Merge pull request #9571 from dotnet/u/xiaoyun/updateMessagePackVersion

Update MessagePack version to 2.5.187
dotnet · Oct 29, 2024 · b42c8ee · b42c8ee
2 parents 4341760 + d841380
commit b42c8ee
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -136,6 +136,12 @@
 
     <!-- Localization -->
     <PackageVersion Include="CommandLineParser"                                                     Version="2.9.1" />
+
+    <!-- MessagePack -->
+    <!-- Fix: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/2286088/ -->
+    <!-- The security vulnerable version of MessagePack package dependency is introduced by `Microsoft.VisualStudio.Utilities 17.12.40093` -->
+    <!-- We should be able to no longer explicitly-pinned MessagePack version after Microsoft.VisualStudio.Utilities update their MessagePack dependency -->
+    <PackageVersion Include="MessagePack"                                                           Version="2.5.187" />
   </ItemGroup>
 
-</Project>
+</Project>
diff --git a/eng/imports/VisualStudio.props b/eng/imports/VisualStudio.props
@@ -38,6 +38,7 @@
     <PackageReference Include="Microsoft.VisualStudio.Telemetry" />
     <PackageReference Include="Microsoft.VisualStudio.Utilities" />
     <PackageReference Include="NuGet.VisualStudio" />
+    <PackageReference Include="MessagePack" />
 
     <!-- Roslyn -->
     <PackageReference Include="Microsoft.VisualStudio.LanguageServices" />