-
Notifications
You must be signed in to change notification settings - Fork 130
Bump MessagePack to 2.5.187 #334
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump MessagePack to 2.5.187 #334
Conversation
Bumps [MessagePack](https://github.com/MessagePack-CSharp/MessagePack-CSharp) from 2.5.171 to 2.5.187. - [Release notes](https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases) - [Commits](MessagePack-CSharp/MessagePack-CSharp@v2.5.171...v2.5.187) --- updated-dependencies: - dependency-name: MessagePack dependency-version: 2.5.187 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
CsRedis v2.3.0 update BaseRedisObjectCacheStrategy.Client init progress
…endencyInjection.Abstractions Bumps Microsoft.Extensions.Caching.Memory to 6.0.2, 8.0.1 Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 8.0.0 to 8.0.2 --- updated-dependencies: - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 6.0.2 dependency-type: direct:production - dependency-name: Microsoft.Extensions.Caching.Memory dependency-version: 8.0.1 dependency-type: direct:production - dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions dependency-version: 8.0.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…NET.Tests/multi-6be6c664dc Bump Microsoft.Extensions.Caching.Memory and Microsoft.Extensions.DependencyInjection.Abstractions
…NET.Cache.CsRedis.Tests/MessagePack-2.5.187 Bump MessagePack from 2.5.171 to 2.5.187 in /src/Senparc.CO2NET.Cache.CsRedis.Tests
--- updated-dependencies: - dependency-name: MessagePack dependency-version: 2.5.187 dependency-type: direct:production - dependency-name: MessagePack dependency-version: 2.5.187 dependency-type: direct:production - dependency-name: MessagePack dependency-version: 2.5.187 dependency-type: direct:production - dependency-name: MessagePack dependency-version: 2.5.187 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR updates MessagePack from versions 1.7.3.4, 1.9.11, and 2.5.171 to 2.5.187 across multiple test project files. The primary motivation is to incorporate security fixes introduced in MessagePack 2.5.187 (addressing GHSA-4qm4-8hg2-g2xm related to hash collision attacks). Additionally, minor updates are made to Microsoft.Extensions dependencies in some projects.
- Upgrades MessagePack to 2.5.187 across all test projects (major version bump for projects still on 1.x)
- Includes security fix for collision-resistant hash algorithm for untrusted data
- Updates Microsoft.Extensions.Caching.Memory and Microsoft.Extensions.DependencyInjection.Abstractions in select projects
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| Senparc.CO2NET.Tests.net8.csproj | Updates Microsoft.Extensions packages; no MessagePack changes in this file |
| Senparc.CO2NET.Tests.net6.csproj | Updates Microsoft.Extensions.Caching.Memory to 6.0.2; no MessagePack changes in this file |
| Senparc.CO2NET.Cache.Redis.Tests.net8.csproj | Updates MessagePack from 2.5.171 to 2.5.187 |
| Senparc.CO2NET.Cache.Redis.Tests.net7.csproj | Major version bump: MessagePack 1.7.3.4 → 2.5.187 |
| Senparc.CO2NET.Cache.Redis.Tests.net6.csproj | Major version bump: MessagePack 1.7.3.4 → 2.5.187 |
| Senparc.CO2NET.Cache.Redis.Tests.csproj | Major version bump: MessagePack 1.9.11 → 2.5.187 |
| Senparc.CO2NET.Cache.CsRedis.Tests.net8.csproj | Updates MessagePack from 2.5.171 to 2.5.187; removes BOM character |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| <ItemGroup> | ||
| <PackageReference Include="MessagePack" Version="2.5.171" /> | ||
| <PackageReference Include="MessagePack" Version="2.5.187" /> | ||
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.171"> |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The MessagePackAnalyzer version (2.5.171) should be updated to match the MessagePack version (2.5.187) to ensure compatibility and consistent analysis behavior. Version mismatches between the runtime library and analyzer can lead to incorrect warnings or missed issues.
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.171"> | |
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.187"> |
| <ItemGroup> | ||
| <PackageReference Include="MessagePack" Version="2.5.171" /> | ||
| <PackageReference Include="MessagePack" Version="2.5.187" /> | ||
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.171"> |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The MessagePackAnalyzer version (2.5.171) should be updated to match the MessagePack version (2.5.187) to ensure compatibility and consistent analysis behavior. Version mismatches between the runtime library and analyzer can lead to incorrect warnings or missed issues.
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.171"> | |
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.187"> |
| <ItemGroup> | ||
| <PackageReference Include="MessagePack" Version="1.7.3.4" /> | ||
| <PackageReference Include="MessagePack" Version="2.5.187" /> | ||
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MessagePackAnalyzer version 1.6.0 is significantly outdated compared to MessagePack 2.5.187. This represents a major version mismatch (1.x analyzer with 2.x library) that will likely cause the analyzer to produce incorrect results or fail to recognize MessagePack 2.x features and API changes. Update MessagePackAnalyzer to 2.5.187.
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> | |
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.187" /> |
| <ItemGroup> | ||
| <PackageReference Include="MessagePack" Version="1.7.3.4" /> | ||
| <PackageReference Include="MessagePack" Version="2.5.187" /> | ||
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MessagePackAnalyzer version 1.6.0 is significantly outdated compared to MessagePack 2.5.187. This represents a major version mismatch (1.x analyzer with 2.x library) that will likely cause the analyzer to produce incorrect results or fail to recognize MessagePack 2.x features and API changes. Update MessagePackAnalyzer to 2.5.187.
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> | |
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.187" /> |
| <ItemGroup> | ||
| <PackageReference Include="MessagePack" Version="1.9.11" /> | ||
| <PackageReference Include="MessagePack" Version="2.5.187" /> | ||
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> |
Copilot
AI
Nov 25, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MessagePackAnalyzer version 1.6.0 is significantly outdated compared to MessagePack 2.5.187. This represents a major version mismatch (1.x analyzer with 2.x library) that will likely cause the analyzer to produce incorrect results or fail to recognize MessagePack 2.x features and API changes. Update MessagePackAnalyzer to 2.5.187.
| <PackageReference Include="MessagePackAnalyzer" Version="1.6.0" /> | |
| <PackageReference Include="MessagePackAnalyzer" Version="2.5.187" /> |
Updated MessagePack from 1.7.3.4 to 2.5.187.
Release notes
Sourced from MessagePack's releases.
2.5.187
Changes:
This list of changes was auto generated.
2.5.172
What's Changed
[MessagePackFormatter]on parameters and return values by @AArnott in Allow applying[MessagePackFormatter]on parameters and return values MessagePack-CSharp/MessagePack-CSharp#1901Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.171...v2.5.172
2.5.171
What's Changed
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.168...v2.5.171
2.5.168
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.140...v2.5.168
2.5.140
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.129...v2.5.140
2.5.129
What's Changed
longtointtruncation of stream position by @AArnott in Removelongtointtruncation of stream position MessagePack-CSharp/MessagePack-CSharp#1685Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.124...v2.5.129
2.5.124
What's Changed
ILookup<TKey, TElement>deserialized behavior by @AArnott in FixILookup<TKey, TElement>deserialized behavior MessagePack-CSharp/MessagePack-CSharp#1623New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.108...v2.5.124
2.5.108
What's Changed
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.103...v2.5.108
2.5.103
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.94...v2.5.103
2.5.94
What's Changed
StaticCompositeResolverby @AArnott in Fix null param check inStaticCompositeResolverMessagePack-CSharp/MessagePack-CSharp#1527PrimitiveObjectFormatterby @AArnott in Improve error messages in exceptions thrown fromPrimitiveObjectFormatterMessagePack-CSharp/MessagePack-CSharp#1499UnsafeBlitFormatterby @lynzrand in Fix wrong data length written inUnsafeBlitFormatterMessagePack-CSharp/MessagePack-CSharp#1551New Contributors
UnsafeBlitFormatterMessagePack-CSharp/MessagePack-CSharp#1551... (truncated)
2.5.64-alpha
What's Changed
New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.4.23-alpha...v2.5.64-alpha
2.4.59
What's Changed
StaticCompositeResolverby @AArnott in Fix null param check inStaticCompositeResolverMessagePack-CSharp/MessagePack-CSharp#1527PrimitiveObjectFormatterby @AArnott in Improve error messages in exceptions thrown fromPrimitiveObjectFormatterMessagePack-CSharp/MessagePack-CSharp#1499New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.4.35...v2.4.59
2.4.35
Changes:
Enhancements:
Others:
This list of changes was auto generated.
2.4.23-alpha
What's Changed
DateOnlyandTimeOnlytypes by @AArnott in Add built-in support for .NET 6DateOnlyandTimeOnlytypes MessagePack-CSharp/MessagePack-CSharp#1427New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.4.14-alpha...v2.4.23-alpha
2.4.14-alpha
What's Changed
floatby @pCYSl5EDgo in Fix secure hash forfloatMessagePack-CSharp/MessagePack-CSharp#1364New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.3.85...v2.4.14-alpha
2.3.112
What's Changed
floatby @pCYSl5EDgo in Fix secure hash forfloatMessagePack-CSharp/MessagePack-CSharp#1364New Contributors
Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.3.85...v2.3.112
2.3.85
Changes:
This list of changes was auto generated.
2.3.75
Changes:
Breaking
This release includes a behavioral breaking change (relative to our v2.2 releases) for better performance and avoid overriding default values when the msgpack stream does not include a value for that property (see #1085)
Enhancements:
Others:
This list of changes was auto generated.
2.3.73-alpha
Changes:
Fixes:
initEnhancements:
IReadOnlySet<T>See More
Others:
StandardResolverAllowPrivate[MessagePackObject]or a valid[MessagePackFormatter()]IReadOnlySet<T>MissingMethodExceptionon generic classes withinitproperty settersCtorParameterAndPropertySetterExiststest for v2.3 behavior... (truncated)
2.3.58-alpha
Changes:
Fixes:
initEnhancements:
See More
Others:
prepare_release.ps1scriptMissingMethodExceptionon generic classes withinitproperty settersCtorParameterAndPropertySetterExiststest for v2.3 behavior... (truncated)
2.2.113
Changes:
Fixes:
fixarrayof bytesEnhancements:
Others:
byte[]from a msgpack arraySee More
This list of changes was auto generated.
2.2.85
Changes:
Fixes:
Enhancements:
CodeGenHelpersOthers:
See More
[MessagePackFormatter(TypelessFormatter)][DataMember]that appears on virtual and override propertiesThis list of changes was auto generated.
2.2.60
Changes:
Fixes:
Enhancements:
Others:
This list of changes was auto generated.
2.2.44-rc
Changes:
Fixes:
Unionattributes with type namesEnhancements:
ReadOnlyMemory<T>andReadOnlySequence<T>supportdotnet mpctoolOthers:
See More
This list of changes was auto generated.
2.2.36-alpha
Changes:
Fixes:
Enhancements:
ReadOnlyMemory<T>andReadOnlySequence<T>supportdotnet mpctoolOthers:
See More
Unionattributes with type namesThis list of changes was auto generated.
2.1.194
Changes:
Fixes:
StandardResolverAllowPrivateEnhancements:
Array.Empty<T>()instead ofnew T[]wherever possibleOthers:
2.1.165
Changes:
See More
This list of changes was auto generated.
2.1.152
Changes:
Fixes:
Others:
This list of changes was auto generated.
2.1.143
Changes:
Fixes:
Enhancements:
Others:
See More
This list of changes was auto generated.
2.1.115
Changes:
Fixes:
Enhancements:
Others:
See More
This list of changes was auto generated.
2.1.90
Changes:
Fixes:
MessagePackSecurity.GetEqualityComparer<object>to not return nullEnhancements:
2.1.80
Changes:
🔒 Security fixes are included in this release. Read more in our security advisory.
Fixes:
ConvertToJsonEnhancements:
See More
MessagePackReader.TryRead*HeadermethodsOthers:
... (truncated)
2.0.335
Changes:
Fixes:
ConvertToJsonin ext formatReadOnlySequence<byte>that it deserializedOthers:
This list of changes was auto generated.
2.0.323
Changes:
Upgrading from 1.x? See our migration doc.
Fixes:
Enhancements:
IBufferWriter<byte>overload to NonGeneric APIOthers:
See More
This list of changes was auto generated.
2.0.299-rc
Changes:
Fixes:
Enhancements:
Others:
See More
This list of changes was auto generated.
API diff: