Upgrade StreamJsonRpc to MessagePack 3.x and remove temporary MessagePack pin #21050

Is there an existing issue for this?

• I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

Aspire currently uses StreamJsonRpc 2.25.29, which brings in MessagePack 2.5.302 transitively for hosting and CLI consumers. NuGet now reports NU1902 for GHSA-qhrr-8q5h-9q3h, causing builds that treat warnings as errors to fail during restore. The advisory lists 2.5.303 and 3.1.9 as patched versions for the respective release lines.

The immediate mitigation is a separate PR centrally pinning MessagePack to 2.5.307, retaining StreamJsonRpc 2.25.29 and picking up subsequent 2.x security fixes as well. That interim PR is related to this issue; it does not resolve it. We ultimately want StreamJsonRpc to own its MessagePack dependency again instead of retaining a central override indefinitely.

Describe the solution you'd like

Wait for a released StreamJsonRpc version that adopts MessagePack 3.x, upgrade Aspire to that release, and remove the temporary central MessagePack pin together.

Acceptance criteria:

• A released StreamJsonRpc version depends on MessagePack 3.x; track microsoft/vs-streamjsonrpc#1576, currently proposing MessagePack and its analyzer 3.1.11.
• Upgrade Aspire's StreamJsonRpc dependency to that release.
• Remove the temporary MessagePack entry from Directory.Packages.props and the explicit security-only MessagePack reference in src/Aspire.Hosting/Aspire.Hosting.csproj, and confirm hosting and CLI consumers resolve the supported upstream dependency without NuGet vulnerability warnings.
• Verify relevant hosting/setup and RPC behavior after the dependency upgrade.

Do not independently force MessagePack 3.x while StreamJsonRpc still depends on 2.x. The interim 2.5.307 pin only unblocks NuGet/build failures and must not close this issue.

Additional context

Version and PR history:

• Aspire #18155 upgraded StreamJsonRpc to 2.25.29 to obtain MessagePack 2.5.302; #18204 was its release backport.
• Aspire #20071 previously added a temporary MessagePack 2.5.302 pin while retaining the CLI's NativeAOT StreamJsonRpc preview. Current main no longer has that pin.
• microsoft/vs-streamjsonrpc#1560 merged the MessagePack 2.5.305 update into upstream main, but the latest released StreamJsonRpc is still 2.25.29.
• microsoft/vs-streamjsonrpc#1571 proposes MessagePack 2.5.305 → 2.5.307, including the LZ4 integer-overflow fix for GHSA-7rj2-5w9w-r9jx.
• microsoft/vs-streamjsonrpc#1576 proposes MessagePack and analyzer 2.5.305 → 3.1.11 and is the long-term upstream upgrade to follow.
• MessagePack 2.5.307 release.

The current restore failure can mask the expected ASPIRE009 diagnostic in MSBuildTests.CliBundleSetupFailureReportsAspire009WhenWarningsAreErrors. Keep warnings-as-errors and vulnerability auditing enabled; address the dependency rather than suppressing the warning.