Skip to content

Bump MessagePack from 2.5.302 to 3.1.8 - #180

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/MessagePack-3.1.8
Closed

Bump MessagePack from 2.5.302 to 3.1.8#180
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/MessagePack-3.1.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated MessagePack from 2.5.302 to 3.1.8.

Release notes

Sourced from MessagePack's releases.

3.1.7

What's Changed

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes

Moderage severity advisory fixes

Fixes with no security advisory

  • fb0fe9f0 Honor TypeFormatter options hooks for CWE-470
  • c1c06a6f Fix WriteRawX methods to advance by written length
  • 46c6a0fe Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

3.1.6

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

3.1.5

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

3.1.4

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

3.1.3

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

3.1.2

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

3.1.1

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

3.1.0

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

3.0.301

Note

Tag and Unity's version is 3.0.301 but published NuGet version is 3.0.308.
The version mismatch due to release process inconsistencies will be fixed in the next release.

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.300...v3.0.301

3.0.300

Fixed version, release notes see v3.0.3.

3.0.238-rc.1

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.233-rc.1...v3.0.238-rc.1

3.0.233-rc.1

Changes

Enhancements

  • #​2013: Secure by default

Fixes

  • #​2031: Use generic type argument used for custom formatters
  • #​2029: Apply scoped in more places
  • #​2030: Support nesting formatters within generic data types
  • #​2024: Source code generation fails for generic type with private member serialization
  • #​2028: Avoid collecting fields with custom formatter recusively
  • #​2023: Suppress MsgPack004 on private base members when only public is interesting
  • #​2022: Ignore abstract implementations of IMessagePackFormatter<T>
  • #​2012: MsgPack004 Analyzer triggering on not attributed private property on base class eventhough source generator shouldn't include private properties
  • #​2017: MsgPack013 should not report diagnostics on abstract classes
  • #​2021: Add scoped modifier to in parameters of ref struct
  • #​2016: Avoid collecting members when it doesn't have [Key]
  • #​2005: custom formatters code source generator error

Others

  • #​2032: Use simpler C# syntax for nullable value types

3.0.214-rc.1

Changes:

  • #​2015: Use a collision-resistant hash algorithm for untrusted data to address GHSA-4qm4-8hg2-g2xm
  • #​2009: Build nuget package with semver v2

This list of changes was auto generated.

3.0.208-rc.1

Breaking changes

Enhancements

Fixes

Other changes

New Contributors

3.0.134-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.129-beta...v3.0.134-beta

3.0.129-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.111-alpha...v3.0.129-beta

3.0.111-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.54-alpha...v3.0.111-alpha

3.0.54-alpha

What's Changed

High level

  • mpc tool is gone. We use roslyn source generators now.
  • Source generation is enabled by default. At runtime MessagePack v3 will look for these source generated formatters and avoid generating them dynamically if found.

Pull requests

New Contributors

... (truncated)

3.0.3

See our migration guide.
Details blog article

What's new

  • AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.
  • AOT source generation is hugely improved.
    • Support most or all of the data types that DynamicObjectResolver supported.
    • Support for serializing private members.
  • [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate.
  • Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.
  • Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute].
  • New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.

Unity

  • Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

2.6.100-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.6.95-alpha...v2.6.100-alpha

2.6.95-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.108...v2.6.95-alpha

Commits viewable in compare view.

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump MessagePack from 2.5.302 to 3.1.8
f6438d0 
---
updated-dependencies:
- dependency-name: MessagePack
  dependency-version: 3.1.8
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies labels Sep 13, 2026
@coderabbitai

coderabbitai Bot commented Sep 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ace4a6f4-01b7-44ef-a602-0968e095740f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #200.

@dependabot dependabot Bot closed this Oct 26, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/MessagePack-3.1.8 branch October 26, 2026 20:50
@Cadacious Cadacious mentioned this pull request Oct 26, 2026
Merged
Cadacious added a commit that referenced this pull request Oct 26, 2026
@Cadacious @claude
chore(deps): NuGet minor/patch group, coverlet 10, MessagePack 3
9138c76 
Consolidates Dependabot #175, #176 and #180, re-applied on current main.

- #175 group: Microsoft.Extensions/ASP.NET Core/EF Core to 10.0.14 (aligned
  with SignalR.Client already at 10.0.14 on main), OpenTelemetry 1.18.0,
  OpenIddict 7.7.0, StackExchange.Redis 2.13.17, Aspire hosting 13.5.3,
  Azure SDKs, Graph, Spectre.Console 0.57.2, test tooling and others.
- Held back: MassTransit stays 8.3.6 (v9 is commercially licensed);
  System.CommandLine stays 2.0.0-beta4 (2.0 stable is an API rewrite,
  ~340 call sites in Dhadgar.Cli; needs its own PR).
- #176: coverlet.collector 10.0.1.
- #180: MessagePack 3.1.12 (3.1.8 is itself inside GHSA-qhrr-8q5h-9q3h,
  patched at 3.1.9). Aspire only uses StreamJsonRpc's SystemTextJsonFormatter.
- Aspire.AppHost.Sdk 13.1.0 -> 13.5.3 to match the hosting packages;
  ASPIRE010 kept as a message (we use package-delivered DCP, not the CLI bundle).
- Spectre 0.57 adds ConfirmAsync: CA1849 fixed at 7 CLI confirm prompts.
- Scalar 2.17 adds namespace Scalar.AspNetCore.Attributes: CA1724 fixed by
  renaming TracingConstants.Attributes to SpanAttributes.
- Regenerated packages.lock.json files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE
Cadacious added a commit that referenced this pull request Oct 26, 2026
@Cadacious @claude
chore(deps): consolidate remaining Dependabot updates (#201)
5ada87a 
* ci(deps): bump GitHub Actions and hold MassTransit at v8

- actions/github-script v7 -> v9.0.0, actions/checkout v4 -> v7.0.1 and
  actions/create-github-app-token v1 -> v3.3.0 in the gemini and pr-agent
  workflows, now pinned by SHA like the rest of the repo.
- dorny/test-reporter v3.0.0 -> v3.2.0, Azure/static-web-apps-deploy to
  1a947af.
- Dependabot ignores MassTransit major versions: v9+ is commercially
  licensed. The OpenTransit switch is tracked in #195.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): express 5, jose 6, dotenv 17 in BetterAuth

Supersedes Dependabot #156 (express), #155 (jose) and #157 (dotenv).

- express 4.22 -> 5.3: the Better Auth catch-all becomes
  /api/v1/betterauth/*splat (path-to-regexp v8 rejects a bare "*").
  express.json() is no longer global; it runs only on the exchange
  route, as Better Auth's Express docs require the auth handler to see
  the raw body. The listen callback ignores the error argument that
  Express 5 now passes on bind failure.
- jose 5.10 -> 6.2: importPKCS8 + SignJWT usage is unchanged.
- dotenv 16.6 -> 17.4: loaded through src/env.js with quiet: true so
  the new "injected env" log line does not appear.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): React 19 in Panel and ShoppingCart

Bump react, react-dom, @types/react and @types/react-dom to 19.x in
both apps (supersedes Dependabot #148, #149, #152, #164). No source
changes were needed: neither app uses the global JSX namespace,
argument-less useRef, ReactDOM.render, defaultProps, propTypes or
string refs. @astrojs/react 6 accepts React 19. SharedAuth has no
React dependency, so it is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): migrate Panel and ShoppingCart to Tailwind 4

Supersedes Dependabot #150 and #151. Started from
`npx @tailwindcss/upgrade` (4.3.3), then reviewed and adjusted:

- Build: tailwindcss 4.3.3 through @tailwindcss/vite in astro.config.
  postcss.config.mjs, tailwind.config.mjs and autoprefixer are gone
  (v4 handles vendor prefixes itself). The upgrade tool wired up
  @tailwindcss/postcss, which was swapped for the Vite plugin.
- Theme: tailwind.config theme.extend moved into an @theme block in
  src/styles/global.css. backgroundSize.grid has no v4 theme
  namespace (the tool emitted a dead --background-size-grid, so
  bg-grid vanished from the build); restored as @Utility bg-grid.
- Sources: `@import 'tailwindcss' source('..')` limits scanning to
  src/, matching v3's content glob, so the legacy .razor files and
  READMEs are not scanned. SharedAuth holds no class names, so it
  needs no @source.
- Utility renames from the tool: rounded -> rounded-sm,
  backdrop-blur-sm -> backdrop-blur-xs, outline-none ->
  outline-hidden, flex-shrink-0 -> shrink-0, bg-gradient-to-* ->
  bg-linear-to-*, bg-[#0A0E17] -> bg-space-dark (same value).
- Visual parity: kept the tool's v3 border-colour compatibility rule
  and added v4's documented button cursor:pointer rule. @layer
  components and utilities blocks became @Utility rules.
- Drop tailwind.config.mjs from the csproj NpmBuild inputs and
  update the README and CLAUDE.md notes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): bump scope minor/patch group and drop @types/cytoscape stub

Applies Dependabot #183: astro 7.4.2, cytoscape 3.34.4,
@typescript-eslint 8.72, eslint-plugin-react-hooks 7.1.1, globals 17.13,
autoprefixer 10.6.1, prettier 3.9.10.

@types/cytoscape 3.31.0 is a deprecated stub (cytoscape ships its own
index.d.ts), so remove it instead of bumping. Raise engines.node to
>=22.23.4 to match astro 7.4.2's minimum.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): bump scope to react 19

Applies Dependabot #159 (react, @types/react) and moves react-dom and
@types/react-dom with it, since the pair must stay in lockstep. No source
changes needed: tsc --noEmit is clean (no global JSX namespace, every
useRef has an initial value, no removed APIs in use).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): migrate scope to tailwind css 4

Applies Dependabot #160 (tailwindcss 3.4.19 -> 4.3.3) using the official
@tailwindcss/upgrade tool, then reviewed and adjusted:

- Run Tailwind through @tailwindcss/vite in astro.config; drop
  postcss.config.mjs, autoprefixer and @tailwindcss/postcss (v4 handles
  vendor prefixing itself).
- Port tailwind.config.mjs (slate-950, Roboto sans, class dark mode) to
  @theme / @custom-variant in global.css and delete the config file.
- Restrict source detection to src/ with source("../"), matching the old
  content glob.
- Class renames from the tool: outline-none -> outline-hidden,
  backdrop-blur(-sm) -> backdrop-blur-sm(-xs), flex-shrink-0 -> shrink-0,
  bg-gradient-to-b -> bg-linear-to-b, arbitrary opacity/z-index to the
  bare-value forms. Computed values are unchanged.
- Keep v3 visuals: gray-200 default border colour and cursor:pointer on
  buttons via @layer base; move element-level globals (select/option
  colours, a { text-decoration: none }, safe-area padding) into
  @layer base so utilities such as hover:underline and bg-black/30 on
  selects still win, as they did in v3.
- Drop tailwind.config.mjs from the csproj build inputs; update README.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* chore(deps): NuGet minor/patch group, coverlet 10, MessagePack 3

Consolidates Dependabot #175, #176 and #180, re-applied on current main.

- #175 group: Microsoft.Extensions/ASP.NET Core/EF Core to 10.0.14 (aligned
  with SignalR.Client already at 10.0.14 on main), OpenTelemetry 1.18.0,
  OpenIddict 7.7.0, StackExchange.Redis 2.13.17, Aspire hosting 13.5.3,
  Azure SDKs, Graph, Spectre.Console 0.57.2, test tooling and others.
- Held back: MassTransit stays 8.3.6 (v9 is commercially licensed);
  System.CommandLine stays 2.0.0-beta4 (2.0 stable is an API rewrite,
  ~340 call sites in Dhadgar.Cli; needs its own PR).
- #176: coverlet.collector 10.0.1.
- #180: MessagePack 3.1.12 (3.1.8 is itself inside GHSA-qhrr-8q5h-9q3h,
  patched at 3.1.9). Aspire only uses StreamJsonRpc's SystemTextJsonFormatter.
- Aspire.AppHost.Sdk 13.1.0 -> 13.5.3 to match the hosting packages;
  ASPIRE010 kept as a message (we use package-delivered DCP, not the CLI bundle).
- Spectre 0.57 adds ConfirmAsync: CA1849 fixed at 7 CLI confirm prompts.
- Scalar 2.17 adds namespace Scalar.AspNetCore.Attributes: CA1724 fixed by
  renaming TracingConstants.Attributes to SpanAttributes.
- Regenerated packages.lock.json files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* fix(deps): finish the Scope Tailwind 4 move and review fixes

The Scope Tailwind 4 commit was missing its package, lockfile, Astro
config, csproj and README changes, and still had tailwind.config.mjs.
Restore them so Scope builds with @tailwindcss/vite.

Also put the static-web-apps-deploy pin back to the v1 commit main
uses, and update the BetterAuth README to express 5, jose 6 and
dotenv 17.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* ci(npm): fetch the newest Node 22 in the npm-ci action

The runner caches Node 22.23.3, but Astro 7.4.2 needs >=22.23.4, so
setup-node now checks for the latest 22.x instead of using the cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

* ci(codeql): run CodeQL nightly instead of on every PR

CodeQL now runs on a nightly schedule against main (and by hand), not on
pushes or pull requests, so its findings are triaged from the Security
tab rather than blocking merges.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014QCSL3vKBpaY5vx6epF7wE

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants