From a3ef6b4f232d19e72df44aafaa46fcb8926435ce Mon Sep 17 00:00:00 2001
From: Meera Ruxmohan <mruxmohan@microsoft.com>
Date: Tue, 5 Nov 2024 21:37:46 -0800
Subject: [PATCH] Pin vulnerable MessagePack package to version 2.5.187 (#627)

---
 Directory.Packages.props | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6dda05e..35c1dd8 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -33,10 +33,11 @@
     <PackageVersion Include="xunit" Version="2.9.2" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
     <!-- Pinning vulnerable packages -->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.2" />
+    <PackageVersion Include="MessagePack" Version="2.5.187" />
     <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />
     <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.2" />
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
     <PackageVersion Include="System.Text.RegularExpressions" Version="4.3.1" />
   </ItemGroup>