chore: pin net10 Microsoft.OpenApi to 2.9.0

The transitive default (2.0.0, floored by Microsoft.AspNetCore.OpenApi
10.0.10) is affected by GHSA-v5pm-xwqc-g5wc (stack overflow parsing
circular schema refs in untrusted documents; patched at 2.7.5+). We
only generate documents, never parse untrusted ones, so exposure was
low, but pinning above the patched version costs nothing. net9's
transitive Microsoft.OpenApi 1.x line is unaffected per the advisory
and untouched.

Verified: full OpenApi suite green on both net9.0 (22/22) and net10.0
(25/25) at the new pinned version; the AddComponent/OpenApiSchemaReference/
Target-resolution APIs this fix depends on behave identically.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: panesofglass

RELEASE_NOTES.md

@@ -4,6 +4,7 @@
 * `FSharpSchemaTransformer` now registers component schemas into the live `OpenApiDocument` on net10 instead of leaving them unregistered with dangling references
 * Fix self-recursive types (e.g. a tree or linked-list shaped DU) all resolving their self-reference to the same hardcoded component id on net10; each now gets its own correctly-named component
 * On net10, definition/component ids (DU cases and nested referenced types alike) are now qualified by their owning root type's name (e.g. `TreeNode.Leaf` instead of `Leaf`), so two different types that happen to share a case or type name no longer silently collide in `components/schemas`
+* Pin the net10 `Microsoft.OpenApi` dependency to 2.9.0 (was transitively 2.0.0), above the version affected by GHSA-v5pm-xwqc-g5wc
 
 ### FSharp.Data.JsonSchema.NJsonSchema 3.1.0
 

src/FSharp.Data.JsonSchema.OpenApi/FSharp.Data.JsonSchema.OpenApi.fsproj

@@ -25,6 +25,12 @@
 
   <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
     <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />
+    <!-- Explicit floor above the transitive default (2.0.0), which is affected by
+         GHSA-v5pm-xwqc-g5wc (stack overflow parsing circular schema refs; patched at 2.7.5+).
+         We only generate documents, never parse untrusted ones, so exposure was low, but
+         there's no reason to ship a known-vulnerable transitive version when pinning above it
+         costs nothing. -->
+    <PackageReference Include="Microsoft.OpenApi" Version="2.9.0" />
   </ItemGroup>
 
 </Project>