From 85907ffa33c36dec45d26c3d404191601257c6b3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 13:27:29 +0000
Subject: [PATCH 1/3] Fix MessagePack vulnerability (GHSA-hv8m-jj95-wg3x) in AI
 Chat Web template

Pin MessagePack to 2.5.301 to resolve NU1903 warning-as-error in the
AppHost project. The vulnerable 2.5.192 version was pulled transitively
through Aspire packages.
---
 eng/packages/ProjectTemplates.props                              | 1 +
 .../AIChatWeb-CSharp.AppHost/AIChatWeb-CSharp.AppHost.csproj-in  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/eng/packages/ProjectTemplates.props b/eng/packages/ProjectTemplates.props
index 988907822d6..affa5cd555b 100644
--- a/eng/packages/ProjectTemplates.props
+++ b/eng/packages/ProjectTemplates.props
@@ -18,6 +18,7 @@
     <PackageVersion Include="Azure.Search.Documents" Version="11.7.0" />
     <PackageVersion Include="CommunityToolkit.Aspire.Hosting.Ollama" Version="13.0.0-beta.444" />
     <PackageVersion Include="CommunityToolkit.Aspire.OllamaSharp" Version="13.0.0-beta.444" />
+    <PackageVersion Include="MessagePack" Version="2.5.301" />
     <PackageVersion Include="Microsoft.Agents.AI" Version="1.3.0" />
     <PackageVersion Include="Microsoft.Agents.AI.DevUI" Version="1.3.0-preview.260423.1" />
     <PackageVersion Include="Microsoft.Agents.AI.Hosting" Version="1.3.0-preview.260423.1" />
diff --git a/src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.AppHost/AIChatWeb-CSharp.AppHost.csproj-in b/src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.AppHost/AIChatWeb-CSharp.AppHost.csproj-in
index efaf93c8114..ca38328d28e 100644
--- a/src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.AppHost/AIChatWeb-CSharp.AppHost.csproj-in
+++ b/src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.AppHost/AIChatWeb-CSharp.AppHost.csproj-in
@@ -12,6 +12,7 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.AppHost" Version="${PackageVersion:Aspire.Hosting.AppHost}" />
+    <PackageReference Include="MessagePack" Version="${PackageVersion:MessagePack}" />
 <!--#if (IsQdrant)
     <PackageReference Include="Aspire.Hosting.Qdrant" Version="${PackageVersion:Aspire.Hosting.Qdrant}" />
 #elif (IsAzureAISearch)

From 8189c3fcad33d947d81cd462cf703bb23a994ab1 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 18:06:43 +0000
Subject: [PATCH 2/3] Update AppHost snapshot files to include MessagePack
 PackageReference

---
 .../aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj         | 1 +
 .../aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj         | 1 +
 .../aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj         | 1 +
 3 files changed, 3 insertions(+)

diff --git a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
index c9340b988a1..4378bd51b44 100644
--- a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
+++ b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
@@ -12,6 +12,7 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.AppHost" Version="{VERSION}" />
+    <PackageReference Include="MessagePack" Version="{VERSION}" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
index a7fda7e47f6..7343bbc7cd5 100644
--- a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
+++ b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
@@ -14,6 +14,7 @@
     <PackageReference Include="Aspire.Hosting.AppHost" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Azure.Search" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Azure.CognitiveServices" Version="{VERSION}" />
+    <PackageReference Include="MessagePack" Version="{VERSION}" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
index d65dd7ef340..341fe042044 100644
--- a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
+++ b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
@@ -14,6 +14,7 @@
     <PackageReference Include="Aspire.Hosting.AppHost" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Qdrant" Version="{VERSION}" />
     <PackageReference Include="CommunityToolkit.Aspire.Hosting.Ollama" Version="{VERSION}" />
+    <PackageReference Include="MessagePack" Version="{VERSION}" />
   </ItemGroup>
 
   <ItemGroup>

From 039d4b7dd685f1b7eff62dc1e4205136d4f77824 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 19:32:30 +0000
Subject: [PATCH 3/3] Fix MessagePack position in snapshot files to match
 template output order

---
 .../aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj        | 2 +-
 .../aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
index 7343bbc7cd5..8d775d8fb10 100644
--- a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
+++ b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A_aoai_aais.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
@@ -12,9 +12,9 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.AppHost" Version="{VERSION}" />
+    <PackageReference Include="MessagePack" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Azure.Search" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Azure.CognitiveServices" Version="{VERSION}" />
-    <PackageReference Include="MessagePack" Version="{VERSION}" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
index 341fe042044..4cfed977723 100644
--- a/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
+++ b/test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.o_q.verified/aichatweb/aichatweb.AppHost/aichatweb.AppHost.csproj
@@ -12,9 +12,9 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.AppHost" Version="{VERSION}" />
+    <PackageReference Include="MessagePack" Version="{VERSION}" />
     <PackageReference Include="Aspire.Hosting.Qdrant" Version="{VERSION}" />
     <PackageReference Include="CommunityToolkit.Aspire.Hosting.Ollama" Version="{VERSION}" />
-    <PackageReference Include="MessagePack" Version="{VERSION}" />
   </ItemGroup>
 
   <ItemGroup>