Repository navigation
.NET: chore: upgrades messagepack to a safe version to unblock CI - #9455
Conversation
Signed-off-by: Vincent Biret <[email protected]>
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
github-actions
Bot
changed the title
There was a problem hiding this comment.
🟢 Approval recommended
The narrowly scoped patch upgrade has no identified blocking issues.
0 open findings
What changed in this PR
Updates the centrally pinned .NET MessagePack dependency to address the vulnerability blocking CI.
Changes:
- Upgrades MessagePack from
3.1.7to3.1.12without changing application code.
| File | Description |
|---|---|
| dotnet/Directory.Packages.props | Updates the MessagePack version pin. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): bf78ac64c969
Model: gpt-5.6-sol
Overview
This PR updates the centrally managed MessagePack transitive pin used by Aspire dependency graphs from 3.1.7 to 3.1.12 without changing application APIs or serialization code. Central transitive pinning, representative Aspire consumers and tests in the main solution, warnings-as-errors builds, and transitive NuGet auditing provide concrete guardrails. No publishable regression was established.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
currently CI is failing because of the vulnerable version https://github.com/microsoft/agent-framework/actions/runs/38804473858/job/116936632775?pr=9432