Bump Microsoft.OpenApi.Readers to 1.6.31 to remediate SharpYaml DoS advisory (MVS-2026-hqm8-ggjx) - #3083
Open
Crash Collison (tehcrashxor) wants to merge 2 commits into
Conversation
…dvisory Microsoft.OpenApi.Readers 1.6.11 has a transitive dependency on SharpYaml 2.1.0, which is vulnerable to a denial-of-service attack when processing deeply nested YAML (MVS-2026-hqm8-ggjx). The advisory requires SharpYaml 2.1.5 or later on the 2.x line. Microsoft.OpenApi.Readers 1.6.31 is the first 1.6.x release whose nuspec depends on SharpYaml 2.1.5, so bumping the reader clears the advisory without introducing a direct SharpYaml pin into the dependency surface of the shipped Microsoft.PowerFx.Connectors package. SharpYaml is not referenced directly anywhere in the repo; it arrives only through this package. After the bump, SharpYaml resolves to 2.1.5 in Microsoft.PowerFx.Connectors, Microsoft.PowerFx.Connectors.Tests, and Microsoft.PowerFx.TexlFunctionExporter. Verified with a full solution restore, a clean build of the affected projects, and Microsoft.PowerFx.Connectors.Tests (549 passed, 0 failed, 20 skipped). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
McCall Saltzman (lesaltzm)
approved these changes
Aug 21, 2026
Contributor
|
✅ No public API change. |
Crash Collison (tehcrashxor)
enabled auto-merge (squash)
August 22, 2026 03:52
auto-merge was automatically disabled
September 2, 2026 20:19
Pull request was closed
Crash Collison (tehcrashxor)
enabled auto-merge (squash)
September 2, 2026 20:19
Crash Collison (tehcrashxor)
requested a review
from McCall Saltzman (lesaltzm)
September 2, 2026 20:20
Contributor
|
✅ No public API change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
Microsoft.OpenApi.Readersfrom 1.6.11 to 1.6.31 to remediate a Component Governance security alert on the transitive dependencySharpYaml.Filed as CG alert 19024728 against the
Power Fx-Officialpipeline.The vulnerability
MVS-2026-hqm8-ggjx (severity: medium) — SharpYaml versions before 3.4.0 are vulnerable to denial-of-service when processing deeply nested YAML. The advisory requires 2.1.5+ on the 2.x line.
SharpYamlis not referenced directly anywhere in this repo. It arrives purely transitively:Why 1.6.31 specifically
Walking the nuspec dependency of each 1.6.x release:
1.6.31 is the first 1.6.x release that satisfies the advisory. Bumping the reader avoids adding a direct
SharpYamlpin to the dependency surface of the shippedMicrosoft.PowerFx.Connectorspackage, and stays on the 1.6.x line (2.x is still preview and has breaking API changes).Changes
Microsoft.PowerFx.Connectors.csproj— 1.6.11 → 1.6.31Microsoft.PowerFx.TexlFunctionExporter.csproj— 1.6.11 → 1.6.31Both were bumped together so the exporter does not silently downgrade the resolved graph.
Validation
SharpYamlnow resolves to 2.1.5 in all three affected projects (Microsoft.PowerFx.Connectors,Microsoft.PowerFx.Connectors.Tests,Microsoft.PowerFx.TexlFunctionExporter), verified viaproject.assets.jsonMicrosoft.PowerFx.ConnectorsandMicrosoft.PowerFx.TexlFunctionExporterbuild clean — 0 warnings, 0 errorsMicrosoft.PowerFx.Connectors.Tests: 549 passed, 0 failed, 20 skippedDownstream impact
Microsoft.PowerFx.ConnectorsdeclaresMicrosoft.OpenApi.Readersas a nuspec dependency, so consumers inherit this fix once they pick up a build containing it. This also clears the same SharpYaml advisory on the internalbic/power-fx-internalrepo (CG alert 19025149), which consumesMicrosoft.PowerFx.Connectorsas a package rather than referencing SharpYaml itself.