Bump StreamJsonRpc to 2.25.29 to clear MessagePack NU1903 by mitchdenny · Pull Request #18155 · microsoft/aspire

Mitch Denny (mitchdenny) · 2026-06-12T11:37:18Z

Bumps StreamJsonRpc to 2.25.29 to pick up MessagePack 2.5.302 transitively, clearing the NU1903 warning for GHSA-hv8m-jj95-wg3x / CVE-2026-48109 in consumer AppHost projects generated by dotnet new aspire-starter. No direct exposure for us, but the bump avoids the warning for end users.

Fixes #18153

The aspire-starter template was emitting NU1903 for transitive MessagePack 2.5.192 (GHSA-hv8m-jj95-wg3x / CVE-2026-48109) because the shared StreamJsonRpc 2.22.23 dependency pulled it in. Updating StreamJsonRpc to 2.25.25 brings MessagePack 2.5.198, outside the advisory's vulnerable range. The advisory affects only MessagePack's LZ4 decompression path. We do not use MessagePackFormatter anywhere - all StreamJsonRpc sites use SystemTextJsonFormatter - and our JSON-RPC transports are local UDS under the user's home directory, so the underlying vulnerability was not reachable. This change is warning hygiene. Fixes #18153 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-12T11:37:34Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18155

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18155"

Copilot

Pull request overview

This PR bumps the centrally-managed StreamJsonRpc package version from 2.22.23 to 2.25.25 to resolve the NU1903 vulnerability warning (GHSA-hv8m-jj95-wg3x / CVE-2026-48109) that was emitted when creating new Aspire projects via dotnet new aspire-starter. The transitive MessagePack 2.5.192 dependency (pulled via the old StreamJsonRpc) falls within the advisory's vulnerable range; the updated StreamJsonRpc brings MessagePack 2.5.198 which is outside that range.

Changes:

Bump StreamJsonRpc from 2.22.23 to 2.25.25 in Directory.Packages.props (central package management)

Show a summary per file

File	Description
Directory.Packages.props	Bumps the centrally-pinned `StreamJsonRpc` version to clear the NU1903 transitive vulnerability warning on `MessagePack`

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 0

github-actions · 2026-06-12T12:01:54Z

Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
GitHub was asked to rerun all failed jobs for that attempt, and the rerun is being tracked in the rerun attempt.
The job links below point to the failed attempt jobs that matched the retry-safe transient failure rules.

Tests / Cli.EndToEnd-KubernetesDeployWithValkeyTests / Cli.EndToEnd-KubernetesDeployWithValkeyTests (ubuntu-latest) - Failed step 'Set up .NET Core' matched the transient annotation allowlist.

StreamJsonRpc 2.25.25 still declares a transitive dep on MessagePack 2.5.198, which is inside the advisory's vulnerable range (< 2.5.302). Add a direct PackageReference on MessagePack to Aspire.Hosting so consumers (including generated AppHosts from 'aspire new aspire-starter') restore the patched version, and NU1903 is no longer emitted. This can be removed once StreamJsonRpc ships a release that depends on MessagePack >= 2.5.302. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mitch Denny (mitchdenny) · 2026-06-12T12:21:45Z

PR Testing Report

PR Information

PR Number: Bump StreamJsonRpc to 2.25.29 to clear MessagePack NU1903 #18155
Title: Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903
Tested commits:
- 020f29c9 — original (StreamJsonRpc bump only) → fix incomplete
- 4f03129d — follow-up (added direct MessagePack 2.5.302 pin in Aspire.Hosting) → fix complete
Tested At: 2026-06-12 +1000

Changes Analyzed

Files Changed

Directory.Packages.props — StreamJsonRpc 2.22.23 → 2.25.25, added MessagePack 2.5.302
src/Aspire.Hosting/Aspire.Hosting.csproj — added direct <PackageReference Include="MessagePack" />

Change Categories

CLI changes
Hosting integration changes
Dashboard changes
Template changes
Client/Component changes
VS Code extension changes
Test changes
Build/infra: central NuGet version bump + direct pin to fully eliminate the vulnerable transitive MessagePack

Test Scenarios Executed

Scenario 1: PR CLI version matches head SHA

Status: ✅ Passed

Installed PR CLI via the dogfood get-aspire-cli-pr.sh 18155 script (commit 020f29c9).
aspire --version → 13.5.0-pr.18155.g020f29c9 (contains expected SHA).

Scenario 2: `aspire new aspire-starter` AppHost restore no longer emits NU1903 for MessagePack

Run 2a — original commit `020f29c9` (StreamJsonRpc bump only)

Status: ❌ Failed — warning still emitted

PrSmoke.AppHost.csproj : warning NU1903: Package 'MessagePack' 2.5.198 has a known high
  severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x

Root cause: StreamJsonRpc 2.25.25 still declares a transitive dep on MessagePack 2.5.198, which is inside the advisory's range (< 2.5.302). Bumping StreamJsonRpc alone moved MessagePack from 2.5.192 → 2.5.198 — both vulnerable. The reporter explicitly called this out: "After update the MessagePack version to 2.5.302 will fix this issue."

Run 2b — follow-up commit `4f03129d` (direct MessagePack pin)

Status: ✅ Passed

Locally packed Aspire.Hosting and Aspire.Hosting.AppHost from 4f03129d and substituted them into the PR hive (same version string), then re-ran the starter scenario with cleared NuGet caches.
Restore output: zero NU1903 occurrences.

$ grep -c NU1903 restore.log
0

Scenario 3: Resolved package versions in generated AppHost

Commit	`MessagePack`	`StreamJsonRpc`	Vulnerable?
pre-PR baseline	`2.5.192`	`2.22.23`	yes
`020f29c9` (StreamJsonRpc bump only)	`2.5.198`	`2.25.25`	still yes
`4f03129d` (with MessagePack pin)	`2.5.302`	`2.25.25`	no ✅

Versions read directly from obj/project.assets.json of the generated PrSmoke.AppHost.

Summary

Scenario	Status
1. CLI version matches head SHA	✅ Passed
2a. NU1903 gone after `020f29c9` (StreamJsonRpc bump only)	❌ Failed
2b. NU1903 gone after `4f03129d` (direct `MessagePack 2.5.302` pin)	✅ Passed
3. Resolved package versions	✅ Passed (with follow-up commit)

Overall Result

✅ PR VERIFIED at 4f03129d — the follow-up commit pinning MessagePack 2.5.302 directly in Aspire.Hosting correctly eliminates NU1903 from dotnet new aspire-starter AppHost restore. The original 020f29c9 commit alone was insufficient because StreamJsonRpc 2.25.25 still declares a vulnerable MessagePack 2.5.198 transitively. This PR now contains both changes.

Notes

This pin can be removed once StreamJsonRpc ships a release that depends on MessagePack >= 2.5.302.
Exposure assessment (separate from the warning): Aspire never instantiates MessagePack; every JsonRpc site uses SystemTextJsonFormatter. All StreamJsonRpc transports are local UDS in the user's home dir. The advisory's LZ4 decompression bug is not reachable in Aspire's runtime.

Copilot

Copilot's findings

Files reviewed: 2/2 changed files
Comments generated: 0 new

StreamJsonRpc 2.25.25 ships analyzers built against Roslyn 4.14, which breaks template tests that build generated AppHosts with the .NET 8 SDK (CSC error CS9057). The MessagePack 2.5.302 direct pin in Aspire.Hosting already overrides StreamJsonRpc 2.22.23's transitive MessagePack 2.5.192 in consumer projects, so the GHSA-hv8m-jj95-wg3x warning is silenced without needing the StreamJsonRpc bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mitch Denny (mitchdenny) · 2026-06-12T13:01:06Z

Tracking upstream fix at microsoft/vs-streamjsonrpc#1458. Once that ships in a StreamJsonRpc release, we can drop the MessagePack pin added here and just bump StreamJsonRpc.

StreamJsonRpc 2.25.28 brings MessagePack 2.5.302 transitively, which is above the GHSA-hv8m-jj95-wg3x / CVE-2026-48109 vulnerable range. This lets us drop the direct MessagePack PackageReference (and PackageVersion) we added earlier as a workaround. StreamJsonRpc 2.25.x ships an analyzer built against Roslyn 4.14, which is newer than the Roslyn 4.11 in the .NET 8 SDK used by template tests to build generated AppHost projects (would trigger CSC error CS9057). We don't use the StreamJsonRpc analyzers anywhere in this assembly, so ExcludeAssets="analyzers" skips them. NuGet bakes the exclusion into the Aspire.Hosting nuspec so downstream consumers (AppHost projects) also skip the analyzer transitively. See microsoft/vs-streamjsonrpc#1459 for the upstream MessagePack bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Copilot's findings

Files reviewed: 2/2 changed files
Comments generated: 1

ExcludeAssets in Aspire.Hosting alone is not enough: the .NET 8 SDK discovers analyzer DLLs in the NuGet cache by convention regardless of the project.assets.json exclude flags, and StreamJsonRpc.Analyzers.dll (Roslyn 4.14) fails to load under SDK 8's Roslyn 4.11 with CS9057. Add a target in Aspire.Hosting.AppHost.targets that runs before CoreCompile and removes any Analyzer item whose path contains 'StreamJsonRpc.Analyzers'. Aspire doesn't depend on any of the StreamJsonRpc analyzer diagnostics, so dropping them is safe. Verified locally: building a net8.0 AppHost with the .NET 8 SDK (Roslyn 4.11) no longer hits CS9057. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-14T08:25:03Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-06-14T08:35:34Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

The Aspire.Hosting.AppHost targets file only reaches direct AppHost consumers — but Aspire.Hosting.Testing also pulls StreamJsonRpc in transitively, and the test project (.aspire_xunitTests.csproj) hit the same CS9057 under .NET 8 SDK. Move the analyzer-strip target into Aspire.Hosting's buildTransitive/Aspire.Hosting.targets so every consumer of Aspire.Hosting (AppHost projects, test projects, etc.) automatically drops the StreamJsonRpc analyzer. Verified locally: a net8.0 test project that references Aspire.Hosting.Testing builds cleanly under the .NET 8 SDK. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Mitch Denny (mitchdenny) · 2026-06-15T02:55:29Z

/backport to release/13.4

github-actions · 2026-06-15T02:55:41Z

Started backporting to release/13.4 (link to workflow run)

github-actions · 2026-06-15T03:23:47Z

❓ CLI E2E Tests unknown — 115 passed, 0 failed, 2 unknown (commit a5dfa00)

View all recordings

-	Test	Detail
✅	AddPackageInteractiveWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AddPackageWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AgentCommands_AllHelpOutputs_AreCorrect	Recording · Job · CLI logs
✅	AgentInitCommand_DefaultSelection_InstallsDefaultSkills	Recording · Job · CLI logs
✅	AgentInitCommand_MigratesDeprecatedConfig	Recording · Job · CLI logs
✅	AgentInit_NonInteractive_BundleOnlySkillsNotInCatalog	Recording · Job · CLI logs
✅	AgentMcpListResources_ExcludesResourceMarkedWithExcludeFromMcp	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_DevLocalhost	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_Isolated	Recording · Job · CLI logs
✅	AllPublishMethodsBuildDockerImages	Recording · Job · CLI logs
✅	AspireAddAndStartWorkAgainstLegacyAppHostTs	Recording · Job · CLI logs
✅	AspireAddPackageVersionToDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireInitSingleFileAppHostRunsViaDotnetRunAppHost	Recording · Job · CLI logs
✅	AspireInit_ExistingAppHostDir_RecreatesNuGetConfigKeepsFiles	Recording · Job · CLI logs
❔	AspireInit_SolutionFile_BuildsAgainstChannelHive	Recording · Job · CLI logs
✅	AspireStartUpdatesStaleTypeScriptAppHostPath	Recording · Job · CLI logs
✅	AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireUpdateRemovesOrphanAppHostPackageVersionWhenSdkAlreadyCurrent	Recording · Job · CLI logs
✅	Banner_DisplayedOnFirstRun	Recording · Job · CLI logs
✅	Banner_DisplayedWithExplicitFlag	Recording · Job · CLI logs
✅	Banner_NotDisplayedWithNoLogoFlag	Recording · Job · CLI logs
✅	CertificatesClean_RemovesCertificates	Recording · Job · CLI logs
✅	CertificatesTrust_WithNoCert_CreatesAndTrustsCertificate	Recording · Job · CLI logs
✅	CertificatesTrust_WithUntrustedCert_TrustsCertificate	Recording · Job · CLI logs
✅	ConfigSetGet_CreatesNestedJsonFormat	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProject	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProjectWithBundle	Recording · Job · CLI logs
✅	CreateAndRunEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJavaEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJsReactProject	Recording · Job · CLI logs
✅	CreateAndRunPolyglotAppHostWithDevLocalhostUrls	Recording · Job · CLI logs
✅	CreateAndRunPythonReactProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptStarterProject	Recording · Job · CLI logs
✅	CreateJavaAppHostWithViteApp	Recording · Job · CLI logs
✅	CreateTypeScriptAppHostWithViteApp_UsesConfiguredToolchain	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DeployK8sBasicApiService	Recording · Job · CLI logs
✅	DeployK8sWithExternalHelmChart	Recording · Job · CLI logs
✅	DeployK8sWithGarnet	Recording · Job · CLI logs
✅	DeployK8sWithMongoDB	Recording · Job · CLI logs
✅	DeployK8sWithMySql	Recording · Job · CLI logs
✅	DeployK8sWithPostgres	Recording · Job · CLI logs
✅	DeployK8sWithRabbitMQ	Recording · Job · CLI logs
✅	DeployK8sWithRedis	Recording · Job · CLI logs
✅	DeployK8sWithSqlServer	Recording · Job · CLI logs
✅	DeployK8sWithValkey	Recording · Job · CLI logs
✅	DeployTypeScriptAppToKubernetes	Recording · Job · CLI logs
✅	DescribeCommandResolvesReplicaNames	Recording · Job · CLI logs
✅	DescribeCommandShowsRunningResources	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJson	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJsonWhenRestartingExistingInstance	Recording · Job · CLI logs
✅	DoPublishAndDeployListStepsWork	Recording · Job · CLI logs
✅	DocsCommand_RendersInteractiveMarkdownFromLocalSource	Recording · Job · CLI logs
✅	DoctorCommand_DetectsDeprecatedAgentConfig	Recording · Job · CLI logs
✅	DoctorCommand_TypeScriptAppHostReportsMissingConfiguredToolchain	Recording · Job · CLI logs
✅	DoctorCommand_WithSslCertDir_ShowsTrusted	Recording · Job · CLI logs
✅	DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	Recording · Job · CLI logs
✅	DotNetRunFileBasedAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	DotNetRunProjectAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	GatewayWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	GeneratedAspireDevScript_StartsWatchMode_WithConfiguredToolchain	Recording · Job · CLI logs
✅	GlobalMigration_HandlesCommentsAndTrailingCommas	Recording · Job · CLI logs
✅	GlobalMigration_HandlesMalformedLegacyJson	Recording · Job · CLI logs
✅	GlobalMigration_PreservesAllValueTypes	Recording · Job · CLI logs
✅	GlobalMigration_SkipsWhenNewConfigExists	Recording · Job · CLI logs
✅	GlobalSettings_MigratedFromLegacyFormat	Recording · Job · CLI logs
✅	IngressWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	InitTypeScriptAppHost_AugmentsExistingViteRepoInWorkspaceSubdirectory	Recording · Job · CLI logs
✅	InteractiveCSharpInitCreatesExpectedFiles	Recording · Job · CLI logs
✅	InvalidAppHostPathWithComments_IsHealedOnRun	Recording · Job · CLI logs
✅	JavaScriptHostingApisRunFromTypeScriptAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelTypeScriptAppHost	Recording · Job · CLI logs
✅	LegacySettingsMigration_AdjustsRelativeAppHostPath	Recording · Job · CLI logs
✅	LogsCommandShowsResourceLogs	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterApp	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterAppIsolated	Recording · Job · CLI logs
✅	ProcessCommandCallbackReceivesCliArguments	Recording · Job · CLI logs
✅	PsCommandListsRunningAppHost	Recording · Job · CLI logs
✅	PsFormatJsonOutputsOnlyJsonToStdout	Recording · Job · CLI logs
✅	PublishJavaScriptPatternsGeneratesExpectedDockerComposeArtifacts	Recording · Job · CLI logs
✅	PublishWithConfigureEnvFileUpdatesEnvOutput	Recording · Job · CLI logs
✅	PublishWithDockerComposeServiceCallbackSucceeds	Recording · Job · CLI logs
✅	PublishWithoutOutputPathUsesAppHostDirectoryDefault	Recording · Job · CLI logs
✅	ResourceCommand_FailedExec_ShowsLogPathAndLogHasEntries	Recording · Job · CLI logs
✅	ResourceCommand_SetAndDeleteParameterUpdatesDescribeOutput	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles_WithConfiguredToolchain	Recording · Job · CLI logs
✅	RestoreRefreshesGeneratedSdkAfterAddingIntegration	Recording · Job · CLI logs
✅	RestoreSupportsConfigOnlyHelperPackageAndCrossPackageTypes	Recording · Job · CLI logs
✅	RunFromParentDirectory_UsesExistingConfigNearAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	SecretCrudOnDotNetAppHost	Recording · Job · CLI logs
✅	SecretCrudOnTypeScriptAppHost	Recording · Job · CLI logs
✅	StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	Recording · Job · CLI logs
✅	StartAndWaitForTypeScriptSqlServerAppHostWithNativeAssets	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	StopAllAppHostsFromAppHostDirectory	Recording · Job · CLI logs
✅	StopJavaPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopNonInteractiveSingleAppHost	Recording · Job · CLI logs
✅	StopTypeScriptPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopWithNoRunningAppHostExitsSuccessfully	Recording · Job · CLI logs
✅	TerminalAttachFrontend_ShowsViteHelpAndDetaches	Recording · Job · CLI logs
✅	TypeScriptAppHostRunDoesNotDeadlockWhenLazyOptionsInvokeAsyncCallback	Recording · Job · CLI logs
✅	TypeScriptAppHostWithVite_AllowsDifferentGuestPkgManager	Recording · Job · CLI logs
✅	UnAwaitedChainsCompileWithAutoResolvePromises	Recording · Job · CLI logs
❔	UpdateToStable_CSharpEmptyAppHost_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_CSharpSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScriptSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScript_PreviewsStablePkgsAndKeepsChannel	Recording · Job · CLI logs

_{📹 Recordings uploaded automatically from CI run #27521146371}

Adam Sitnik (adamsitnik)

LGTM, as soon as this is shipped to nuget.org we are going to update the Microsoft.Extensions.AI.Templates project

StreamJsonRpc 2.25.29 ships analyzers compiled against an older Roslyn that is compatible with the .NET 8 SDK (vs-streamjsonrpc#1463 / #1399), so the buildTransitive analyzer-strip target and the ExcludeAssets flag on the PackageReference are no longer needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-06-16T01:39:17Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

Copilot

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 1

github-actions · 2026-06-16T01:44:26Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

github-actions · 2026-06-16T01:48:36Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

This reverts commit b179c30.

github-actions · 2026-06-16T02:59:22Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

This reverts commit 1f175af.

Copilot

Copilot's findings

Files reviewed: 1/1 changed files
Comments generated: 0 new

github-actions · 2026-06-16T07:00:05Z

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

StreamJsonRpc 2.25.29 ships analyzers compiled against an older Roslyn that is compatible with the .NET 8 SDK (vs-streamjsonrpc#1463 / #1399), so the buildTransitive analyzer-strip target and the ExcludeAssets flag on the PackageReference are no longer needed. Mirrors the final state of #18155 on main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…903 (#18204) * Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903 The aspire-starter template was emitting NU1903 for transitive MessagePack 2.5.192 (GHSA-hv8m-jj95-wg3x / CVE-2026-48109) because the shared StreamJsonRpc 2.22.23 dependency pulled it in. Updating StreamJsonRpc to 2.25.25 brings MessagePack 2.5.198, outside the advisory's vulnerable range. The advisory affects only MessagePack's LZ4 decompression path. We do not use MessagePackFormatter anywhere - all StreamJsonRpc sites use SystemTextJsonFormatter - and our JSON-RPC transports are local UDS under the user's home directory, so the underlying vulnerability was not reachable. This change is warning hygiene. Fixes #18153 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Pin MessagePack to 2.5.302 to fully clear GHSA-hv8m-jj95-wg3x StreamJsonRpc 2.25.25 still declares a transitive dep on MessagePack 2.5.198, which is inside the advisory's vulnerable range (< 2.5.302). Add a direct PackageReference on MessagePack to Aspire.Hosting so consumers (including generated AppHosts from 'aspire new aspire-starter') restore the patched version, and NU1903 is no longer emitted. This can be removed once StreamJsonRpc ships a release that depends on MessagePack >= 2.5.302. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Revert StreamJsonRpc bump; keep MessagePack 2.5.302 pin StreamJsonRpc 2.25.25 ships analyzers built against Roslyn 4.14, which breaks template tests that build generated AppHosts with the .NET 8 SDK (CSC error CS9057). The MessagePack 2.5.302 direct pin in Aspire.Hosting already overrides StreamJsonRpc 2.22.23's transitive MessagePack 2.5.192 in consumer projects, so the GHSA-hv8m-jj95-wg3x warning is silenced without needing the StreamJsonRpc bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump StreamJsonRpc to 2.25.28 and drop MessagePack pin StreamJsonRpc 2.25.28 brings MessagePack 2.5.302 transitively, which is above the GHSA-hv8m-jj95-wg3x / CVE-2026-48109 vulnerable range. This lets us drop the direct MessagePack PackageReference (and PackageVersion) we added earlier as a workaround. StreamJsonRpc 2.25.x ships an analyzer built against Roslyn 4.14, which is newer than the Roslyn 4.11 in the .NET 8 SDK used by template tests to build generated AppHost projects (would trigger CSC error CS9057). We don't use the StreamJsonRpc analyzers anywhere in this assembly, so ExcludeAssets="analyzers" skips them. NuGet bakes the exclusion into the Aspire.Hosting nuspec so downstream consumers (AppHost projects) also skip the analyzer transitively. See microsoft/vs-streamjsonrpc#1459 for the upstream MessagePack bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Strip StreamJsonRpc analyzer from consumer AppHost builds ExcludeAssets in Aspire.Hosting alone is not enough: the .NET 8 SDK discovers analyzer DLLs in the NuGet cache by convention regardless of the project.assets.json exclude flags, and StreamJsonRpc.Analyzers.dll (Roslyn 4.14) fails to load under SDK 8's Roslyn 4.11 with CS9057. Add a target in Aspire.Hosting.AppHost.targets that runs before CoreCompile and removes any Analyzer item whose path contains 'StreamJsonRpc.Analyzers'. Aspire doesn't depend on any of the StreamJsonRpc analyzer diagnostics, so dropping them is safe. Verified locally: building a net8.0 AppHost with the .NET 8 SDK (Roslyn 4.11) no longer hits CS9057. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Move StreamJsonRpc analyzer strip to Aspire.Hosting buildTransitive The Aspire.Hosting.AppHost targets file only reaches direct AppHost consumers — but Aspire.Hosting.Testing also pulls StreamJsonRpc in transitively, and the test project (.aspire_xunitTests.csproj) hit the same CS9057 under .NET 8 SDK. Move the analyzer-strip target into Aspire.Hosting's buildTransitive/Aspire.Hosting.targets so every consumer of Aspire.Hosting (AppHost projects, test projects, etc.) automatically drops the StreamJsonRpc analyzer. Verified locally: a net8.0 test project that references Aspire.Hosting.Testing builds cleanly under the .NET 8 SDK. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Simplify StreamJsonRpc analyzer-strip condition using %(Filename) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Bump StreamJsonRpc to 2.25.29; drop analyzer-strip workaround StreamJsonRpc 2.25.29 ships analyzers compiled against an older Roslyn that is compatible with the .NET 8 SDK (vs-streamjsonrpc#1463 / #1399), so the buildTransitive analyzer-strip target and the ExcludeAssets flag on the PackageReference are no longer needed. Mirrors the final state of #18155 on main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Mitch Denny <midenn@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 12, 2026 11:37

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 12, 2026 11:38

View session

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Mitch Denny (mitchdenny) marked this pull request as ready for review June 12, 2026 12:22

Mitch Denny (mitchdenny) requested a review from James Newton-King (JamesNK) as a code owner June 12, 2026 12:22

Copilot AI review requested due to automatic review settings June 12, 2026 12:22

Mitch Denny (mitchdenny) requested review from David Negstad (danegsta), David Fowler (davidfowl) and Karol Zadora-Przylecki (karolz-ms) as code owners June 12, 2026 12:22

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 12, 2026 12:23

View session

Copilot AI reviewed Jun 12, 2026

View reviewed changes

Mitch Denny (mitchdenny) mentioned this pull request Jun 12, 2026

Update MessagePack version to 2.5.302 microsoft/vs-streamjsonrpc#1458

Closed

Adam Sitnik (adamsitnik) mentioned this pull request Jun 12, 2026

Microsoft.Extensions.AI.Templates tests are failing dotnet/extensions#7562

Closed

Copilot AI review requested due to automatic review settings June 14, 2026 07:33

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 14, 2026 07:34

View session

Copilot AI reviewed Jun 14, 2026

View reviewed changes

Comment thread Directory.Packages.props Outdated

Copilot AI review requested due to automatic review settings June 14, 2026 08:37

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 14, 2026 08:37

View session

Mitch Denny (mitchdenny) changed the title ~~Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903~~ Bump StreamJsonRpc to 2.25.28 to clear MessagePack NU1903 Jun 15, 2026

aspire-repo-bot Bot mentioned this pull request Jun 15, 2026

[release/13.4] Bump StreamJsonRpc to 2.25.29 to clear MessagePack NU1903 #18204

Merged

Adam Sitnik (adamsitnik) approved these changes Jun 15, 2026

View reviewed changes

Benjamin Krämer (Falco20019) mentioned this pull request Jun 15, 2026

[AspireE2E] There is a warning Package 'MessagePack' 2.5.192 has a known high severity vulnerability when creating Aspire project #18153

Closed

Copilot AI review requested due to automatic review settings June 16, 2026 01:33

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 16, 2026 01:33

View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

Comment thread Directory.Packages.props

Revert "Bump StreamJsonRpc to 2.25.29; drop analyzer-strip workaround"

1f175af

This reverts commit b179c30.

Reapply "Bump StreamJsonRpc to 2.25.29; drop analyzer-strip workaround"

40efc86

This reverts commit 1f175af.

Copilot AI review requested due to automatic review settings June 16, 2026 06:31

Copilot started reviewing on behalf of Mitch Denny (mitchdenny) June 16, 2026 06:32

View session

Copilot AI reviewed Jun 16, 2026

View reviewed changes

Mitch Denny (mitchdenny) changed the title ~~Bump StreamJsonRpc to 2.25.28 to clear MessagePack NU1903~~ Bump StreamJsonRpc to 2.25.29 to clear MessagePack NU1903 Jun 16, 2026

James Newton-King (JamesNK) approved these changes Jun 16, 2026

View reviewed changes

Mitch Denny (mitchdenny) merged commit 92c1cb7 into main Jun 16, 2026
669 of 672 checks passed

Mitch Denny (mitchdenny) deleted the mitchdenny/fix-messagepack-vulnerability-warning branch June 16, 2026 09:25

github-actions Bot added this to the 13.5 milestone Jun 16, 2026

Jose Perez Rodriguez (joperezr) mentioned this pull request Jul 14, 2026

Merge release/13.4 back into main (reconciliation, no net changes) #18773

Merged

github-actions Bot locked and limited conversation to collaborators Jul 16, 2026

Conversation

Mitch Denny (mitchdenny) commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

github-actions Bot commented Jun 12, 2026

Uh oh!

Mitch Denny (mitchdenny) commented Jun 12, 2026

PR Testing Report

PR Information

Changes Analyzed

Files Changed

Change Categories

Test Scenarios Executed

Scenario 1: PR CLI version matches head SHA

Scenario 2: aspire new aspire-starter AppHost restore no longer emits NU1903 for MessagePack

Run 2a — original commit 020f29c9 (StreamJsonRpc bump only)

Run 2b — follow-up commit 4f03129d (direct MessagePack pin)

Scenario 3: Resolved package versions in generated AppHost

Summary

Overall Result

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Mitch Denny (mitchdenny) commented Jun 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

github-actions Bot commented Jun 14, 2026

Uh oh!

github-actions Bot commented Jun 14, 2026

Uh oh!

Mitch Denny (mitchdenny) commented Jun 15, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

Adam Sitnik (adamsitnik) left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot's findings

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Mitch Denny (mitchdenny) commented Jun 12, 2026 •

edited

Loading

github-actions Bot commented Jun 12, 2026 •

edited

Loading

Scenario 2: `aspire new aspire-starter` AppHost restore no longer emits NU1903 for MessagePack

Run 2a — original commit `020f29c9` (StreamJsonRpc bump only)

Run 2b — follow-up commit `4f03129d` (direct MessagePack pin)