From 79c0e7c83fb00295ae6a19517e75bb72468498d8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 16:32:58 +0000
Subject: [PATCH 1/2] fix(deps): pin patched MessagePack 2.5.303 for Aspire
 (GHSA-qhrr-8q5h-9q3h)

Aspire.Hosting 13.6.1 and StreamJsonRpc pull MessagePack 2.5.302, which
fails restore with NU1902 (warnings as errors) in TUnit.Aspire.Core and
TUnit.Aspire. Raise the floor to the patched 2.x release via
VersionOverride in TUnit.Aspire.Core and the Aspire test AppHost; the
central 3.x version is not API-compatible with them.

Remove once Aspire depends on a patched MessagePack.
---
 src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj                | 4 ++++
 .../TUnit.Aspire.Tests.AppHost.csproj                         | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj b/src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj
index 42ed3428793..10ebbcfc77d 100644
--- a/src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj
+++ b/src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj
@@ -26,6 +26,10 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.Testing" />
+    <!-- Aspire.Hosting and StreamJsonRpc pull MessagePack 2.5.302 (GHSA-qhrr-8q5h-9q3h). Raise the floor
+         to the patched 2.x release; 3.x (the central version) is not API-compatible with them.
+         Remove once Aspire depends on a patched MessagePack. -->
+    <PackageReference Include="MessagePack" VersionOverride="2.5.303" />
   </ItemGroup>
 
   <Import Project="..\..\eng\Library.targets" />
diff --git a/tests/TUnit.Aspire.Tests.AppHost/TUnit.Aspire.Tests.AppHost.csproj b/tests/TUnit.Aspire.Tests.AppHost/TUnit.Aspire.Tests.AppHost.csproj
index 42789349c11..22da39c7a73 100644
--- a/tests/TUnit.Aspire.Tests.AppHost/TUnit.Aspire.Tests.AppHost.csproj
+++ b/tests/TUnit.Aspire.Tests.AppHost/TUnit.Aspire.Tests.AppHost.csproj
@@ -9,6 +9,8 @@
 
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.AppHost" />
+    <!-- Patched MessagePack (GHSA-qhrr-8q5h-9q3h); see src/TUnit.Aspire.Core/TUnit.Aspire.Core.csproj. -->
+    <PackageReference Include="MessagePack" VersionOverride="2.5.303" />
   </ItemGroup>
 
   <ItemGroup>

From 0fb9421892263c6519ab82fe0382f4ed0ad269e8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 16 Oct 2026 15:54:25 +0000
Subject: [PATCH 2/2] fix(deps): use per-TFM Microsoft.Extensions.Http versions
 for TUnit.Mocks.Http

Microsoft.Extensions.Http was pinned to 10.0.12 for every target framework,
so TUnit.Mocks.Http pulled Microsoft.Extensions.Logging* 10.x into net8.0
and net9.0 consumers, overriding the 8.x/9.x floors that
TUnit.Logging.Microsoft, TUnit.Mocks.Logging and TUnit.AspNetCore.Core use.

Add an HttpVersion property alongside the existing per-TFM versions:
8.0.1 (net8.0), 9.0.20 (net9.0), 10.0.12 (net10.0).
---
 Directory.Packages.props | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 4b404261d0f..094cf46ad72 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -2,22 +2,26 @@
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
   </PropertyGroup>
-  <!-- Per-TFM versions: the 10.x packages do not support net8.0/net9.0 consumers.
+  <!-- Per-TFM versions: match these packages to the consumer's runtime. Some 10.x packages do not support
+       net8.0/net9.0 consumers at all, and the rest would lift Microsoft.Extensions.* to 10.x on net8.0/net9.0.
        Any project (single- or multi-targeted) that builds for net8.0/net9.0 resolves the matching 8.x/9.x version. -->
   <PropertyGroup>
     <MvcTestingVersion>10.0.12</MvcTestingVersion>
     <LoggingVersion>10.0.12</LoggingVersion>
     <LoggingAbstractionsVersion>10.0.12</LoggingAbstractionsVersion>
+    <HttpVersion>10.0.12</HttpVersion>
   </PropertyGroup>
   <PropertyGroup Condition="'$(TargetFramework)' == 'net8.0'">
     <MvcTestingVersion>8.0.31</MvcTestingVersion>
     <LoggingVersion>8.0.1</LoggingVersion>
     <LoggingAbstractionsVersion>8.0.3</LoggingAbstractionsVersion>
+    <HttpVersion>8.0.1</HttpVersion>
   </PropertyGroup>
   <PropertyGroup Condition="'$(TargetFramework)' == 'net9.0'">
     <MvcTestingVersion>9.0.20</MvcTestingVersion>
     <LoggingVersion>9.0.20</LoggingVersion>
     <LoggingAbstractionsVersion>9.0.20</LoggingAbstractionsVersion>
+    <HttpVersion>9.0.20</HttpVersion>
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="Grpc.Core.Api" Version="2.84.0" />
@@ -60,7 +64,7 @@
     <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="18.7.23" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.12" />
     <PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.12" />
-    <PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.12" />
+    <PackageVersion Include="Microsoft.Extensions.Http" Version="$(HttpVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="$(LoggingVersion)" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="$(LoggingAbstractionsVersion)" />
     <PackageVersion Include="Microsoft.Kiota.Abstractions" Version="2.1.2" />