Update MessagePack dependency to 3.1.7 or later
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 2k
- Forks
- 133
- PR merge metrics
- No merged PRs in 30d
Description
Hi, MessagePipe.Interprocess 1.8.2 currently depends on MessagePack >= 3.1.4.
GitHub Advisory Database now reports GHSA-hv8m-jj95-wg3x / CVE-2026-48109 as a high-severity vulnerability affecting MessagePack v3 versions before 3.1.7. MessagePack 3.1.7 is listed as the patched v3 release.
Could you please update the MessagePack dependency to 3.1.7 or later and publish a new MessagePipe release?
This would help downstream projects keep NuGet audit enabled without suppressing NU1903.
References:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the dependency metadata for the MessagePipe.Interprocess 1.8.2 package and inspect how its MessagePack version range is declared. Update the minimum version to 3.1.7 or later, verify that the package no longer triggers NU1903, and publish a new MessagePipe release as requested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100