Skip to content

security: upgrades nerdbank message pack version#1427

Closed
baywet wants to merge 1 commit into
microsoft:mainfrom
baywet:fix/upgrade-message-pack-security
Closed

security: upgrades nerdbank message pack version#1427
baywet wants to merge 1 commit into
microsoft:mainfrom
baywet:fix/upgrade-message-pack-security

Conversation

@baywet

@baywet baywet commented May 12, 2026

Copy link
Copy Markdown
Member

closes #1415
fixes #1426
due to this advisory, restores are failing on a bunch of projects. GHSA-2cwq-pwfr-wcw3
This pull request upgrade the dependency in an attempt to release and fix the issue.
However I was not able to test things out locally since https://dev.azure.com/azure-public/vside/_artifacts/feed/msft_consumption_public does not have that specific version, and I couldn't figure out how to get the permissions to do so.
Nuking the nuget config locally results in quite a few unit tests failing. Not sure how to proceed from there?

Copilot AI review requested due to automatic review settings May 12, 2026 12:11
@baywet baywet mentioned this pull request May 12, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the centrally-managed NuGet dependency version for Nerdbank.MessagePack to address the security advisory referenced in the PR description and unblock restores that are failing due to the vulnerable version.

Changes:

  • Bump Nerdbank.MessagePack from 1.0.11 to 1.1.62 via central package management.

Comment thread Directory.Packages.props
<PackageVersion Include="Microsoft.VisualStudio.Threading" Version="$(VisualStudioThreadingVersion)" />
<PackageVersion Include="Microsoft.VisualStudio.Validation" Version="17.13.22" />
<PackageVersion Include="Nerdbank.MessagePack" Version="1.0.11" />
<PackageVersion Include="Nerdbank.MessagePack" Version="1.1.62" />
@AArnott

AArnott commented May 13, 2026

Copy link
Copy Markdown
Member

Thanks for volunteering this. We'll go with #1430 instead of this PR because this PR targets an unreleased version and you probably want a release sooner rather than later.

That said, you can workaround this locally by adding a direct reference to the Nerdbank.MessagePack package yourself, or if you're using CPVM, just add a PackageVersion item to Directory.Packages.props to the same dependency (and turn on transitive pinning).

@AArnott AArnott closed this May 13, 2026
@baywet
baywet deleted the fix/upgrade-message-pack-security branch June 2, 2026 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

NerdBank Security Issue?

3 participants