Fix MessagePack

[SergeyMenshykh]

Pin MessagePack to 3.1.7 to resolve NU1903 error for known vulnerability in transitive dependency 2.5.192 brought in by Aspire packages.

[Copilot]

Pull request overview

Pins MessagePack to a non-vulnerable version to address the NU1903 security vulnerability warning triggered by Aspire packages in the .NET Aspire sample(s).

Changes:

• Adds a central MessagePack package version (3.1.7) under dotnet/Directory.Packages.props.
• Adds an explicit MessagePack package reference to the ChatWithAgent.AppHost project so the pinned version is actually used during restore.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
dotnet/samples/Demos/AgentFrameworkWithAspire/ChatWithAgent.AppHost/ChatWithAgent.AppHost.csproj	Adds an explicit MessagePack reference so the solution restores with the pinned (non-vulnerable) version.
dotnet/Directory.Packages.props	Centrally pins MessagePack to 3.1.7 for CPM-managed restores.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 91%

✓ Correctness

This PR correctly pins MessagePack to 3.1.7 in the central package management file (Directory.Packages.props) and adds an explicit PackageReference in the Aspire AppHost project to override the vulnerable transitive dependency (2.5.192). The approach follows standard .NET/NuGet patterns for resolving transitive dependency vulnerabilities with Central Package Management. The version 3.1.7 is above the fix threshold (2.6.100) for GHSA-hv8m-jj95-wg3x. No correctness issues found.

✓ Security Reliability

This PR correctly pins MessagePack to 3.1.7 to address the high-severity vulnerability GHSA-hv8m-jj95-wg3x in the transitive dependency 2.5.192 brought in by Aspire packages. The approach of adding a central PackageVersion entry plus a direct PackageReference in the affected project is the standard NuGet pattern for overriding vulnerable transitive dependencies. However, two other Aspire AppHost projects in the repo (ProcessFramework.Aspire.AppHost and ProcessFramework.Aspire.SignalR.AppHost) also reference Aspire.Hosting.AppHost and may have the same vulnerable transitive dependency without a corresponding direct PackageReference to force the override.

✓ Test Coverage

This PR pins the MessagePack transitive dependency to version 3.1.7 to fix a known high-severity vulnerability (GHSA-hv8m-jj95-wg3x) in version 2.5.192 brought in by Aspire packages. This is purely a build/dependency configuration change with no new or altered runtime behavior. No test coverage concerns exist—there is no new logic, feature, or behavioral change to test. The appropriate validation is that the project builds successfully with the updated dependency.

✓ Failure Modes

This PR pins MessagePack to 3.1.7 via Central Package Management to resolve a known high-severity vulnerability (GHSA-hv8m-j95-wg3x) in the transitive dependency version 2.5.192 brought in by Aspire packages. The change is straightforward and scoped appropriately. The version pin in Directory.Packages.props defines the version centrally, and the explicit PackageReference in ChatWithAgent.AppHost.csproj ensures the override applies to that project. No silent failure modes, swallowed exceptions, or operational risks are introduced by this change. If the version were incompatible with Aspire's expectations, NuGet restore or runtime loading would fail loudly rather than silently.

✗ Design Approach

The package pin itself is reasonable, but the current design only applies the transitive MessagePack override to one Aspire sample. Two other AppHost projects in the repo still reference Aspire packages through the same pattern without the direct override, so this does not fully address the stated repo-level vulnerability fix.

Flagged Issues

• The MessagePack override is only wired into ChatWithAgent.AppHost, while dotnet/samples/Demos/ProcessFrameworkWithAspire/ProcessFramework.Aspire.AppHost/ProcessFramework.Aspire.AppHost.csproj:16 and dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.AppHost/ProcessFramework.Aspire.SignalR.AppHost.csproj:16-20 still consume Aspire packages without a direct MessagePack reference. The repo's existing pattern for transitive-vulnerability remediation is to add the overriding package directly in each affected project (dotnet/src/Functions/Functions.Prompty.csproj:21-23).

---

Automated review by SergeyMenshykh's agents

[github-actions]

Flagged issue

The MessagePack override is only wired into ChatWithAgent.AppHost, while dotnet/samples/Demos/ProcessFrameworkWithAspire/ProcessFramework.Aspire.AppHost/ProcessFramework.Aspire.AppHost.csproj:16 and dotnet/samples/Demos/ProcessFrameworkWithSignalR/src/ProcessFramework.Aspire.SignalR.AppHost/ProcessFramework.Aspire.SignalR.AppHost.csproj:16-20 still consume Aspire packages without a direct MessagePack reference. The repo's existing pattern for transitive-vulnerability remediation is to add the overriding package directly in each affected project (dotnet/src/Functions/Functions.Prompty.csproj:21-23).

---

Source: automated DevFlow PR review

[SergeyMenshykh]

Addressed added direct MessagePack reference to both ProcessFramework.Aspire.AppHost and ProcessFramework.Aspire.SignalR.AppHost projects as well.