From 130bd1626874e00f6880da1e11666e5edee91fbc Mon Sep 17 00:00:00 2001 From: cheerfulnut <91607869+cheerfulnut@users.noreply.github.com> Date: Sun, 20 Sep 2026 11:48:28 +0900 Subject: [PATCH] Update MessagePack to 3.1.9 to address security advisories MessagePack 3.1.4 is affected by advisories covering >= 3.0, < 3.1.7, patched in 3.1.7. Two are rated high severity: - GHSA-vh6j-jc39-fggf: MessagePackReader.Skip can recurse without enforcing maximum object graph depth - GHSA-382j-8mxh-c7x2: DoS via stack and heap overflows CompanionMessageHandler deserializes ICompanionMessage from websocket data, which is the input path these advisories describe. This clears all NU1902/NU1903 warnings from dotnet restore. Co-Authored-By: Claude Opus 5 --- SOTFEdit.Companion.Shared/SOTFEdit.Companion.Shared.csproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SOTFEdit.Companion.Shared/SOTFEdit.Companion.Shared.csproj b/SOTFEdit.Companion.Shared/SOTFEdit.Companion.Shared.csproj index 4b61737..97a4a1b 100644 --- a/SOTFEdit.Companion.Shared/SOTFEdit.Companion.Shared.csproj +++ b/SOTFEdit.Companion.Shared/SOTFEdit.Companion.Shared.csproj @@ -10,7 +10,7 @@ - +