7.1.8

🔒 Security fix — Issue #220

Closes the transitive high-severity advisory GHSA-v5pm-xwqc-g5wc / CVE-2026-49451 (CVSS 7.5, CWE-674 Uncontrolled Recursion — a circular $ref schema could stack-overflow the OpenAPI reader; availability / process-termination only).

• Bumped Swashbuckle.AspNetCore.SwaggerGen 10.0.0 → 10.2.1 on the net10.0 target, which resolves the transitive Microsoft.OpenApi from the vulnerable 2.3.0 to the patched 2.7.5.
• The net8.0 / net9.0 targets use Swashbuckle 8.1.1 → Microsoft.OpenApi v1 and were never in the advisory range — left unchanged.
• No public API or OpenAPI output changes — dependency + version bump only.

📎 IFormFile media type & file size validation — Issue #216

Stable rollup of the work previously shipped as 7.1.8-beta.1 / 7.1.8-beta.2:

• New File-level FluentValidation rules in MicroElements.OpenApi.FluentValidation.FileUpload: .FileContentType(params string[]), .MaxFileSize(long), .MinFileSize(long), .FileSizeBetween(long, long) on IRuleBuilder<T, IFormFile>.
• Swashbuckle, NSwag, and Microsoft.AspNetCore.OpenApi emit multipart/form-data encoding.contentType for file parts and append the allowed types / size limits to the file property description.
• Purely additive / opt-in — output only changes when the new rules are used.

---

Full changelog: https://github.com/micro-elements/MicroElements.Swashbuckle.FluentValidation/blob/master/CHANGELOG.md