From 16a34bfcca3c6f438c54b0aeb0d5728d9187f592 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 13 Mar 2026 14:52:10 +0000 Subject: [PATCH 01/11] Bump Humanizer.Core from 2.14.1 to 3.0.10 --- updated-dependencies: - dependency-name: Humanizer.Core dependency-version: 3.0.10 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj b/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj index 7e3db37d3..b7a86dc4f 100644 --- a/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj +++ b/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj @@ -28,7 +28,7 @@ - + From 2aa18905cc001a8a01dc1121033df75166e1b0c8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Mar 2026 16:53:10 +0000 Subject: [PATCH 02/11] Initial plan From ab63449a098de93be1144553fe8052c3874f7caa Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Mar 2026 17:22:25 +0000 Subject: [PATCH 03/11] Initial plan for Humanizer API update Co-authored-by: baywet <7905502+baywet@users.noreply.github.com> --- global.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/global.json b/global.json index d72c3f669..459fe3e6e 100644 --- a/global.json +++ b/global.json @@ -1,5 +1,5 @@ { "sdk": { - "version": "8.0.419" + "version": "8.0.418" } } \ No newline at end of file From 6cbf2abfa77537be8fa2c5d720acb48fe152f5b9 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Fri, 20 Mar 2026 17:23:37 +0000 Subject: [PATCH 04/11] fix(hidi): remove Humanizer.Inflections namespace for Humanizer 3.x compatibility Co-authored-by: baywet <7905502+baywet@users.noreply.github.com> --- src/Microsoft.OpenApi.Hidi/Formatters/PowerShellFormatter.cs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/Microsoft.OpenApi.Hidi/Formatters/PowerShellFormatter.cs b/src/Microsoft.OpenApi.Hidi/Formatters/PowerShellFormatter.cs index bb4bc58d9..6d2282b32 100644 --- a/src/Microsoft.OpenApi.Hidi/Formatters/PowerShellFormatter.cs +++ b/src/Microsoft.OpenApi.Hidi/Formatters/PowerShellFormatter.cs @@ -5,7 +5,6 @@ using System.Text; using System.Text.RegularExpressions; using Humanizer; -using Humanizer.Inflections; using Microsoft.OpenApi.Hidi.Extensions; namespace Microsoft.OpenApi.Hidi.Formatters From a5906bc4cf7a3dc31d2e81b703348d3b31df7fad Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Sun, 22 Mar 2026 15:43:28 -0400 Subject: [PATCH 05/11] chore: reverts global.json changes --- global.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/global.json b/global.json index 459fe3e6e..d72c3f669 100644 --- a/global.json +++ b/global.json @@ -1,5 +1,5 @@ { "sdk": { - "version": "8.0.418" + "version": "8.0.419" } } \ No newline at end of file From 6ee2dd66b88b7abbbf5a57be5d74a4833e9905ca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 26 Mar 2026 21:23:32 +0000 Subject: [PATCH 06/11] chore(deps): bump dependabot/fetch-metadata from 2.5.0 to 3.0.0 Bumps [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) from 2.5.0 to 3.0.0. - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](https://github.com/dependabot/fetch-metadata/compare/v2.5.0...v3.0.0) --- updated-dependencies: - dependency-name: dependabot/fetch-metadata dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/auto-merge-dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml index ba2243c97..62a99a480 100644 --- a/.github/workflows/auto-merge-dependabot.yml +++ b/.github/workflows/auto-merge-dependabot.yml @@ -19,7 +19,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2.5.0 + uses: dependabot/fetch-metadata@v3.0.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" From b3807c81067a302f625eaff1aa40b8c9a3dc3ce6 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Mon, 30 Mar 2026 13:16:15 -0400 Subject: [PATCH 07/11] tests: refactors to theory to reduce duplication Signed-off-by: Vincent Biret --- .../Models/OpenApiSecurityRequirementTests.cs | 32 +++---------------- 1 file changed, 5 insertions(+), 27 deletions(-) diff --git a/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs b/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs index 4ae9aedfd..7cb51a919 100644 --- a/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs +++ b/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs @@ -184,31 +184,10 @@ public async Task SerializeSecurityRequirementWithReferencedSecuritySchemeAsV2Js Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(actual))); } - [Fact] - public async Task SerializeSecurityRequirementWithUnreferencedSecuritySchemeAsV3JsonShouldSkipUnserializableKeyValuePair() - { - // Arrange - var expected = - """ - { - "scheme1": [ - "scope1", - "scope2", - "scope3" - ], - "scheme3": [ ] - } - """; - - // Act - var actual = await SecurityRequirementWithUnreferencedSecurityScheme.SerializeAsJsonAsync(OpenApiSpecVersion.OpenApi3_0); - - // Assert - Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(actual))); - } - - [Fact] - public async Task SerializeSecurityRequirementWithUnreferencedSecuritySchemeAsV2JsonShouldSkipUnserializableKeyValuePair() + [Theory] + [InlineData(OpenApiSpecVersion.OpenApi3_0)] + [InlineData(OpenApiSpecVersion.OpenApi2_0)] + public async Task SerializeSecurityRequirementWithUnreferencedSecuritySchemeAsJsonShouldSkipUnserializableKeyValuePair(OpenApiSpecVersion openApiSpecVersion) { // Arrange var expected = @@ -224,8 +203,7 @@ public async Task SerializeSecurityRequirementWithUnreferencedSecuritySchemeAsV2 """; // Act - var actual = - await SecurityRequirementWithUnreferencedSecurityScheme.SerializeAsJsonAsync(OpenApiSpecVersion.OpenApi2_0); + var actual = await SecurityRequirementWithUnreferencedSecurityScheme.SerializeAsJsonAsync(openApiSpecVersion); // Assert Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(actual))); From 32bef0ff09ff579e228af638b6ce485d7bf1777a Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Mon, 30 Mar 2026 13:17:10 -0400 Subject: [PATCH 08/11] tests: further theory refactoring Signed-off-by: Vincent Biret --- .../Models/OpenApiSecurityRequirementTests.cs | 35 +++---------------- 1 file changed, 5 insertions(+), 30 deletions(-) diff --git a/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs b/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs index 7cb51a919..29f5af3c6 100644 --- a/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs +++ b/test/Microsoft.OpenApi.Tests/Models/OpenApiSecurityRequirementTests.cs @@ -130,35 +130,10 @@ public async Task SerializeSecurityRequirementAsV3JsonWorksAsync(bool produceTer await Verifier.Verify(outputStringWriter).UseParameters(produceTerseOutput); } - [Fact] - public async Task SerializeSecurityRequirementWithReferencedSecuritySchemeAsV3JsonWorks() - { - // Arrange - var expected = - """ - { - "scheme1": [ - "scope1", - "scope2", - "scope3" - ], - "scheme2": [ - "scope4", - "scope5" - ], - "scheme3": [ ] - } - """; - - // Act - var actual = await SecurityRequirementWithReferencedSecurityScheme.SerializeAsJsonAsync(OpenApiSpecVersion.OpenApi3_0); - - // Assert - Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(actual))); - } - - [Fact] - public async Task SerializeSecurityRequirementWithReferencedSecuritySchemeAsV2JsonWorks() + [Theory] + [InlineData(OpenApiSpecVersion.OpenApi3_0)] + [InlineData(OpenApiSpecVersion.OpenApi2_0)] + public async Task SerializeSecurityRequirementWithReferencedSecuritySchemeAsJsonWorks(OpenApiSpecVersion openApiSpecVersion) { // Arrange var expected = @@ -178,7 +153,7 @@ public async Task SerializeSecurityRequirementWithReferencedSecuritySchemeAsV2Js """; // Act - var actual = await SecurityRequirementWithReferencedSecurityScheme.SerializeAsJsonAsync(OpenApiSpecVersion.OpenApi2_0); + var actual = await SecurityRequirementWithReferencedSecurityScheme.SerializeAsJsonAsync(openApiSpecVersion); // Assert Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), JsonNode.Parse(actual))); From a6291d12acc493f4a01729b020910d3af2b2bfce Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Mon, 30 Mar 2026 13:23:10 -0400 Subject: [PATCH 09/11] tests: adds a unit test to validate security reference resolution Signed-off-by: Vincent Biret --- .../Models/OpenApiDocumentTests.cs | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/test/Microsoft.OpenApi.Tests/Models/OpenApiDocumentTests.cs b/test/Microsoft.OpenApi.Tests/Models/OpenApiDocumentTests.cs index 1acd8ce8c..7a47b8597 100644 --- a/test/Microsoft.OpenApi.Tests/Models/OpenApiDocumentTests.cs +++ b/test/Microsoft.OpenApi.Tests/Models/OpenApiDocumentTests.cs @@ -9,6 +9,7 @@ using System.IO; using System.Linq; using System.Net.Http; +using System.Text.Json.Nodes; using System.Threading.Tasks; using VerifyXunit; using Xunit; @@ -2387,6 +2388,56 @@ public async Task SerializeDocumentWithSelfPropertyAsV32Works() Assert.Equal(expected.MakeLineBreaksEnvironmentNeutral(), actual.MakeLineBreaksEnvironmentNeutral()); } + [Theory] + [InlineData(OpenApiSpecVersion.OpenApi3_0)] + [InlineData(OpenApiSpecVersion.OpenApi3_1)] + [InlineData(OpenApiSpecVersion.OpenApi3_2)] + public async Task SerializeDocumentWithSecurityRequirementAsJsonWorks(OpenApiSpecVersion openApiSpecVersion) + { + // Arrange + var doc = new OpenApiDocument + { + Info = new OpenApiInfo { Title = "Test", Version = "1.0" }, + Components = new OpenApiComponents + { + SecuritySchemes = new Dictionary(StringComparer.Ordinal) + { + ["Bearer"] = new OpenApiSecurityScheme + { + Type = SecuritySchemeType.Http, + Scheme = "Bearer", + BearerFormat = "JWT", + }, + }, + }, + }; + + doc.Security = + [ + new OpenApiSecurityRequirement + { + { new OpenApiSecuritySchemeReference("Bearer", doc), [] }, + }, + ]; + + var expected = + """ + [ + { + "Bearer": [] + } + ] + """; + + // Act + var actual = await doc.SerializeAsJsonAsync(openApiSpecVersion); + + // Assert + var actualSecurity = JsonNode.Parse(actual)?["security"]; + Assert.NotNull(actualSecurity); + Assert.True(JsonNode.DeepEquals(JsonNode.Parse(expected), actualSecurity)); + } + [Fact] public async Task SerializeDocumentWithSelfPropertyAsV31WritesAsExtension() { From a5acb896cb46a58702c07bc742b5e114ba90f95a Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Mon, 30 Mar 2026 13:44:13 -0400 Subject: [PATCH 10/11] fix: security scheme references serialization Signed-off-by: Vincent Biret --- .../Models/OpenApiSecurityRequirement.cs | 25 +++++++++++++++---- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/src/Microsoft.OpenApi/Models/OpenApiSecurityRequirement.cs b/src/Microsoft.OpenApi/Models/OpenApiSecurityRequirement.cs index 4a912c0de..766b73f0d 100644 --- a/src/Microsoft.OpenApi/Models/OpenApiSecurityRequirement.cs +++ b/src/Microsoft.OpenApi/Models/OpenApiSecurityRequirement.cs @@ -79,11 +79,7 @@ private void SerializeInternal(IOpenApiWriter writer, Action p.Key?.Target is not null)) + foreach (var securitySchemeAndScopesValuePair in this.Where(static p => CanSerializeSecurityScheme(p.Key))) { var securityScheme = securitySchemeAndScopesValuePair.Key; var scopes = securitySchemeAndScopesValuePair.Value; @@ -103,6 +99,25 @@ private void SerializeInternal(IOpenApiWriter writer, Action /// Serialize to Open Api v2.0 /// From 09a957a1af98c4cf6818163e9ce97dbefb1ae78a Mon Sep 17 00:00:00 2001 From: "release-please-token-provider[bot]" <225477224+release-please-token-provider[bot]@users.noreply.github.com> Date: Tue, 31 Mar 2026 16:55:05 +0000 Subject: [PATCH 11/11] chore(main): release 3.5.1 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 7 +++++++ Directory.Build.props | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index bf0d03617..3549461d9 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "3.5.0" + ".": "3.5.1" } \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index e0cc37e18..265529627 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [3.5.1](https://github.com/microsoft/OpenAPI.NET/compare/v3.5.0...v3.5.1) (2026-03-31) + + +### Bug Fixes + +* security scheme references serialization ([a5acb89](https://github.com/microsoft/OpenAPI.NET/commit/a5acb896cb46a58702c07bc742b5e114ba90f95a)) + ## [3.5.0](https://github.com/microsoft/OpenAPI.NET/compare/v3.4.0...v3.5.0) (2026-03-20) diff --git a/Directory.Build.props b/Directory.Build.props index 034c59b03..410c635e0 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -12,7 +12,7 @@ https://github.com/Microsoft/OpenAPI.NET © Microsoft Corporation. All rights reserved. OpenAPI .NET - 3.5.0 + 3.5.1