Merge branch 'main' into dev/ygerges/multiple-types-3

Author: Youssef1313

.azure-pipelines/ci-build.yml

@@ -79,6 +79,20 @@ extends:
             checkLatest: true
 
         # Build the Product project
+        - task: NuGetAuthenticate@1
+          displayName: 'Authenticate to Azure Artifacts'
+
+        - pwsh: |
+            @"
+            <?xml version="1.0" encoding="utf-8"?>
+            <configuration>
+              <packageSources>
+                <clear />
+                <add key="GraphDeveloperExperiences_Public" value="https://microsoftgraph.pkgs.visualstudio.com/0985d294-5762-4bc2-a565-161ef349ca3e/_packaging/GraphDeveloperExperiences_Public/nuget/v3/index.json" />
+              </packageSources>
+            </configuration>
+            "@ | Set-Content -Path "$(Build.SourcesDirectory)/nuget.config" -Encoding UTF8
+          displayName: 'Create nuget.config (central feed)'
         - task: DotNetCoreCLI@2
           displayName: 'build'
           inputs:

.github/dependabot.yml

@@ -1,35 +1,41 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    # default location of `.github/workflows`
-    directory: "/"
-    open-pull-requests-limit: 10
-    schedule:
-      interval: "daily"
-  - package-ecosystem: "nuget"
-    # location of package manifests
-    directory: "/"
-    open-pull-requests-limit: 10
-    schedule:
-      interval: "daily"
-    groups:
-      MicrosoftExtensions:
-        patterns:
-          - "Microsoft.Extensions.*"
-      coverlet:
-        patterns:
-          - "coverlet.*"
-  - package-ecosystem: dotnet-sdk
-    directory: /
-    schedule:
-      interval: "daily"
-    ignore:
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: "devcontainers"
-    directory: "/"
-    open-pull-requests-limit: 10
-    schedule:
-      interval: "daily"
+- package-ecosystem: github-actions
+  directory: /
+  open-pull-requests-limit: 10
+  schedule:
+    interval: daily
+  cooldown:
+    default-days: 7
+- package-ecosystem: nuget
+  directory: /
+  open-pull-requests-limit: 10
+  schedule:
+    interval: daily
+  groups:
+    MicrosoftExtensions:
+      patterns:
+      - Microsoft.Extensions.*
+    coverlet:
+      patterns:
+      - coverlet.*
+  cooldown:
+    default-days: 7
+- package-ecosystem: dotnet-sdk
+  directory: /
+  schedule:
+    interval: daily
+  ignore:
+  - dependency-name: '*'
+    update-types:
+    - version-update:semver-major
+    - version-update:semver-minor
+  cooldown:
+    default-days: 7
+- package-ecosystem: devcontainers
+  directory: /
+  open-pull-requests-limit: 10
+  schedule:
+    interval: daily
+  cooldown:
+    default-days: 7

.github/workflows/ci-cd.yml

@@ -18,12 +18,12 @@ jobs:
       GITHUB_RUN_NUMBER: ${{ github.run_number }}
     steps:
       - name: Setup .NET 8
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 8.x
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.x
 
@@ -64,7 +64,7 @@ jobs:
 
       - name: Upload coverage report
         if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') || (github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch)
-        uses: actions/upload-code-coverage@v1
+        uses: actions/upload-code-coverage@v1.4.1
         with:
           file: ./reports/coverage/Cobertura.xml
           language: CSharp
@@ -83,12 +83,12 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Setup .NET 8
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 8.x
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.x
 
@@ -105,12 +105,12 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup .NET 8
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 8.x
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.x
 

.github/workflows/codeql-analysis.yml

@@ -23,18 +23,18 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup .NET 8
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 8.0.x
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
 
       - name: Initialize CodeQL
         id: init_codeql
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.2
         with:
           queries: security-and-quality
 
@@ -54,6 +54,6 @@ jobs:
 
       - name: Perform CodeQL Analysis
         id: analyze_codeql
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.2
 
 # Built with ❤ by [Pipeline Foundation](https://pipeline.foundation)

.github/workflows/sonarcloud.yml

@@ -40,11 +40,11 @@ jobs:
           distribution: 'adopt'
           java-version: 17
       - name: Setup .NET 8
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 8.0.x
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: 10.0.x
       - uses: actions/checkout@v7

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.8.0"
+  ".": "3.9.0"
 }

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [3.9.0](https://github.com/microsoft/OpenAPI.NET/compare/v3.8.0...v3.9.0) (2026-07-15)
+
+
+### Features
+
+* adds support for anchor and id external resolution ([1591007](https://github.com/microsoft/OpenAPI.NET/commit/15910070f2bf3006f79e1c43dd9c2b56e45d665c))
+* **schema:** resolve bare $dynamicRef via $dynamicAnchor index ([#2913](https://github.com/microsoft/OpenAPI.NET/issues/2913)) ([eacc2fc](https://github.com/microsoft/OpenAPI.NET/commit/eacc2fc06537fbb11fe95765e4fb6df09861c9af))
+* support relative URI resolution in $dynamicRef ([#2928](https://github.com/microsoft/OpenAPI.NET/issues/2928)) ([#2945](https://github.com/microsoft/OpenAPI.NET/issues/2945)) ([821053b](https://github.com/microsoft/OpenAPI.NET/commit/821053ba02129e92868df2ae0c26551fb3d5276a))
+
+
+### Bug Fixes
+
+* adds explicit error message for invalid json pointers ([63fc55d](https://github.com/microsoft/OpenAPI.NET/commit/63fc55d69274ebd405e677983e0a72efd2b96079))
+* adds explicit error message for invalid json pointers ([bc93efe](https://github.com/microsoft/OpenAPI.NET/commit/bc93efe9d4694e89da1ea30fbc2d031e7f1318ae))
+* default mapping is not being serialized with the correct shape ([fe4a25f](https://github.com/microsoft/OpenAPI.NET/commit/fe4a25f1f25c853404540d30f11812f1208f93c9))
+* differentiate unset value from null value in OpenApiSchema.Const ([#2936](https://github.com/microsoft/OpenAPI.NET/issues/2936)) ([07b525f](https://github.com/microsoft/OpenAPI.NET/commit/07b525f568b65b5003deaccc56829f5e7e8e2641))
+* handle nullability more accurately during serialization for 3.0/2.0 ([#2933](https://github.com/microsoft/OpenAPI.NET/issues/2933)) ([0ace243](https://github.com/microsoft/OpenAPI.NET/commit/0ace243ebbabe82aacc52d49fe58f54f039bdf76))
+* validate required properties of security scheme before serialization ([#2952](https://github.com/microsoft/OpenAPI.NET/issues/2952)) ([f31b192](https://github.com/microsoft/OpenAPI.NET/commit/f31b192e9d59d39671fdfd03b4fa4d309b03021b))
+
 ## [3.8.0](https://github.com/microsoft/OpenAPI.NET/compare/v3.7.0...v3.8.0) (2026-07-03)
 
 

Directory.Build.props

@@ -12,7 +12,7 @@
     <PackageProjectUrl>https://github.com/Microsoft/OpenAPI.NET</PackageProjectUrl>
     <Copyright>© Microsoft Corporation. All rights reserved.</Copyright>
     <PackageTags>OpenAPI .NET</PackageTags>
-    <Version>3.8.0</Version>
+    <Version>3.9.0</Version>
   </PropertyGroup>
   <!-- https://github.com/clairernovotny/DeterministicBuilds#deterministic-builds -->
   <PropertyGroup Condition="'$(TF_BUILD)' == 'true'">

src/Microsoft.OpenApi.Workbench/Microsoft.OpenApi.Workbench.csproj

@@ -26,6 +26,7 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.Windows.Compatibility" Version="10.0.5" />
+    <PackageReference Include="System.Security.Cryptography.Xml" Version="10.0.6" />
   </ItemGroup>
 
   <!-- Windows-specific resources -->

src/Microsoft.OpenApi/Models/Interfaces/IOpenApiParameter.cs

@@ -1,4 +1,5 @@
-using System.Collections.Generic;
+using System;
+using System.Collections.Generic;
 using System.Text.Json.Nodes;
 
 namespace Microsoft.OpenApi;
@@ -42,6 +43,7 @@ public interface IOpenApiParameter : IOpenApiDescribedElement, IOpenApiReadOnlyE
     /// If style is used, and if behavior is n/a (cannot be serialized),
     /// the value of allowEmptyValue SHALL be ignored.
     /// </summary>
+    [Obsolete("Use of AllowEmptyValue is not recommended and it is likely to be removed in a later revision.")]
     public bool AllowEmptyValue { get; }
 
     /// <summary>