Repository navigation
Bump MessagePack to 2.5.307 and pin Pkcs to the patched versions - #10646
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No unresolved review issues were identified.
No open issues 🎉
What changed in this PR
Updates MessagePack and PKCS dependencies to patched versions across Aspire AppHosts and SQL Server test infrastructure.
Changes:
- Upgrades MessagePack to 2.5.307 and pins it where required.
- Adds patched, framework-specific
System.Security.Cryptography.Pkcsreferences.
| File | Description |
|---|---|
src/Mocha/examples/PostgresTransport/PostgresTransport.AppHost/PostgresTransport.AppHost.csproj |
Pins MessagePack. |
src/Mocha/examples/Demo/Demo.AppHost/Demo.AppHost.csproj |
Pins MessagePack. |
src/Mocha/examples/AzureServiceBusTransport/AzureServiceBusTransport.AppHost/AzureServiceBusTransport.AppHost.csproj |
Pins MessagePack. |
src/HotChocolate/AspNetCore/benchmarks/k6/Catalog.AppHost/eShop.Catalog.AppHost.csproj |
References the centrally upgraded MessagePack package. |
src/Directory.Packages.props |
Updates central MessagePack and PKCS versions. |
src/CookieCrumble/src/CookieCrumble.Resources.SqlServer/CookieCrumble.Resources.SqlServer.csproj |
Pins the patched PKCS dependency. |
Review effort: Lite
Contributor
|
✅ Nitro CLI E2E snapshots: no flow recordings changed vs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
MessagePackfrom 2.5.302 to 2.5.307 and pins it in the four Aspire AppHost projects that resolve it throughAspire.Hosting.AppHost13.6.1. 2.5.307 clears GHSA-qhrr-8q5h-9q3h and two maintainer advisories that are not in the GitHub Advisory Database yet, GHSA-7rj2-5w9w-r9jx and GHSA-fx6j-x9m5-vmrf.HotChocolate.Fusion.Aspirenow depends onMessagePack >= 2.5.307.System.Security.Cryptography.PkcsinCookieCrumble.Resources.SqlServer, whereMicrosoft.Data.SqlClient7.1.1 resolves 8.0.1 or 9.0.18 (GHSA-846f-f764-76mx, GHSA-2fmv-rv2c-59x7). The reference takes the per-framework versions already inDirectory.Packages.props. The project is test infrastructure and is not published, so no package's published dependencies change.Test plan
dotnet list package --vulnerable --include-transitivereports nothing for the Fusion, AspNetCore, eShop, Mocha Demo, CookieCrumble, and GreenDonut solutions, or for the AzureServiceBusTransport and PostgresTransport AppHosts.EnforceCodeStyleInBuild=false, because of existingIDE0005andIDE1006errors in its projects.HotChocolate.Fusion.Aspire.Tests(net9.0, net10.0, net11.0) andGreenDonut.Data.EntityFramework.Tests(net8.0 to net11.0, SQL Server container tests included) pass.