Repository navigation
fix(deps): pin MessagePack 2.5.303 for GHSA-qhrr-8q5h-9q3h - #1321
Merged
Merged
Conversation
Aspire.Hosting 13.6.1 and StreamJsonRpc resolve MessagePack 2.5.302. GHSA-qhrr-8q5h-9q3h, published 2026-10-15, makes restore fail with NU1902 in both AppHost projects, so every PR's .NET jobs go red. Pin the patched 2.5.303 centrally with a direct reference in the AppHost, the same pattern as the Microsoft.OpenApi pin. The lock files change only the MessagePack entries.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GHSA-qhrr-8q5h-9q3h (MessagePack < 2.5.303, moderate) was published on 2026-10-15. NuGet audit raises it as NU1902, which this repo treats as an error, so
dotnet restorefails in both AppHost projects. Every PR's .NET jobs now fail in about 20 seconds; #1315 is one example.MessagePack 2.5.302 comes in transitively through Aspire.Hosting 13.6.1 and StreamJsonRpc. This PR pins 2.5.303 in
Directory.Packages.propsand adds a direct reference inCluckwork.AppHost.csproj, the same wayMicrosoft.OpenApiis pinned. AppHost.Tests gets the pin through its project reference.Both lock files change only their MessagePack entries. A plain restore also moved the floating
Microsoft.NET.Test.Sdkandxunit.runner.visualstudioranges in AppHost.Tests. I removed those unrelated changes from the AppHost.Tests lock file.Verified locally:
dotnet restore Cluckwork.slnx --locked-modepasses.dotnet list package --vulnerable --include-transitivereports nothing in any project.Remove the pin once Aspire ships a patched dependency.