[AspireE2E] There is a warning Package 'MessagePack' 2.5.192 has a known high severity vulnerability when creating Aspire project

[jinzhao1127]

REGRESSION INFO: Also repro on Aspire 13.4.3

INSTALL STEPS

1. Clean machine: Windows11 25h2 x64
2. Install 10.0.301 SDK
3. Add 9.0 feed
4. Install Aspire.ProjectTemplates 13.5.0-preview
   dotnet new install Aspire.ProjectTemplates::13.5.0-preview.1.26311.10

REPRO STEPS

1. Open CMD, run following command to create a Aspire Starter App

    dotnet new aspire-starter -o AspireStarterApp
   

ACTUAL
warning NU1903: Package 'MessagePack' 2.5.192 has a known high severity vulnerability appears

Note:

1. After update the MessagePack version to 2.5.302 will fix this issue.

[edmondshtogu]

The same issue happening to me as well:

dotnet restore -v diagnostic
    Determining projects to restore...
    ~/Repos/CommunityToolkit/Aspire/src/CommunityToolkit.Aspire.Hosting.K3s/CommunityToolkit.Aspire.Hosting.K3s.csproj : error NU1903: Warning As Error: Package 'MessagePack' 2.5.192 has a known high severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x
    Failed to restore ~/Repos/CommunityToolkit/Aspire/src/CommunityToolkit.Aspire.Hosting.K3s/CommunityToolkit.Aspire.Hosting.K3s.csproj (in 118 ms).

Restore failed with 1 error(s) in 0.4s

[richardrobberse]

Same here.

[mitchdenny]

Investigating.

[mikewild-wcl]

I've also had this with Aspire.Hosting.SqlServer in Aspire 13.4.3, in a project with <TreatWarningsAsErrors>true</TreatWarningsAsErrors> .

Looking at the code, the dependency chain is Aspire.Hosting -> StreamJsonRpc (older version) -> MessagePack (v2.5.192). My suggested fix would be to update the StreamJsonRpc package version to a newer version that doesn't use a vulnerable MessagePack version.

[kieronlanning]

As a workaround you can always pin the version - I'm using central package management, so in my Directory.Packages.props you can add:

<!-- Pinning -->
<ItemGroup>
  <PackageVersion Include="MessagePack" Version="2.5.302" />
</ItemGroup>

v2.5.302 was released a few days.

Build Without Pinning

Restore succeeded with 2 warning(s) in 1.4s
    P:\GitHub\kjldev\purview-eventsourcing\src\src\EventSourcing.Samples.AppHost\EventSourcing.Samples.AppHost.csproj : warning NU1903: Package 'MessagePack' 2.5.192 has a known high severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x
    P:\GitHub\kjldev\purview-eventsourcing\src\tests\EventSourcing.Samples.AppHost.IntegrationTests\EventSourcing.Samples.AppHost.IntegrationTests.csproj : warning NU1903: Package 'MessagePack' 2.5.192 has a known high severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x
  EventSourcing.SourceGenerator netstandard2.0 succeeded (1.5s) → src\src\EventSourcing.SourceGenerator\bin\Release\netstandard2.0\EventSourcing.SourceGenerator.dll
  EventSourcing.Samples.ServiceDefaults net10.0 succeeded (2.0s) → src\src\EventSourcing.Samples.ServiceDefaults\bin\Release\net10.0\EventSourcing.Samples.ServiceDefaults.dll
  EventSourcing.SourceGenerator.PerformanceTests net10.0 succeeded (1.1s) → src\tests\EventSourcing.SourceGenerator.PerformanceTests\bin\Release\net10.0\EventSourcing.SourceGenerator.PerformanceTests.dll
  EventSourcing.SourceGenerator.UnitTests net10.0 succeeded (1.9s) → src\tests\EventSourcing.SourceGenerator.UnitTests\bin\Release\net10.0\EventSourcing.SourceGenerator.UnitTests.dll
  EventSourcing net10.0 succeeded (2.0s) → src\src\EventSourcing\bin\Release\net10.0\EventSourcing.dll
  EventSourcing.CosmosDb net10.0 succeeded (0.9s) → src\src\EventSourcing.CosmosDb\bin\Release\net10.0\EventSourcing.CosmosDb.dll
  EventSourcing.Samples net10.0 succeeded (1.3s) → src\src\EventSourcing.Samples\bin\Release\net10.0\EventSourcing.Samples.dll
  EventSourcing.AzureStorage net10.0 succeeded (1.3s) → src\src\EventSourcing.AzureStorage\bin\Release\net10.0\EventSourcing.AzureStorage.dll
  EventSourcing.MongoDB net10.0 succeeded (1.3s) → src\src\EventSourcing.MongoDB\bin\Release\net10.0\EventSourcing.MongoDB.dll
  EventSourcing.Samples.QuickStart net10.0 succeeded (0.7s) → src\src\EventSourcing.Samples.QuickStart\bin\Release\net10.0\EventSourcing.Samples.QuickStart.dll
  EventSourcing.SqlServer net10.0 succeeded (1.9s) → src\src\EventSourcing.SqlServer\bin\Release\net10.0\EventSourcing.SqlServer.dll
  SharedTestingFramework net10.0 succeeded (0.9s) → src\tests\SharedTestingFramework\bin\Release\net10.0\SharedTestingFramework.dll
  EventSourcing.Samples.IntegrationTests net10.0 succeeded (1.3s) → src\tests\EventSourcing.Samples.IntegrationTests\bin\Release\net10.0\EventSourcing.Samples.IntegrationTests.dll
  EventSourcing.Samples.UnitTests net10.0 succeeded (1.3s) → src\tests\EventSourcing.Samples.UnitTests\bin\Release\net10.0\EventSourcing.Samples.UnitTests.dll
  EventSourcing.Samples.Web net10.0 succeeded (2.2s) → src\src\EventSourcing.Samples.Web\bin\Release\net10.0\EventSourcing.Samples.Web.dll
  EventSourcing.UnitTests net10.0 succeeded (2.0s) → src\tests\EventSourcing.UnitTests\bin\Release\net10.0\EventSourcing.UnitTests.dll
  EventSourcing.Samples.AppHost net10.0 succeeded with 1 warning(s) (0.9s) → src\src\EventSourcing.Samples.AppHost\bin\Release\net10.0\EventSourcing.Samples.AppHost.dll
    P:\GitHub\kjldev\purview-eventsourcing\src\src\EventSourcing.Samples.AppHost\EventSourcing.Samples.AppHost.csproj : warning NU1903: Package 'MessagePack' 2.5.192 has a known high severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x
  EventSourcing.IntegrationTests net10.0 succeeded (2.5s) → src\tests\EventSourcing.IntegrationTests\bin\Release\net10.0\EventSourcing.IntegrationTests.dll
  EventSourcing.Samples.AppHost.IntegrationTests net10.0 succeeded with 1 warning(s) (1.3s) → src\tests\EventSourcing.Samples.AppHost.IntegrationTests\bin\Release\net10.0\EventSourcing.Samples.AppHost.IntegrationTests.dll
    P:\GitHub\kjldev\purview-eventsourcing\src\tests\EventSourcing.Samples.AppHost.IntegrationTests\EventSourcing.Samples.AppHost.IntegrationTests.csproj : warning NU1903: Package 'MessagePack' 2.5.192 has a known high severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x

Build succeeded with 4 warning(s) in 10.3s

Build with Pinning

Restore complete (0.6s)
  EventSourcing.Samples.ServiceDefaults net10.0 succeeded (0.3s) → src\src\EventSourcing.Samples.ServiceDefaults\bin\Release\net10.0\EventSourcing.Samples.ServiceDefaults.dll
  EventSourcing.SourceGenerator netstandard2.0 succeeded (0.4s) → src\src\EventSourcing.SourceGenerator\bin\Release\netstandard2.0\EventSourcing.SourceGenerator.dll
  EventSourcing net10.0 succeeded (0.5s) → src\src\EventSourcing\bin\Release\net10.0\EventSourcing.dll
  EventSourcing.SourceGenerator.PerformanceTests net10.0 succeeded (0.5s) → src\tests\EventSourcing.SourceGenerator.PerformanceTests\bin\Release\net10.0\EventSourcing.SourceGenerator.PerformanceTests.dll
  EventSourcing.SourceGenerator.UnitTests net10.0 succeeded (0.6s) → src\tests\EventSourcing.SourceGenerator.UnitTests\bin\Release\net10.0\EventSourcing.SourceGenerator.UnitTests.dll
  EventSourcing.CosmosDb net10.0 succeeded (0.6s) → src\src\EventSourcing.CosmosDb\bin\Release\net10.0\EventSourcing.CosmosDb.dll
  EventSourcing.Samples net10.0 succeeded (0.6s) → src\src\EventSourcing.Samples\bin\Release\net10.0\EventSourcing.Samples.dll
  EventSourcing.AzureStorage net10.0 succeeded (0.8s) → src\src\EventSourcing.AzureStorage\bin\Release\net10.0\EventSourcing.AzureStorage.dll
  EventSourcing.MongoDB net10.0 succeeded (0.9s) → src\src\EventSourcing.MongoDB\bin\Release\net10.0\EventSourcing.MongoDB.dll
  EventSourcing.Samples.QuickStart net10.0 succeeded (0.5s) → src\src\EventSourcing.Samples.QuickStart\bin\Release\net10.0\EventSourcing.Samples.QuickStart.dll
  EventSourcing.SqlServer net10.0 succeeded (1.0s) → src\src\EventSourcing.SqlServer\bin\Release\net10.0\EventSourcing.SqlServer.dll
  SharedTestingFramework net10.0 succeeded (0.4s) → src\tests\SharedTestingFramework\bin\Release\net10.0\SharedTestingFramework.dll
  EventSourcing.Samples.IntegrationTests net10.0 succeeded (0.6s) → src\tests\EventSourcing.Samples.IntegrationTests\bin\Release\net10.0\EventSourcing.Samples.IntegrationTests.dll
  EventSourcing.UnitTests net10.0 succeeded (0.9s) → src\tests\EventSourcing.UnitTests\bin\Release\net10.0\EventSourcing.UnitTests.dll
  EventSourcing.Samples.UnitTests net10.0 succeeded (0.9s) → src\tests\EventSourcing.Samples.UnitTests\bin\Release\net10.0\EventSourcing.Samples.UnitTests.dll
  EventSourcing.IntegrationTests net10.0 succeeded (1.0s) → src\tests\EventSourcing.IntegrationTests\bin\Release\net10.0\EventSourcing.IntegrationTests.dll
  EventSourcing.Samples.Web net10.0 succeeded (1.3s) → src\src\EventSourcing.Samples.Web\bin\Release\net10.0\EventSourcing.Samples.Web.dll
  EventSourcing.Samples.AppHost net10.0 succeeded (0.5s) → src\src\EventSourcing.Samples.AppHost\bin\Release\net10.0\EventSourcing.Samples.AppHost.dll
  EventSourcing.Samples.AppHost.IntegrationTests net10.0 succeeded (0.4s) → src\tests\EventSourcing.Samples.AppHost.IntegrationTests\bin\Release\net10.0\EventSourcing.Samples.AppHost.IntegrationTests.dll

Build succeeded in 4.1s

[niemyjski]

Also seeing this, Also curious why we are using a super old version of message pack...