Skip to content

fix(deps): patch MessagePack for Aspire and use per-TFM Microsoft.Extensions.Http #7072

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thomhurst merged 2 commits into from
Oct 17, 2026
Merged

fix(deps): patch MessagePack for Aspire and use per-TFM Microsoft.Extensions.Http #7072

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
79c0e7c
fix(deps): pin patched MessagePack 2.5.303 for Aspire (GHSA-qhrr-8q5h…
claude Oct 16, 2026
0fb9421
fix(deps): use per-TFM Microsoft.Extensions.Http versions for TUnit.M…
claude Oct 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,22 +2,26 @@
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
</PropertyGroup>
<!-- Per-TFM versions: the 10.x packages do not support net8.0/net9.0 consumers.
<!-- Per-TFM versions: match these packages to the consumer's runtime. Some 10.x packages do not support
net8.0/net9.0 consumers at all, and the rest would lift Microsoft.Extensions.* to 10.x on net8.0/net9.0.
Any project (single- or multi-targeted) that builds for net8.0/net9.0 resolves the matching 8.x/9.x version. -->
<PropertyGroup>
<MvcTestingVersion>10.0.12</MvcTestingVersion>
<LoggingVersion>10.0.12</LoggingVersion>
<LoggingAbstractionsVersion>10.0.12</LoggingAbstractionsVersion>
<HttpVersion>10.0.12</HttpVersion>
</PropertyGroup>
<PropertyGroup Condition="'$(TargetFramework)' == 'net8.0'">
<MvcTestingVersion>8.0.31</MvcTestingVersion>
<LoggingVersion>8.0.1</LoggingVersion>
<LoggingAbstractionsVersion>8.0.3</LoggingAbstractionsVersion>
<HttpVersion>8.0.1</HttpVersion>
</PropertyGroup>
<PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
<MvcTestingVersion>9.0.20</MvcTestingVersion>
<LoggingVersion>9.0.20</LoggingVersion>
<LoggingAbstractionsVersion>9.0.20</LoggingAbstractionsVersion>
<HttpVersion>9.0.20</HttpVersion>
</PropertyGroup>
<ItemGroup>
<PackageVersion Include="Grpc.Core.Api" Version="2.84.0" />
Expand Down Expand Up @@ -60,7 +64,7 @@
<PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="18.7.23" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="$(HttpVersion)" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="$(LoggingVersion)" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LoggingAbstractionsVersion)" />
<PackageVersion Include="Microsoft.Kiota.Abstractions" Version="2.1.2" />
Expand Down
4 changes: 4 additions & 0 deletions src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,10 @@

<ItemGroup>
<PackageReference Include="Aspire.Hosting.Testing" />
<!-- Aspire.Hosting and StreamJsonRpc pull MessagePack 2.5.302 (GHSA-qhrr-8q5h-9q3h). Raise the floor
to the patched 2.x release; 3.x (the central version) is not API-compatible with them.
Remove once Aspire depends on a patched MessagePack. -->
<PackageReference Include="MessagePack" VersionOverride="2.5.303" />
</ItemGroup>

<Import Project="..\..\eng\Library.targets" />
Expand Down
2 changes: 2 additions & 0 deletions tests/TUnit.Aspire.Tests.AppHost/TUnit.Aspire.Tests.AppHost.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@

<ItemGroup>
<PackageReference Include="Aspire.Hosting.AppHost" />
<!-- Patched MessagePack (GHSA-qhrr-8q5h-9q3h); see src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj. -->
<PackageReference Include="MessagePack" VersionOverride="2.5.303" />

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin MessagePack in the shipped Aspire starter AppHost

When a user instantiates the shipped TUnit.Aspire.Starter, the generated AppHost restores independently and directly pins Aspire.Hosting.AppHost 13.6.1 in src/TUnit.Templates/content/TUnit.Aspire.Starter/ExampleNamespace.AppHost/ExampleNamespace.AppHost.csproj:15, the same version called out here as pulling vulnerable MessagePack 2.5.302. This override exists only in the repository's test AppHost, while TUnit.Aspire.Core is referenced by the separate test project, so it cannot affect the generated AppHost's restore and new starter projects still resolve the vulnerable package; add the 2.5.303 floor to the template and update its snapshot too.

Useful? React with 👍 / 👎.

</ItemGroup>

<ItemGroup>
Expand Down
Loading