fix(deps): pin MessagePack 2.5.301 — NU1903 broke all branch CI#136
Conversation
…broke all CI StreamJsonRpc (via the Aspire AppHost SDK) pulls MessagePack 2.5.192, which now carries high-severity advisory GHSA-hv8m-jj95-wg3x (LZ4 decompression AccessViolation on bad input). NuGetAudit + TreatWarningsAsErrors turns the advisory into a restore failure on every branch. Direct-reference override forces the patched version; remove when StreamJsonRpc ships with MessagePack >= 2.5.301. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 27 minutes and 53 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
What
New high-severity advisory GHSA-hv8m-jj95-wg3x landed for MessagePack 2.5.192, a transitive dependency via StreamJsonRpc (Aspire AppHost SDK). NuGetAudit + TreatWarningsAsErrors turns it into restore failure NU1903 on every branch — this is what's failing CI on #126 and #131.
Standard remediation: direct-reference override pinning the patched 2.5.301, with a removal note for when StreamJsonRpc updates.
Restore + full build verified clean locally.
🤖 Generated with Claude Code