Skip to content

Update MessagePack to 2.5.303 - #69369

Merged
wtgodbe merged 1 commit into
release/9.0from
BrennanConroy-patch-5
Sep 21, 2026
Merged

Update MessagePack to 2.5.303#69369
wtgodbe merged 1 commit into
release/9.0from
BrennanConroy-patch-5

Conversation

@BrennanConroy

@BrennanConroy BrennanConroy commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Update MessagePack to 2.5.303

Description

Update MessagePack to the latest version. The previous version has an advisory so we should make sure our transitive reference is on the latest (fixed) version.

Customer Impact

Don't need to update a transitive reference due to vulnerability warnings.

Regression?

  • Yes
  • No

Risk

  • High
  • Medium
  • Low

3rd party package reference update to fix a vulnerability. No code changes on our side.

Verification

  • Manual (required)
  • Automated

Packaging changes reviewed?

  • Yes
  • No
  • N/A

Copilot AI lite review requested due to automatic review settings September 17, 2026 22:50
Copilot AI reviewed Sep 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟡 Changes recommended

The PR description is still "TODO" and should be updated to document the motivation and relevant upstream release notes for the dependency bump.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 Low severity

Open (1)
What changed in this PR

Updates the centrally-managed MessagePack dependency version used across the repo via eng/Versions.props.

Changes:

  • Bump MessagePackVersion from 2.5.302 to 2.5.303.
File Description
eng/​Versions.props Updates the centrally-defined MessagePackVersion property to 2.5.303.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Comment thread eng/Versions.props
<GrpcNetClientVersion>2.64.0</GrpcNetClientVersion>
<GrpcToolsVersion>2.64.0</GrpcToolsVersion>
<MessagePackVersion>2.5.302</MessagePackVersion>
<MessagePackVersion>2.5.303</MessagePackVersion>
@build-analysis build-analysis Bot mentioned this pull request Sep 18, 2026
Open
3 tasks
@BrennanConroy BrennanConroy added the Servicing-approved Shiproom has approved the issue label Sep 21, 2026
@dotnet-policy-service

dotnet-policy-service Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Hi @BrennanConroy. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.

@wtgodbe
wtgodbe merged commit a0f453f into release/9.0 Sep 21, 2026
24 of 28 checks passed
@wtgodbe
wtgodbe deleted the BrennanConroy-patch-5 branch September 21, 2026 18:58
This was referenced Oct 13, 2026
Closed
Closed
Closed
Closed
Merged
Closed
Closed
Closed
Closed
Merged
Closed
Closed
Closed
Closed
Merged
Closed
Closed
This was referenced Oct 31, 2026
Open
Merged
Open
Open
Open
Open
Open
Open
Open
Merged
Merged
github-actions Bot pushed a commit to dlresende/extreme-carpaccio that referenced this pull request Nov 1, 2026
@dependabot
chore: Bump Microsoft.AspNetCore.Mvc.Testing from 9.0.20 to 9.0.22 (#557
1aa0119 
)

Updated
[Microsoft.AspNetCore.Mvc.Testing](https://github.com/dotnet/aspnetcore)
from 9.0.20 to 9.0.22.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Mvc.Testing's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 9.0.21

[Release](https://github.com/dotnet/core/releases/tag/v9.0.21)

## What's Changed
* [release/9.0] Update branding to 9.0.21 by @​vseanreesermsft in
dotnet/aspnetcore#68962
* [release/9.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in dotnet/aspnetcore#68967
* [release/9.0] (deps): Bump src/submodules/googletest from `3940de9` to
`36ba75f` by @​dependabot[bot] in
dotnet/aspnetcore#68919
* [release/9.0] Update OpenApi to 1.6.31 by @​Youssef1313 in
dotnet/aspnetcore#68837
* [release/9.0] Extract IsAuthenticated helper method by @​Youssef1313
with @​Copilot in dotnet/aspnetcore#68659
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#68570
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#69085
* [release/9.0] Fix h3 connection-level and stream-level abort locking
by @​BrennanConroy in dotnet/aspnetcore#69151
* Merging internal commits for release/9.0 by @​dotnet-bot in
dotnet/aspnetcore#69179
* [release/9.0] [SignalR] [Java] Fix hang when reading an HTTP response
body fails by @​github-actions[bot] in
dotnet/aspnetcore#69208
* [release/9.0] Fix: hardening http2 to refuse newline chars on trailers
and dynamic HPACK table by @​BrennanConroy in
dotnet/aspnetcore#69249
* [release/9.0] Scope sections E2E assertions to mounted app by
@​wtgodbe in dotnet/aspnetcore#69252
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#69268
* Update MessagePack to 2.5.303 by @​BrennanConroy in
dotnet/aspnetcore#69369


**Full Changelog**:
dotnet/aspnetcore@v9.0.20...v9.0.21

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/commits).
</details>

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=Microsoft.AspNetCore.Mvc.Testing&package-manager=nuget&previous-version=9.0.20&new-version=9.0.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
github-actions Bot pushed a commit to dlresende/extreme-carpaccio that referenced this pull request Nov 1, 2026
@dependabot
chore: Bump Microsoft.AspNetCore.Mvc.Testing from 9.0.20 to 9.0.22 (#554
bfdea01 
)

Updated
[Microsoft.AspNetCore.Mvc.Testing](https://github.com/dotnet/aspnetcore)
from 9.0.20 to 9.0.22.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.AspNetCore.Mvc.Testing's
releases](https://github.com/dotnet/aspnetcore/releases)._

## 9.0.21

[Release](https://github.com/dotnet/core/releases/tag/v9.0.21)

## What's Changed
* [release/9.0] Update branding to 9.0.21 by @​vseanreesermsft in
dotnet/aspnetcore#68962
* [release/9.0] Update dependencies from dotnet/source-build-assets by
@​dotnet-maestro[bot] in dotnet/aspnetcore#68967
* [release/9.0] (deps): Bump src/submodules/googletest from `3940de9` to
`36ba75f` by @​dependabot[bot] in
dotnet/aspnetcore#68919
* [release/9.0] Update OpenApi to 1.6.31 by @​Youssef1313 in
dotnet/aspnetcore#68837
* [release/9.0] Extract IsAuthenticated helper method by @​Youssef1313
with @​Copilot in dotnet/aspnetcore#68659
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#68570
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#69085
* [release/9.0] Fix h3 connection-level and stream-level abort locking
by @​BrennanConroy in dotnet/aspnetcore#69151
* Merging internal commits for release/9.0 by @​dotnet-bot in
dotnet/aspnetcore#69179
* [release/9.0] [SignalR] [Java] Fix hang when reading an HTTP response
body fails by @​github-actions[bot] in
dotnet/aspnetcore#69208
* [release/9.0] Fix: hardening http2 to refuse newline chars on trailers
and dynamic HPACK table by @​BrennanConroy in
dotnet/aspnetcore#69249
* [release/9.0] Scope sections E2E assertions to mounted app by
@​wtgodbe in dotnet/aspnetcore#69252
* [release/9.0] Update dependencies from dotnet/arcade by
@​dotnet-maestro[bot] in dotnet/aspnetcore#69268
* Update MessagePack to 2.5.303 by @​BrennanConroy in
dotnet/aspnetcore#69369


**Full Changelog**:
dotnet/aspnetcore@v9.0.20...v9.0.21

Commits viewable in [compare
view](https://github.com/dotnet/aspnetcore/commits).
</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This was referenced Nov 1, 2026
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@wtgodbe wtgodbe wtgodbe approved these changes
@dotnet-maestro-bot dotnet-maestro-bot Awaiting requested review from dotnet-maestro-bot dotnet-maestro-bot is a code owner

Assignees

No one assigned

Labels

Servicing-approved Shiproom has approved the issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@BrennanConroy @wtgodbe