[release/10.0] Limit Microsoft.OpenApi to disallow next major

[Youssef1313]

This mirrors #67771 in release/10.0.

Limit Microsoft.OpenApi to disallow next major

This PR adjusts the dependency on Microsoft.OpenApi to be < 3.0.0 and >= 2.7.5.

Description

Microsoft.OpenApi 2.x and 3.x are not binary compatible. Attempting to update Microsoft.OpenApi in user applications to 3.x while using .NET 10 will fail with errors that are hard to interpret by users. This could either be that the Xml comments source generator producing code with compilation errors, or fail due to other binary incompatibilities at runtime.

Fixes #64317

Customer Impact

Customers will get a more clear error from NuGet that they should keep the dependency on 2.x as 3.0.0+ isn't supported. This is better than failing with cryptic errors in source-generated code.

Regression?

No

Risk

Low

This is a failure case already today.

Verification

From CI artifacts:

Packaging changes reviewed?

• Yes
• No
• N/A

[Copilot]

Pull request overview

This PR updates the repo’s dependency version configuration to constrain Microsoft.OpenApi / Microsoft.OpenApi.YamlReader so NuGet restore won’t float to the next major version, mirroring release/10.0 PR #67771.

Changes:

• Changed MicrosoftOpenApiVersion and MicrosoftOpenApiYamlReaderVersion from a fixed version to a (intended) version range in eng/Versions.props.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[dotnet-policy-service]

Hi @Youssef1313. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.