Skip to content

Update MessagePack-CSharp to v3 - autoclosed - #1576

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-messagepack-csharp
Closed

Update MessagePack-CSharp to v3 - autoclosed#1576
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-messagepack-csharp

Conversation

@renovate

@renovate renovate Bot commented Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
MessagePack 2.5.307 → 3.1.12 age confidence
MessagePackAnalyzer 2.5.307 → 3.1.12 age confidence

Release Notes

MessagePack-CSharp/MessagePack-CSharp (MessagePack)

v3.1.12

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.11...v3.1.12

v3.1.11

Security fix

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.10...v3.1.11

v3.1.10

Security fix
Other fixes
New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.9...v3.1.10

v3.1.9

What's Changed
Security fix
Other fixes

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.8...v3.1.9

v3.1.8

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.7...v3.1.8

v3.1.7

What's Changed

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes
Moderage severity advisory fixes
Fixes with no security advisory
  • fb0fe9f Honor TypeFormatter options hooks for CWE-470
  • c1c06a6 Fix WriteRawX methods to advance by written length
  • 46c6a0f Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

v3.1.6

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

v3.1.5

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

v3.1.4

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

v3.1.3

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

v3.1.2

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

v3.1.1

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

v3.1.0

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

v3.0.300

Fixed version, release notes see v3.0.3.

v3.0.3

See our migration guide.
Details blog article

What's new

  • AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.
  • AOT source generation is hugely improved.
    • Support most or all of the data types that DynamicObjectResolver supported.
    • Support for serializing private members.
  • [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate.
  • Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.
  • Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute].
  • New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.
Unity
  • Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 16, 2026
Copilot AI balanced review requested due to automatic review settings October 16, 2026 05:57
@azure-pipelines

azure-pipelines Bot commented Oct 16, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI reviewed Oct 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Existing manually registered formatters need exclusions from v3’s automatic discovery to avoid compilation diagnostics.

1 open finding
What changed in this PR

Updates StreamJsonRpc’s MessagePack-CSharp dependencies to v3, including upstream security fixes.

Changes:

  • Raises the shared MessagePack and MessagePackAnalyzer version from 2.5.305 to 3.1.11.
File Description
Directory.Packages.props Updates the central MessagePack version.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread Directory.Packages.props Outdated
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
<MicrosoftTestingPlatformVersion>2.5.1</MicrosoftTestingPlatformVersion>
<MessagePackVersion>2.5.305</MessagePackVersion>
<MessagePackVersion>3.1.11</MessagePackVersion>

Copilot AI commented Oct 16, 2026

Copy link
Copy Markdown

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Authenticate to Azure with GitHub OIDC

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

This was referenced Oct 16, 2026
Open
Merged
Mitch Denny (mitchdenny) added a commit to microsoft/aspire that referenced this pull request Oct 16, 2026
@mitchdenny
Pin MessagePack to 2.5.307 for security fixes (#21051)
104378d 
## Description

NuGet reports NU1902 for MessagePack 2.5.302, pulled in by StreamJsonRpc
2.25.29, and fails restores/builds that treat warnings as errors.
Temporarily pin MessagePack to **2.5.307** to pick up the patched 2.x
releases without independently forcing StreamJsonRpc onto MessagePack
3.x.

- Add the central MessagePack version using the existing
transitive-pinning mechanism. StreamJsonRpc remains **2.25.29**.
- Add an explicit `MessagePack` reference in `Aspire.Hosting` so
out-of-tree `ProjectReference` consumers also receive the patched
minimum. A central transitive pin alone still allowed the generated
AppHost in `MSBuildTests` to restore 2.5.302.
- Both MessagePack and MessagePack.Annotations resolve to **2.5.307**
for Hosting, CLI, and an out-of-tree AppHost project-reference consumer.
The packed Hosting nuspec requires MessagePack **2.5.307**.
- The package is already available on the approved `dotnet-public` feed;
no feed, audit, warning, or test assertion changes are included.

Related to #21050. **This interim mitigation does not resolve the
issue.** When StreamJsonRpc releases with MessagePack 3.x, upgrade
StreamJsonRpc and remove both the central version entry and the
security-only Hosting reference.

Prior Aspire changes:
[#18155](#18155), its release
backport [#18204](#18204), and
the previous temporary pin
[#20071](#20071). Upstream:
[microsoft/vs-streamjsonrpc#1560](microsoft/vs-streamjsonrpc#1560)
merged MessagePack 2.5.305;
[microsoft/vs-streamjsonrpc#1571](microsoft/vs-streamjsonrpc#1571)
proposes 2.5.307;
[microsoft/vs-streamjsonrpc#1576](microsoft/vs-streamjsonrpc#1576)
tracks the 3.1.11 upgrade. The latest released StreamJsonRpc remains
2.25.29.

### Validation

Passed:

```bash
./restore.sh
dotnet restore src/Aspire.Hosting.AppHost/Aspire.Hosting.AppHost.csproj --force-evaluate -warnaserror -p:NuGetAudit=true
dotnet restore src/Aspire.Cli/Aspire.Cli.csproj --force-evaluate -warnaserror -p:NuGetAudit=true
MSBUILDTERMINALLOGGER=false dotnet test --project tests/Aspire.Cli.Tests/Aspire.Cli.Tests.csproj --no-launch-profile -p:SkipNativeBuild=true -- --filter-class '*.BackchannelJsonSerializerContextTests' --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true'
MSBUILDTERMINALLOGGER=false dotnet pack src/Aspire.Hosting/Aspire.Hosting.csproj --no-restore -p:SkipNativeBuild=true -o artifacts/packages/messagepack-pin-validation
```

Repository restore: 0 warnings/errors. CLI backchannel tests: **29
passed**. Hosting package created successfully; its nuspec has the
patched MessagePack minimum. A separate out-of-tree AppHost
project-reference consumer also passed restore with `-warnaserror
-p:NuGetAudit=true -p:NuGetAuditMode=all` against the unchanged
repository NuGet configuration, resolving MessagePack/Annotations
2.5.307 and StreamJsonRpc 2.25.29.

Failed / remaining validation blocker:

```bash
MSBUILDTERMINALLOGGER=false dotnet test --project tests/Aspire.Hosting.Tests/Aspire.Hosting.Tests.csproj --no-launch-profile -p:SkipNativeBuild=true -- --filter-method '*.CliBundleSetupFailureReportsAspire009WhenWarningsAreErrors' --filter-method '*.CliBundleSetupTimeoutReportsAspire009' --filter-not-trait 'quarantined=true' --filter-not-trait 'outerloop=true'
```

Both setup diagnostic tests still fail before their expected ASPIRE009
assertion. A diagnostic rerun of the warnings-as-errors case confirms
the MessagePack NU1902 failure is gone; its next blocker is existing
MSB3277 assembly conflicts, including Google.Protobuf 3.31.1 versus
3.36.1 and YamlDotNet. Those unrelated version conflicts are not changed
here. No full test suite was run.

### Security considerations

This selects the published MessagePack 2.x security fixes, including
[GHSA-qhrr-8q5h-9q3h](GHSA-qhrr-8q5h-9q3h)
and subsequent fixes in
[2.5.307](https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.307).
It does not alter RPC formatters, trust boundaries, or suppress NuGet
vulnerability auditing. No new threat model or security review was
performed for this dependency pin.

## Checklist

- Is this feature complete?
  - [x] Yes. Ready to ship.
  - [ ] No. Follow-up changes expected.
- Are you including unit tests for the changes and scenario tests if
relevant?
  - [ ] Yes
  - [x] No
- Did you add public API?
  - [ ] Yes
    - If yes, did you have an API Review for it?
      - [ ] Yes
      - [ ] No
- Did you add `<remarks />` and `<code />` elements on your triple slash
comments?
      - [ ] Yes
      - [ ] No
  - [x] No
- Does the change make any security assumptions or guarantees?
  - [x] Yes
    - If yes, have you done a threat model and had a security review?
      - [ ] Yes
      - [x] No
  - [ ] No

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 25f67c97-c7d9-43c6-be44-a406e0bf1b17
@renovate
renovate Bot force-pushed the renovate/major-messagepack-csharp branch from df842ad to a698e91 Compare October 16, 2026 20:11
Copilot AI balanced review requested due to automatic review settings October 19, 2026 20:55
@renovate
renovate Bot force-pushed the renovate/major-messagepack-csharp branch from a698e91 to 31bff60 Compare October 19, 2026 20:55
Copilot AI reviewed Oct 19, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

The major serializer upgrade needs formatter migration changes and build and compatibility validation before human approval.

2 open issues

Review effort: Balanced

Comment thread Directory.Packages.props
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
<MicrosoftTestingPlatformVersion>2.5.1</MicrosoftTestingPlatformVersion>
<MessagePackVersion>2.5.307</MessagePackVersion>
<MessagePackVersion>3.1.12</MessagePackVersion>

Copilot AI commented Oct 19, 2026

Copy link
Copy Markdown

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Authenticate to Azure with GitHub OIDC

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

@renovate renovate Bot changed the title Update MessagePack-CSharp to v3 Update MessagePack-CSharp to v3 - autoclosed Oct 20, 2026
@renovate renovate Bot closed this Oct 20, 2026
@renovate
renovate Bot deleted the renovate/major-messagepack-csharp branch October 20, 2026 15:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant