[Eric Erhardt (eerhardt)]

Backport of #21051 to release/13.6

Customer Impact

NuGet reports NU1902 (vulnerable MessagePack 2.5.302, pulled in transitively by StreamJsonRpc) and fails restores/builds that treat warnings as errors. Pinning to MessagePack 2.5.307 picks up the patched 2.x releases.

Testing

Validated on main per #21051: repo restore with -warnaserror -p:NuGetAudit=true (0 warnings/errors), CLI backchannel tests passed (29), Hosting pack nuspec requires MessagePack 2.5.307. Not separately re-run on release/13.6. Conflict in Directory.Packages.props (previous 2.5.302 pin) resolved by taking 2.5.307.

Risk

Low. Dependency patch bump within MessagePack 2.x; StreamJsonRpc unchanged.

Regression?

No.

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 21156

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 21156"

[github-actions]

Tests selector

Selects the full PR test matrix + all PR-gated jobs (ALL) — a rule matching 'Directory.Packages.props' selects ALL

---

Selection computed for commit fa2cf21.

[Copilot]

🟢 Approval recommended

No blocking issues were identified in these narrow dependency changes; release-branch validation remains unrun as disclosed.

No open issues 🎉

What changed in this PR

Backports the MessagePack security update to release/13.6, addressing vulnerable dependency restores while retaining MessagePack 2.x compatibility.

Changes:

• Raises the central MessagePack pin to 2.5.307.
• Adds an explicit Hosting reference so external project-reference consumers receive the patched minimum.

File	Description
src/​Aspire.Hosting/​Aspire.Hosting.csproj	Adds MessagePack reference and cleanup guidance.
Directory.Packages.props	Updates the security pin and its removal guidance.

_{Review effort: Balanced}

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch: "excluded → base_branch_is_release, title_release_prefix, body_backport_marker"

This PR is a backport and is out of scope for docs generation per the exclusion rule.

Exclusion reasons (from signals.json):

• base_branch_is_release: base ref is release/13.6 (weak signal, only supporting context)
• title_release_prefix: title is prefixed [release/13.6]
• body_backport_marker: PR body states "Backport of Pin MessagePack to 2.5.307 for security fixes #21051 to release/13.6"

Triggered signals (1): pr_body_has_security_marker — evidence: PR body mentions "NuGet reports NU1902 (vulnerable MessagePack 2.5.302, pulled in transitively by StreamJsonRpc)". This is advisory only; excluded == true overrides recommendation regardless of triggered signals.

The original (forward) PR #21051 on main is the canonical location for any documentation impact of this dependency pin; drafting a duplicate docs PR for this release-branch backport would be redundant noise.