From fa2cf21ad2a3e80bae11b3a44044471ce0aabe85 Mon Sep 17 00:00:00 2001
From: Mitch Denny <midenn@microsoft.com>
Date: Fri, 16 Oct 2026 22:18:31 +1100
Subject: [PATCH] Pin MessagePack to 2.5.307 for security fixes

Keep StreamJsonRpc on 2.25.29 until it adopts MessagePack 3.x. Add an explicit Hosting reference so the security pin also flows to out-of-tree project-reference consumers.

Related to #21050.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 25f67c97-c7d9-43c6-be44-a406e0bf1b17
---
 Directory.Packages.props                 | 7 +++----
 src/Aspire.Hosting/Aspire.Hosting.csproj | 3 +++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 89d373a309c..26196c4705b 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -125,10 +125,9 @@
     <PackageVersion Include="Humanizer.Core" Version="3.0.10" />
     <PackageVersion Include="KubernetesClient" Version="19.0.2" />
     <PackageVersion Include="Markdig" Version="1.3.2" />
-    <!-- Pin StreamJsonRpc's transitive dependency without replacing the CLI's NativeAOT preview.
-         2.5.302 combines the security fixes in 2.5.205 and 2.5.301:
-         https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.302 -->
-    <PackageVersion Include="MessagePack" Version="2.5.302" />
+    <!-- Pin StreamJsonRpc's transitive dependency for 2.x security fixes until it adopts MessagePack 3.x.
+         Remove this pin when upgrading StreamJsonRpc: https://github.com/microsoft/aspire/issues/21050 -->
+    <PackageVersion Include="MessagePack" Version="2.5.307" />
     <!-- 2.0.1's transitive runtime targets set RuntimeIdentifier after restore, breaking
          RID-independent library and AppHost builds with NETSDK1047. Retain 1.1.0 until fixed upstream. -->
     <PackageVersion Include="Microsoft.AI.Foundry.Local" Version="1.1.0" />
diff --git a/src/Aspire.Hosting/Aspire.Hosting.csproj b/src/Aspire.Hosting/Aspire.Hosting.csproj
index 09a2cd9df3c..7edb9f3540d 100644
--- a/src/Aspire.Hosting/Aspire.Hosting.csproj
+++ b/src/Aspire.Hosting/Aspire.Hosting.csproj
@@ -83,6 +83,9 @@
          The public AspireTerminal handle keeps these implementation types out of the API surface. -->
     <PackageReference Include="Hex1b" />
     <PackageReference Include="KubernetesClient" />
+    <!-- Central transitive pins do not flow to out-of-tree ProjectReference consumers.
+         Keep this explicit security pin until https://github.com/microsoft/aspire/issues/21050 is resolved. -->
+    <PackageReference Include="MessagePack" />
     <PackageReference Include="Microsoft.Extensions.Hosting" />
     <PackageReference Include="ModelContextProtocol" />
     <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />