes away. Verified against the live NuGet package data (see below) that the workaround is no longer necessary. Small, single-project, single-intent change (2 source files + the generated lock file). No open PR or branch in this repository touched these files.

What changed

• tools/Directory.Packages.props: bumped Microsoft.AspNetCore.OpenApi and Microsoft.Extensions.ApiDescription.Server from 10.0.10 → 10.0.11, and removed the now-unnecessary Microsoft.OpenApi override and its comment.
• tools/sse-server/Test.SseServer.csproj: removed the corresponding Microsoft.OpenApi PackageReference override and its (already-stale) comment.
• tools/sse-server/packages.lock.json: regenerated via dotnet restore to reflect the new resolution — Microsoft.OpenApi now resolves transitively to 2.7.5, versus the previously pinned 2.8.0; both are patched.

Microsoft.AspNetCore.OpenApi 10.0.11's own nuspec now declares its Microsoft.OpenApi dependency as [2.7.5, 3.0.0) — i.e., the fix moved upstream, so this project's manual override is redundant and actively stale (it hardcoded a single version rather than tracking the floor).

How validated

• Confirmed via the NuGet v3 flat-container API that Microsoft.AspNetCore.OpenApi 10.0.11 exists and its nuspec dependency range for Microsoft.OpenApi is [2.7.5, 3.0.0) (2.7.5 is GHSA-v5pm-xwqc-g5wc's patched floor), versus 10.0.10's unpinned Microsoft.OpenApi 2.0.0 (vulnerable).
• dotnet restore --force-evaluate in tools/sse-server regenerated packages.lock.json cleanly; the transitive Microsoft.OpenApi entry resolved to 2.7.5.
• dotnet restore --locked-mode (matching CI's RestoreLockedMode gate) succeeds against the regenerated lock file.
• dotnet build --configuration Release --property:ContinuousIntegrationBuild=true -warnAsError (matching this repo's CI build step) succeeds with 0 warnings/errors, including the build-time OpenAPI document generation step (GenerateOpenApiDocuments) that exercises the new Microsoft.OpenApi version directly.
• dotnet list package --vulnerable --include-transitive on Test.SseServer reports no vulnerable packages from the current sources.
• No NuGet.Config/private feed is required for this project (nuget.org only), so all of the above ran end-to-end in this session.

Limitations / follow-up

• tools/sse-server's CI job (test-integration.yml) is gated if: !github.event.pull_request.draft, so it won't run automatically while this PR stays in draft; the local restore/build/lock-file validation above covers the same surface it would exercise.
• Scoped to this repo's own tools/ pin; no other project in this repository references Microsoft.OpenApi directly.

---

This pull request was triggered via an automated maintenance routine.

---

Generated by Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[facioquoqa]

FaciōQuōqa Mage Reviewer is standing by.

• Trigger review