Bump MessagePack from 3.0.214-rc.1 to 3.1.8

[dependabot]

Updated MessagePack from 3.0.214-rc.1 to 3.1.8.

Release notes

Sourced from MessagePack's releases.

3.1.7

What's Changed

• Add scoped to MessagePackWriter.Write(ReadOnlySpan<T>) methods by @​AArnott in Add scoped to MessagePackWriter.Write(ReadOnlySpan<T>) methods MessagePack-CSharp/MessagePack-CSharp#2271
• Fix security issues in master by @​AArnott in Fix security issues in master MessagePack-CSharp/MessagePack-CSharp#2274

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes

• 26d4e743 GHSA-382j-8mxh-c7x2 Reject invalid DateTime ext lengths for CWE-789
• b9cb6050 GHSA-vh6j-jc39-fggf Use iteration for skipping msgpack structures for CWE-674
• 719e690a GHSA-hv8m-jj95-wg3x Bound LZ4 input reads for CWE-125

Moderage severity advisory fixes

• 2b5a500a GHSA-v72x-2h86-7f8m Guard LZ4 decompression length for CWE-409
• f093bdc1 GHSA-qhmf-xw27-6rqr Reject nested typeless blocklist bypass for CWE-502
• f077798e GHSA-2f33-pr97-265q Default MVC input formatter to UntrustedData for CWE-1188
• 25a3493e GHSA-2x83-8g95-xh59 Limit untrusted ExpandoObject maps for CWE-407
• b414e6df GHSA-wfr3-xj75-pfwh Guard dynamic union depth for CWE-674
• 0555f07c GHSA-w567-gjr2-hm5j Validate Unity blit lengths for CWE-789
• 9b5783a7 GHSA-cxmj-83gh-fp49 Fix CWE-789 multidimensional array allocation validation
• f96fcf05 GHSA-q2h6-ghwm-5qm8 Use secure lookup comparer for CWE-407
• b3af7cf7 GHSA-cj9g-3mj2-g8vv Guard JSON conversion depth for CWE-674
• 66ad0894 GHSA-cj9g-3mj2-g8vv Avoid JSON separator recursion for CWE-674
• 082ba7da GHSA-cj9g-3mj2-g8vv Guard typeless JSON depth for CWE-674

Fixes with no security advisory

• fb0fe9f0 Honor TypeFormatter options hooks for CWE-470
• c1c06a6f Fix WriteRawX methods to advance by written length
• 46c6a0fe Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

3.1.6

What's Changed

• Add several known unsafe 'gadgets' to the disallow list by @​AArnott in Add several known unsafe 'gadgets' to the disallow list MessagePack-CSharp/MessagePack-CSharp#2270

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

3.1.5

What's Changed

• Remove unneeded GetTypeInfo() calls by @​Bykiev in Remove unneeded GetTypeInfo() calls MessagePack-CSharp/MessagePack-CSharp#2206
• Use 'Write' instead of 'WriteInt32' for union type keys by @​VictorNicollet in Use 'Write' instead of 'WriteInt32' for union type keys MessagePack-CSharp/MessagePack-CSharp#2212
• Fix various disposable issues by @​Bykiev in Fix various disposable issues MessagePack-CSharp/MessagePack-CSharp#2224
• fix: prevent StackOverflow in Equals with recursive generic constraints by @​khuongntrd in fix: prevent StackOverflow in Equals with recursive generic constraints MessagePack-CSharp/MessagePack-CSharp#2226
• Add more types to the default disallow list of named types to be deserialized by @​AArnott in Add more types to the default disallow list of named types to be deserialized MessagePack-CSharp/MessagePack-CSharp#2256
• Fix release workflow by @​AArnott in Fix release workflow MessagePack-CSharp/MessagePack-CSharp#2268
• Fix Incorrect DateTimeOffset Serializer by @​T0PP1ng in Fix Incorrect DateTimeOffset Serializer MessagePack-CSharp/MessagePack-CSharp#2225
• Revert DateTimeOffset encoding change by @​AArnott in Revert DateTimeOffset encoding change MessagePack-CSharp/MessagePack-CSharp#2262

New Contributors

• @​Bykiev made their first contribution in Remove unneeded GetTypeInfo() calls MessagePack-CSharp/MessagePack-CSharp#2206
• @​VictorNicollet made their first contribution in Use 'Write' instead of 'WriteInt32' for union type keys MessagePack-CSharp/MessagePack-CSharp#2212
• @​T0PP1ng made their first contribution in Fix Incorrect DateTimeOffset Serializer MessagePack-CSharp/MessagePack-CSharp#2225
• @​khuongntrd made their first contribution in fix: prevent StackOverflow in Equals with recursive generic constraints MessagePack-CSharp/MessagePack-CSharp#2226

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

3.1.4

What's Changed

• Fix SkipClrVisibilityChecks to notice private fields in base classes by @​AArnott in Fix SkipClrVisibilityChecks to notice private fields in base classes MessagePack-CSharp/MessagePack-CSharp#2153
• Promote analyzers to AnalyzerReleases.Shipped.md by @​hanachiru in Promote analyzers to AnalyzerReleases.Shipped.md MessagePack-CSharp/MessagePack-CSharp#2169
• Add memory size check to GetMemoryCheckResult by @​AArnott in Add memory size check to GetMemoryCheckResult MessagePack-CSharp/MessagePack-CSharp#2172
• AccessModifier was added to generated code. by @​Nirklav in AccessModifier was added to generated code. MessagePack-CSharp/MessagePack-CSharp#2185

New Contributors

• @​hanachiru made their first contribution in Promote analyzers to AnalyzerReleases.Shipped.md MessagePack-CSharp/MessagePack-CSharp#2169

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

3.1.3

What's Changed

• Fix stackoverflow on analyzer by @​neuecc in Fix stackoverflow on analyzer MessagePack-CSharp/MessagePack-CSharp#2150

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

3.1.2

What's Changed

• Add missing recursion guard to CodeAnalysisUtilities.GetTypeParameters by @​AArnott in Add missing recursion guard to CodeAnalysisUtilities.GetTypeParameters MessagePack-CSharp/MessagePack-CSharp#2123
• Remove FluentAssertions, Use Shouldly by @​neuecc in Remove FluentAssertions, Use Shouldly MessagePack-CSharp/MessagePack-CSharp#2124
• Fix issues about Double.MaxValue by @​guojiancong in Fix issues about Double.MaxValue MessagePack-CSharp/MessagePack-CSharp#2135
• GitHubActions, prevent run build-unity on external contributor by @​neuecc in GitHubActions, prevent run build-unity on external contributor MessagePack-CSharp/MessagePack-CSharp#2138
• Protects the generated resolver type metadata from trimmer by @​mayuki in Protects the generated resolver type metadata from trimmer MessagePack-CSharp/MessagePack-CSharp#2134
• Add PreserveAttribute to generic formatters for Unity IL2CPP by @​neuecc in Add PreserveAttribute to generic formatters for Unity IL2CPP MessagePack-CSharp/MessagePack-CSharp#2136
• Change ByteListFormatter behaviour to keep binary compatibility for List by @​neuecc in Change ByteListFormatter behaviour to keep binary compatibility for List<byte> MessagePack-CSharp/MessagePack-CSharp#2139

New Contributors

• @​guojiancong made their first contribution in Fix issues about Double.MaxValue MessagePack-CSharp/MessagePack-CSharp#2135

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

3.1.1

What's Changed

• README.md: ÌntKey -> IntKey by @​stanoddly in README.md: ÌntKey -> IntKey MessagePack-CSharp/MessagePack-CSharp#2098
• allow DynamicGenericResolver to StandardResolver in DynamicAssembly.AvoidDynamicCode by @​neuecc in allow DynamicGenericResolver to StandardResolver in DynamicAssembly.AvoidDynamicCode MessagePack-CSharp/MessagePack-CSharp#2105
• Remove PublicApiAnalyzers by @​neuecc in Remove PublicApiAnalyzers MessagePack-CSharp/MessagePack-CSharp#2104
• Fix source generator, don't generate when abstract/interface is not union by @​neuecc in Fix source generator, don't generate when abstract/interface is not union MessagePack-CSharp/MessagePack-CSharp#2103
• enable analyze union / stop collect field when object marked SuppressSourceGeneration by @​neuecc in enable analyze union / stop collect field when object marked SuppressSourceGeneration MessagePack-CSharp/MessagePack-CSharp#2106

New Contributors

• @​stanoddly made their first contribution in README.md: ÌntKey -> IntKey MessagePack-CSharp/MessagePack-CSharp#2098

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

3.1.0

What's Changed

• Relaxed the conditions in editor.config by @​neuecc in Relaxed the conditions in editor.config MessagePack-CSharp/MessagePack-CSharp#2088
• Add .NET 9 by @​neuecc in Add .NET 9 MessagePack-CSharp/MessagePack-CSharp#2090
• Add Int128, UInt128, Rune. OrderedDictionary<T, V>. ReadOnlySet<T> serialization support
• Check IsGenericType before call ConstructUnboundGenericType() by @​neuecc in Check IsGenericType before call ConstructUnboundGenericType() MessagePack-CSharp/MessagePack-CSharp#2093
• Remove NerdBank.GitVersioning by @​neuecc in Remove NerdBank.GitVersioning MessagePack-CSharp/MessagePack-CSharp#2094
• Current all apis to shipped.txt by @​neuecc in Current all apis to shipped.txt MessagePack-CSharp/MessagePack-CSharp#2095

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

3.0.301

Note

Tag and Unity's version is 3.0.301 but published NuGet version is 3.0.308.
The version mismatch due to release process inconsistencies will be fixed in the next release.

What's Changed

• Touch-ups to master by @​AArnott in Touch-ups to master MessagePack-CSharp/MessagePack-CSharp#2084
• Fix Source Generator doesnt work in Unity by @​neuecc in Fix Source Generator doesnt work in Unity MessagePack-CSharp/MessagePack-CSharp#2087

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.300...v3.0.301

3.0.300

Fixed version, release notes see v3.0.3.

3.0.238-rc.1

What's Changed

• Fix simplified name for ValueTuple by @​AlanLiu90 in Fix simplified name for ValueTuple<T> MessagePack-CSharp/MessagePack-CSharp#2033
• Avoid crashing with stack overflow on recursive generic type parameter constraints by @​AArnott in Avoid crashing with stack overflow on recursive generic type parameter constraints MessagePack-CSharp/MessagePack-CSharp#2036

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.233-rc.1...v3.0.238-rc.1

3.0.233-rc.1

Changes

Enhancements

• #​2013: Secure by default

Fixes

• #​2031: Use generic type argument used for custom formatters
• #​2029: Apply scoped in more places
• #​2030: Support nesting formatters within generic data types
• #​2024: Source code generation fails for generic type with private member serialization
• #​2028: Avoid collecting fields with custom formatter recusively
• #​2023: Suppress MsgPack004 on private base members when only public is interesting
• #​2022: Ignore abstract implementations of IMessagePackFormatter<T>
• #​2012: MsgPack004 Analyzer triggering on not attributed private property on base class eventhough source generator shouldn't include private properties
• #​2017: MsgPack013 should not report diagnostics on abstract classes
• #​2021: Add scoped modifier to in parameters of ref struct
• #​2016: Avoid collecting members when it doesn't have [Key]
• #​2005: custom formatters code source generator error

Others

• #​2032: Use simpler C# syntax for nullable value types

Commits viewable in compare view.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[dependabot]

Dependabot attempted to update this pull request, but because the branch dependabot/nuget/src/csharp/Microsoft.Spark/MessagePack-3.1.8 is protected it was unable to do so.