Skip to content

chore(deps): drop the MessagePack pin that Aspire 13.6.3 makes redundant #1356

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mforce merged 2 commits into from
Oct 24, 2026
Merged

chore(deps): drop the MessagePack pin that Aspire 13.6.3 makes redundant #1356

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
de1e23d
chore(deps): drop the MessagePack pin that Aspire 13.6.3 makes redundant
mforce Oct 24, 2026
693e461
Merge branch 'main' into chore/drop-messagepack-pin
mforce Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,6 @@
<PackageVersion Include="coverlet.collector" Version="10.*" />
<PackageVersion Include="FluentValidation" Version="12.*" />
<PackageVersion Include="Google.Protobuf" Version="3.*" />
<!-- Pinned: Aspire.Hosting 13.6.1 and StreamJsonRpc bring 2.5.302, which has
GHSA-qhrr-8q5h-9q3h (NU1902). Drop when Aspire ships a patched dependency.
Reason also noted at the reference in Cluckwork.AppHost.csproj. -->
<PackageVersion Include="MessagePack" Version="2.5.307" />
<PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.*" />
<PackageVersion Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" Version="10.*" />
<PackageVersion Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="10.*" />
Expand Down
4 changes: 2 additions & 2 deletions src/Cluckwork.Api/Hosting/McpToolErrors.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

namespace Cluckwork.Api.Hosting;

// #1227 — the SDK (2.2.0, McpServerImpl) logs every exception a tool call throws at Error
// #1227 — the SDK (2.3.0, McpServerImpl) logs every exception a tool call throws at Error
// with its stack trace, and passes the model only an McpException's message. Two failures
// are normal, and this filter answers both with the error result the SDK would write, so
// neither reaches the Error log. An argument that does not bind is found before the tool
Expand Down Expand Up @@ -51,7 +51,7 @@ private static CallToolResult Refuse(RequestContext<CallToolRequestParams> conte

private sealed record Refusal(string Message, string Argument);

// AIFunctionFactory's binding (Microsoft.Extensions.AI 10.8.3): a parameter the input
// AIFunctionFactory's binding (Microsoft.Extensions.AI 10.11.0): a parameter the input
// schema lists is read from the argument of that name with the tool's serializer, and
// a missing one takes its default or fails. The SDK puts the method first in Metadata.
private static Refusal? BadArgument(McpServerTool tool, IDictionary<string, JsonElement>? arguments)
Expand Down
2 changes: 1 addition & 1 deletion src/Cluckwork.Api/Program.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@
: exception is OperationCanceledException canceled
&& httpContext.RequestAborted.IsCancellationRequested
&& (canceled.CancellationToken == httpContext.RequestAborted
// MCP SDK 2.2.0 links RequestAborted with its transport-disposed
// MCP SDK 2.3.0 links RequestAborted with its transport-disposed
// token (StreamableHttpServerTransport.cs:243), and a linked
// token cannot be traced back to its source.
|| CluckworkMcp.IsPath(httpContext.Request.Path))
Expand Down
2 changes: 0 additions & 2 deletions src/Cluckwork.AppHost/Cluckwork.AppHost.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@
<PackageReference Include="Aspire.Hosting.JavaScript" />
<PackageReference Include="Aspire.Hosting.PostgreSQL" />
<PackageReference Include="Aspire.Hosting.Redis" />
<!-- Pin patched MessagePack: transitive 2.5.302 has GHSA-qhrr-8q5h-9q3h (NU1902) -->
<PackageReference Include="MessagePack" />
</ItemGroup>

<ItemGroup>
Expand Down
19 changes: 9 additions & 10 deletions src/Cluckwork.AppHost/packages.lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

22 changes: 10 additions & 12 deletions tests/Cluckwork.AppHost.Tests/packages.lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion tools/verify/mcp/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ what each proves are in [`../features/mcp.md`](../features/mcp.md).
| --- | --- |
| `tls-proxy.mjs` | Terminates TLS for the http sim stack, keeps `Host`, sets `X-Forwarded-Proto`. |
| `client.ts` | The official TypeScript MCP SDK client. `connect` runs discovery, dynamic registration, PKCE and `resource`, and drives the consent screen with Playwright; `tools`, `call` and `disconnect` use a saved token. Speaks MCP 2025-11-25. |
| `probe.cs` | The C# `ModelContextProtocol` 2.2.0 client (the server's SDK), as a file-based app, for MCP 2026-07-28. |
| `probe.cs` | The C# `ModelContextProtocol` 2.2.0 client, as a file-based app, for MCP 2026-07-28. It is older than the server's SDK, so it checks that an older client still works. |

```sh
npm ci # Node 22.18+ runs client.ts directly
Expand Down
Loading