Update MessagePack to 3.1.9 to address security advisories - #47
Open
cheerfulnut wants to merge 1 commit into
Open
cheerfulnut wants to merge 1 commit into
cheerfulnut wants to merge 1 commit into
Conversation
MessagePack 3.1.4 is affected by advisories covering >= 3.0, < 3.1.7, patched in 3.1.7. Two are rated high severity: - GHSA-vh6j-jc39-fggf: MessagePackReader.Skip can recurse without enforcing maximum object graph depth - GHSA-382j-8mxh-c7x2: DoS via stack and heap overflows CompanionMessageHandler deserializes ICompanionMessage from websocket data, which is the input path these advisories describe. This clears all NU1902/NU1903 warnings from dotnet restore. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Author
|
FYI CI on this one will fail at the Setup .NET step, but it's nothing to do with the MessagePack change. It's the pre-existing global.json issue on master I mentioned in #46 (setup-dotnet needs a full SDK version when rollForward is set). Merging #46 first would clear it, or it needs the same one-line fix here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi again - this is the follow-up PR I mentioned in #46. Keeping it separate since it's unrelated to the .Net10 change, and this one is based on master so it should merge fine either way.
When I ran dotnet restore, it flagged a bunch of security warnings against MessagePack 3.1.4. They're all covered by advisories affecting >= 3.0, < 3.1.7, fixed in 3.1.7, with two rated high:
GHSA-vh6j-jc39-fggf - MessagePackReader.Skip can recurse without enforcing max object graph depth
GHSA-382j-8mxh-c7x2 - DoS via stack and heap overflows
From what CC tells me this is relevant here because CompanionMessageHandler deserializes messages coming in over the websocket from the Companion mod. Again I'm not a dev so I may be overstating it, but it seemed worth flagging either way.
What changed: MessagePack 3.1.4 → 3.1.9 in SOTFEdit.Companion.Shared.csproj. One line.
Tested: build goes from 60 warnings to 0, and all 27 tests pass including the Companion.Shared round-trip ones.
Not verified: the actual Companion mod integration, since I don't have the mod installed.
🤖 Generated with Claude Code