microsoft/semantic-kernel
1
0
Fork 0
mirror of https://github.com/microsoft/semantic-kernel.git synced 2026-10-12 02:19:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix MessagePack high severity vulnerability (#14079)

Browse Source 
Pin MessagePack to 3.1.7 to resolve NU1903 error for known vulnerability
in transitive dependency 2.5.192 brought in by Aspire packages.

---------

Co-authored-by: Copilot <[email protected]>
This commit is contained in:
SergeyMenshykh
2026-06-15 17:27:33 +00:00
committed by GitHub
co-authored by Copilot
parent 61331d834d
commit f8c757b218
4 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dotnet/Directory.Packages.props
+1
View File
@@ -13,6 +13,7 @@
<PackageVersion Include="CommunityToolkit.Aspire.Hosting.Dapr" Version="9.9.0" />
<PackageVersion Include="CommunityToolkit.Aspire.Hosting.NodeJS.Extensions" Version="9.9.0" />
<PackageVersion Include="Aspire.Hosting.Azure.Search" Version="13.0.0" />
<PackageVersion Include="MessagePack" Version="3.1.7" /> <!-- Transitive dependency of Aspire pinned to newer version due to vulnerability in 2.5.192 -->
<PackageVersion Include="AWSSDK.BedrockAgent" Version="4.0.7.5" />
<PackageVersion Include="AWSSDK.BedrockAgentRuntime" Version="4.0.8.5" />
<PackageVersion Include="AWSSDK.BedrockRuntime" Version="4.0.14.5" />
dotnet/samples/Demos/AgentFrameworkWithAspire/ChatWithAgent.AppHost/ChatWithAgent.AppHost.csproj
+1
View File
@@ -22,6 +22,7 @@
<PackageReference Include="Aspire.Hosting.AppHost" />
<PackageReference Include="Aspire.Hosting.Azure.CognitiveServices" />
<PackageReference Include="Aspire.Hosting.Azure.Search" />
<PackageReference Include="MessagePack" /> <!-- Override vulnerable transitive dependency (2.5.192) from Aspire packages -->
</ItemGroup>
</Project>
dotnet/samples/Demos/ProcessFrameworkWithAspire/ProcessFramework.Aspire/ProcessFramework.Aspire.AppHost/ProcessFramework.Aspire.AppHost.csproj
+1
View File
@@ -14,6 +14,7 @@
<ItemGroup>
<PackageReference Include="Aspire.Hosting.AppHost" />
<PackageReference Include="MessagePack" /> <!-- Override vulnerable transitive dependency (2.5.192) from Aspire packages -->
</ItemGroup>
<ItemGroup>
dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.AppHost/ProcessFramework.Aspire.SignalR.AppHost.csproj
+1
View File
@@ -18,6 +18,7 @@
<PackageReference Include="Aspire.Hosting.NodeJs" />
<PackageReference Include="CommunityToolkit.Aspire.Hosting.Dapr" />
<PackageReference Include="CommunityToolkit.Aspire.Hosting.NodeJS.Extensions" />
<PackageReference Include="MessagePack" /> <!-- Override vulnerable transitive dependency (2.5.192) from Aspire packages -->
</ItemGroup>
<ItemGroup>