From 3f012bc4cd4f46a25b0b6f6dd4d35b3f0525bd91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 17:38:57 -0400 Subject: [PATCH 1/9] chore(deps): bump actions/upload-code-coverage from 1.4.1 to 1.4.2 (#3024) Bumps [actions/upload-code-coverage](https://github.com/actions/upload-code-coverage) from 1.4.1 to 1.4.2. - [Commits](https://github.com/actions/upload-code-coverage/compare/1c15be36fc3733ba839b1dd643bd9556e4426dc1...d8e329117199404bba6fc81efe8093dc7c015e34) --- updated-dependencies: - dependency-name: actions/upload-code-coverage dependency-version: 1.4.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index 4c7d6977e..13136e298 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -64,7 +64,7 @@ jobs: - name: Upload coverage report if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch) - uses: actions/upload-code-coverage@1c15be36fc3733ba839b1dd643bd9556e4426dc1 # v1.4.1 + uses: actions/upload-code-coverage@d8e329117199404bba6fc81efe8093dc7c015e34 # v1.4.2 with: file: ./reports/coverage/Cobertura.xml language: CSharp From 39a80f31a3347e5eb22a402e12deddb60cac9b88 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 17:27:49 -0400 Subject: [PATCH 2/9] chore(deps): bump dotnet-sdk from 10.0.302 to 10.0.400 (#3028) Bumps [dotnet-sdk](https://github.com/dotnet/sdk) from 10.0.302 to 10.0.400. - [Release notes](https://github.com/dotnet/sdk/releases) - [Commits](https://github.com/dotnet/sdk/compare/v10.0.302...v10.0.400) --- updated-dependencies: - dependency-name: dotnet-sdk dependency-version: 10.0.400 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- global.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/global.json b/global.json index d0c1ec64c..151193853 100644 --- a/global.json +++ b/global.json @@ -1,5 +1,5 @@ { "sdk": { - "version": "10.0.302" + "version": "10.0.400" } } \ No newline at end of file From a03523af6baa2cdee4a55cc0a0fce7f04810be6c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:55:02 -0400 Subject: [PATCH 3/9] Bump Microsoft.SourceLink.GitHub from 10.0.301 to 10.0.400 (#3030) --- updated-dependencies: - dependency-name: Microsoft.SourceLink.GitHub dependency-version: 10.0.400 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- Directory.Build.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Directory.Build.props b/Directory.Build.props index aec0c52e9..c1f43b61f 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -19,6 +19,6 @@ true - + \ No newline at end of file From ba2b71ff791fe7e68797cde9ca6160431d6e0e5f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:56:25 -0400 Subject: [PATCH 4/9] Bump the microsoftextensions group with 6 updates (#3029) Bumps Microsoft.Extensions.DependencyInjection from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging.Abstractions from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging.Console from 10.0.10 to 10.0.11 Bumps Microsoft.Extensions.Logging.Debug from 10.0.10 to 10.0.11 Bumps System.Text.Json from 10.0.10 to 10.0.11 --- updated-dependencies: - dependency-name: Microsoft.Extensions.DependencyInjection dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging.Abstractions dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: System.Text.Json dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging.Console dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging.Debug dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions - dependency-name: Microsoft.Extensions.Logging.Debug dependency-version: 10.0.11 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: microsoftextensions ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- performance/resultsComparer/resultsComparer.csproj | 10 +++++----- .../Microsoft.OpenApi.Hidi.csproj | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/performance/resultsComparer/resultsComparer.csproj b/performance/resultsComparer/resultsComparer.csproj index 80a964ca2..7cbd4cacb 100644 --- a/performance/resultsComparer/resultsComparer.csproj +++ b/performance/resultsComparer/resultsComparer.csproj @@ -8,12 +8,12 @@ - - - - + + + + - + diff --git a/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj b/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj index 371fb339b..d578c9e69 100644 --- a/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj +++ b/src/Microsoft.OpenApi.Hidi/Microsoft.OpenApi.Hidi.csproj @@ -29,10 +29,10 @@ - - - - + + + + runtime; build; native; contentfiles; analyzers; buildtransitive all From e0d5e9d105ad1a7b29ff6c628793614f5610f048 Mon Sep 17 00:00:00 2001 From: Gavin Barron Date: Tue, 18 Aug 2026 17:42:33 -0700 Subject: [PATCH 5/9] fix: harden yaml parsing (#3027) --- .../performance.Descriptions-report-github.md | 24 +- .../performance.Descriptions-report.csv | 12 +- .../performance.Descriptions-report.html | 24 +- .../performance.Descriptions-report.json | 2 +- .../performance.EmptyModels-report-github.md | 68 +-- .../performance.EmptyModels-report.csv | 56 +-- .../performance.EmptyModels-report.html | 66 +-- .../performance.EmptyModels-report.json | 2 +- .../Microsoft.OpenApi.YamlReader.csproj | 2 +- .../OpenApiReaderSettingsExtensions.cs | 17 +- .../OpenApiYamlReader.cs | 167 ++++++- .../OpenApiYamlReaderSettings.cs | 73 +++ .../PublicAPI.Unshipped.txt | 21 + .../YamlConversionBudget.cs | 125 +++++ .../YamlConverter.cs | 275 ++++++++--- .../YamlJsonParser.cs | 291 +++++++++++ .../Validations/Rules/OpenApiSchemaRules.cs | 104 ++-- .../OpenApiReaderSettingsExtensionsTests.cs | 15 + .../OpenApiYamlReaderTests.cs | 454 +++++++++++++++++- .../YamlConverterGlobalSettingsCollection.cs | 9 + .../YamlConverterGlobalSettingsTests.cs | 81 ++++ .../YamlConverterTests.cs | 60 +-- .../Reader/OpenApiJsonReaderTests.cs | 39 ++ .../OpenApiSchemaValidationTests.cs | 199 ++++++++ 24 files changed, 1888 insertions(+), 298 deletions(-) create mode 100644 src/Microsoft.OpenApi.YamlReader/OpenApiYamlReaderSettings.cs create mode 100644 src/Microsoft.OpenApi.YamlReader/YamlConversionBudget.cs create mode 100644 src/Microsoft.OpenApi.YamlReader/YamlJsonParser.cs create mode 100644 test/Microsoft.OpenApi.Readers.Tests/YamlConverterGlobalSettingsCollection.cs create mode 100644 test/Microsoft.OpenApi.Readers.Tests/YamlConverterGlobalSettingsTests.cs diff --git a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report-github.md b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report-github.md index 6ee697332..70573f5a0 100644 --- a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report-github.md +++ b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report-github.md @@ -1,20 +1,20 @@ ``` BenchmarkDotNet v0.15.8, Linux Ubuntu 24.04.4 LTS (Noble Numbat) -INTEL XEON PLATINUM 8573C 2.30GHz, 1 CPU, 4 logical and 2 physical cores -.NET SDK 10.0.302 - [Host] : .NET 8.0.29 (8.0.29, 8.0.2926.32403), X64 RyuJIT x86-64-v4 - ShortRun : .NET 8.0.29 (8.0.29, 8.0.2926.32403), X64 RyuJIT x86-64-v4 +INTEL XEON PLATINUM 8573C 3.39GHz, 1 CPU, 4 logical and 2 physical cores +.NET SDK 10.0.400 + [Host] : .NET 8.0.30 (8.0.30, 8.0.3026.36720), X64 RyuJIT x86-64-v4 + ShortRun : .NET 8.0.30 (8.0.30, 8.0.3026.36720), X64 RyuJIT x86-64-v4 Job=ShortRun IterationCount=3 LaunchCount=1 WarmupCount=3 ``` -| Method | Mean | Error | StdDev | Gen0 | Gen1 | Gen2 | Allocated | -|------------- |---------------:|--------------:|-------------:|----------:|----------:|----------:|-------------:| -| PetStoreYaml | 477.6 μs | 237.53 μs | 13.02 μs | 3.9063 | - | - | 375.67 KB | -| PetStoreJson | 193.3 μs | 29.03 μs | 1.59 μs | 1.9531 | - | - | 209.67 KB | -| GHESYaml | 878,325.2 μs | 555,688.50 μs | 30,459.16 μs | 4000.0000 | 3000.0000 | 1000.0000 | 310814.2 KB | -| GHESJson | 225,445.4 μs | 35,058.33 μs | 1,921.67 μs | 1000.0000 | - | - | 140426.65 KB | -| GHESNextYaml | 1,254,063.7 μs | 245,210.30 μs | 13,440.80 μs | 8000.0000 | 6000.0000 | 2000.0000 | 512928.9 KB | -| GHESNextJson | 588,121.5 μs | 83,680.85 μs | 4,586.83 μs | 5000.0000 | 4000.0000 | 1000.0000 | 344754.7 KB | +| Method | Mean | Error | StdDev | Gen0 | Gen1 | Gen2 | Allocated | +|------------- |-------------:|--------------:|-------------:|----------:|----------:|----------:|-------------:| +| PetStoreYaml | 441.7 μs | 119.48 μs | 6.55 μs | 3.9063 | - | - | 327.8 KB | +| PetStoreJson | 167.1 μs | 44.75 μs | 2.45 μs | 1.9531 | - | - | 209.67 KB | +| GHESYaml | 639,148.3 μs | 104,953.08 μs | 5,752.83 μs | 4000.0000 | 3000.0000 | 1000.0000 | 267097.41 KB | +| GHESJson | 183,609.4 μs | 234,899.82 μs | 12,875.65 μs | 1000.0000 | - | - | 140442.72 KB | +| GHESNextYaml | 877,586.8 μs | 245,901.99 μs | 13,478.72 μs | 6000.0000 | 4000.0000 | 1000.0000 | 469032.8 KB | +| GHESNextJson | 521,883.6 μs | 100,709.23 μs | 5,520.21 μs | 5000.0000 | 4000.0000 | 1000.0000 | 344770.8 KB | diff --git a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.csv b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.csv index c5aeb2762..20abd8b12 100644 --- a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.csv +++ b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.csv @@ -1,7 +1,7 @@ Method,Job,AnalyzeLaunchVariance,EvaluateOverhead,MaxAbsoluteError,MaxRelativeError,MinInvokeCount,MinIterationTime,OutlierMode,Affinity,EnvironmentVariables,Jit,LargeAddressAware,Platform,PowerPlanMode,Runtime,AllowVeryLargeObjects,Concurrent,CpuGroups,Force,HeapAffinitizeMask,HeapCount,NoAffinitize,RetainVm,Server,Arguments,BuildConfiguration,Clock,EngineFactory,NuGetReferences,Toolchain,IsMutator,InvocationCount,IterationCount,IterationTime,LaunchCount,MaxIterationCount,MaxWarmupIterationCount,MemoryRandomization,MinIterationCount,MinWarmupIterationCount,RunStrategy,UnrollFactor,WarmupCount,Mean,Error,StdDev,Gen0,Gen1,Gen2,Allocated -PetStoreYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,477.6 μs,237.53 μs,13.02 μs,3.9063,0.0000,0.0000,375.67 KB -PetStoreJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,193.3 μs,29.03 μs,1.59 μs,1.9531,0.0000,0.0000,209.67 KB -GHESYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"878,325.2 μs","555,688.50 μs","30,459.16 μs",4000.0000,3000.0000,1000.0000,310814.2 KB -GHESJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"225,445.4 μs","35,058.33 μs","1,921.67 μs",1000.0000,0.0000,0.0000,140426.65 KB -GHESNextYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"1,254,063.7 μs","245,210.30 μs","13,440.80 μs",8000.0000,6000.0000,2000.0000,512928.9 KB -GHESNextJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"588,121.5 μs","83,680.85 μs","4,586.83 μs",5000.0000,4000.0000,1000.0000,344754.7 KB +PetStoreYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,441.7 μs,119.48 μs,6.55 μs,3.9063,0.0000,0.0000,327.8 KB +PetStoreJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,167.1 μs,44.75 μs,2.45 μs,1.9531,0.0000,0.0000,209.67 KB +GHESYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"639,148.3 μs","104,953.08 μs","5,752.83 μs",4000.0000,3000.0000,1000.0000,267097.41 KB +GHESJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"183,609.4 μs","234,899.82 μs","12,875.65 μs",1000.0000,0.0000,0.0000,140442.72 KB +GHESNextYaml,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"877,586.8 μs","245,901.99 μs","13,478.72 μs",6000.0000,4000.0000,1000.0000,469032.8 KB +GHESNextJson,ShortRun,False,Default,Default,Default,Default,Default,Default,1111,Empty,RyuJit,Default,X64,8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c,.NET 8.0,False,True,False,True,Default,Default,False,False,False,Default,Default,Default,Default,Default,Default,Default,Default,3,Default,1,Default,Default,Default,Default,Default,Default,16,3,"521,883.6 μs","100,709.23 μs","5,520.21 μs",5000.0000,4000.0000,1000.0000,344770.8 KB diff --git a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.html b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.html index f015841f0..a8eee52cd 100644 --- a/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.html +++ b/performance/benchmark/BenchmarkDotNet.Artifacts/results/performance.Descriptions-report.html @@ -2,7 +2,7 @@ -performance.Descriptions-20260807-144733 +performance.Descriptions-20260818-223332