Bump Microsoft.AspNetCore.OpenApi globally and remove local override

[Copilot]

The OpenAPI package version was only bumped locally in one example project, creating drift from central package management. This change moves the upgrade to central package definitions so all projects resolve the same OpenAPI version.

• Global package management

  • Updated Directory.Packages.props:
    • Microsoft.AspNetCore.OpenApi: 8.0.20 → 10.0.10

• Local override cleanup

  • Removed the per-project VersionOverride in examples/surrealdb/CommunityToolkit.Aspire.Hosting.SurrealDb.ApiService/CommunityToolkit.Aspire.Hosting.SurrealDb.ApiService.csproj so it now inherits the centrally managed version.

• Resulting dependency shape

  • OpenAPI version ownership is now centralized, avoiding project-level version pinning for this package.

<!-- Directory.Packages.props -->
<PackageVersion Include="Microsoft.AspNetCore.OpenApi" Version="10.0.10" />

<!-- SurrealDb ApiService.csproj -->
<PackageReference Include="Microsoft.AspNetCore.OpenApi" />

• Fixes Update OpenAPI NuGet package globally #1514

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1515

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1515"

[Copilot]

Pull request overview

This PR centralizes the Microsoft.AspNetCore.OpenApi package version in the repo’s central package management to eliminate drift caused by a per-project override in an example project.

Changes:

• Updated central package version for Microsoft.AspNetCore.OpenApi in Directory.Packages.props from 8.0.20 to 10.0.10.
• Removed the VersionOverride for Microsoft.AspNetCore.OpenApi in the SurrealDb ApiService example so it inherits the centrally managed version.

Show a summary per file

File	Description
Directory.Packages.props	Bumps Microsoft.AspNetCore.OpenApi centrally so all projects resolve the same version.
examples/surrealdb/CommunityToolkit.Aspire.Hosting.SurrealDb.ApiService/CommunityToolkit.Aspire.Hosting.SurrealDb.ApiService.csproj	Removes the local VersionOverride to rely on central package management.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

[Odonno]

Ah yes, we should also set the Microsoft.OpenApi package to each failing project because for some reason it tries to pull the 2.0.0 version with vulnerabiities.

[aaronpowell]

Ah yes, we should also set the Microsoft.OpenApi package to each failing project because for some reason it tries to pull the 2.0.0 version with vulnerabiities.

Good grief.

I'll look at the resolution chain and work out what's the best way to tackle this