Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903

[mitchdenny]

Bumps StreamJsonRpc to 2.25.28 to pick up MessagePack 2.5.302 transitively, clearing the NU1903 warning for GHSA-hv8m-jj95-wg3x / CVE-2026-48109 in consumer AppHost projects generated by dotnet new aspire-starter. No direct exposure for us — we don't use the MessagePack formatter — but the bump avoids the warning for end users.

StreamJsonRpc 2.25.x ships an analyzer built against Roslyn 4.14, which is newer than the Roslyn 4.11 in the .NET 8 SDK used by our template tests to build generated AppHost projects (would otherwise trigger CS9057). We don't use the StreamJsonRpc analyzers, so ExcludeAssets="analyzers" on the PackageReference skips them. NuGet bakes the exclusion into the Aspire.Hosting nuspec so downstream consumers transitively skip the analyzer too.

The upstream MessagePack fix lives at microsoft/vs-streamjsonrpc#1459. The ExcludeAssets="analyzers" can be dropped once our template-test toolchain moves to a .NET SDK with Roslyn ≥ 4.14.

Fixes #18153

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 18155

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 18155"

[Copilot]

Pull request overview

This PR bumps the centrally-managed StreamJsonRpc package version from 2.22.23 to 2.25.25 to resolve the NU1903 vulnerability warning (GHSA-hv8m-jj95-wg3x / CVE-2026-48109) that was emitted when creating new Aspire projects via dotnet new aspire-starter. The transitive MessagePack 2.5.192 dependency (pulled via the old StreamJsonRpc) falls within the advisory's vulnerable range; the updated StreamJsonRpc brings MessagePack 2.5.198 which is outside that range.

Changes:

• Bump StreamJsonRpc from 2.22.23 to 2.25.25 in Directory.Packages.props (central package management)

Show a summary per file

File	Description
Directory.Packages.props	Bumps the centrally-pinned StreamJsonRpc version to clear the NU1903 transitive vulnerability warning on MessagePack

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 0

[github-actions]

Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
GitHub was asked to rerun all failed jobs for that attempt, and the rerun is being tracked in the rerun attempt.
The job links below point to the failed attempt jobs that matched the retry-safe transient failure rules.

• Tests / Cli.EndToEnd-KubernetesDeployWithValkeyTests / Cli.EndToEnd-KubernetesDeployWithValkeyTests (ubuntu-latest) - Failed step 'Set up .NET Core' matched the transient annotation allowlist.

[mitchdenny]

PR Testing Report

PR Information

• PR Number: Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903 #18155
• Title: Bump StreamJsonRpc to 2.25.25 to clear MessagePack NU1903
• Tested commits:
  • 020f29c9 — original (StreamJsonRpc bump only) → fix incomplete
  • 4f03129d — follow-up (added direct MessagePack 2.5.302 pin in Aspire.Hosting) → fix complete
• Tested At: 2026-06-12 +1000

Changes Analyzed

Files Changed

• Directory.Packages.props — StreamJsonRpc 2.22.23 → 2.25.25, added MessagePack 2.5.302
• src/Aspire.Hosting/Aspire.Hosting.csproj — added direct <PackageReference Include="MessagePack" />

Change Categories

• CLI changes
• Hosting integration changes
• Dashboard changes
• Template changes
• Client/Component changes
• VS Code extension changes
• Test changes
• Build/infra: central NuGet version bump + direct pin to fully eliminate the vulnerable transitive MessagePack

Test Scenarios Executed

Scenario 1: PR CLI version matches head SHA

Status: ✅ Passed

• Installed PR CLI via the dogfood get-aspire-cli-pr.sh 18155 script (commit 020f29c9).
• aspire --version → 13.5.0-pr.18155.g020f29c9 (contains expected SHA).

---

Scenario 2: aspire new aspire-starter AppHost restore no longer emits NU1903 for MessagePack

Run 2a — original commit 020f29c9 (StreamJsonRpc bump only)

Status: ❌ Failed — warning still emitted

PrSmoke.AppHost.csproj : warning NU1903: Package 'MessagePack' 2.5.198 has a known high
  severity vulnerability, https://github.com/advisories/GHSA-hv8m-jj95-wg3x

Root cause: StreamJsonRpc 2.25.25 still declares a transitive dep on MessagePack 2.5.198, which is inside the advisory's range (< 2.5.302). Bumping StreamJsonRpc alone moved MessagePack from 2.5.192 → 2.5.198 — both vulnerable. The reporter explicitly called this out: "After update the MessagePack version to 2.5.302 will fix this issue."

Run 2b — follow-up commit 4f03129d (direct MessagePack pin)

Status: ✅ Passed

• Locally packed Aspire.Hosting and Aspire.Hosting.AppHost from 4f03129d and substituted them into the PR hive (same version string), then re-ran the starter scenario with cleared NuGet caches.
• Restore output: zero NU1903 occurrences.

$ grep -c NU1903 restore.log
0

---

Scenario 3: Resolved package versions in generated AppHost

Commit	MessagePack	StreamJsonRpc	Vulnerable?
pre-PR baseline	2.5.192	2.22.23	yes
020f29c9 (StreamJsonRpc bump only)	2.5.198	2.25.25	still yes
4f03129d (with MessagePack pin)	2.5.302	2.25.25	no ✅

Versions read directly from obj/project.assets.json of the generated PrSmoke.AppHost.

Summary

Scenario	Status
1. CLI version matches head SHA	✅ Passed
2a. NU1903 gone after 020f29c9 (StreamJsonRpc bump only)	❌ Failed
2b. NU1903 gone after 4f03129d (direct MessagePack 2.5.302 pin)	✅ Passed
3. Resolved package versions	✅ Passed (with follow-up commit)

Overall Result

✅ PR VERIFIED at 4f03129d — the follow-up commit pinning MessagePack 2.5.302 directly in Aspire.Hosting correctly eliminates NU1903 from dotnet new aspire-starter AppHost restore. The original 020f29c9 commit alone was insufficient because StreamJsonRpc 2.25.25 still declares a vulnerable MessagePack 2.5.198 transitively. This PR now contains both changes.

Notes

• This pin can be removed once StreamJsonRpc ships a release that depends on MessagePack >= 2.5.302.
• Exposure assessment (separate from the warning): Aspire never instantiates MessagePack; every JsonRpc site uses SystemTextJsonFormatter. All StreamJsonRpc transports are local UDS in the user's home dir. The advisory's LZ4 decompression bug is not reachable in Aspire's runtime.

[Copilot]

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 0 new

[mitchdenny]

Tracking upstream fix at microsoft/vs-streamjsonrpc#1458. Once that ships in a StreamJsonRpc release, we can drop the MessagePack pin added here and just bump StreamJsonRpc.

[github-actions]

❓ CLI E2E Tests unknown — 115 passed, 0 failed, 2 unknown (commit 87194e4)

View all recordings

-	Test	Detail
✅	AddPackageInteractiveWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AddPackageWhileAppHostRunningDetached	Recording · Job · CLI logs
✅	AgentCommands_AllHelpOutputs_AreCorrect	Recording · Job · CLI logs
✅	AgentInitCommand_DefaultSelection_InstallsDefaultSkills	Recording · Job · CLI logs
✅	AgentInitCommand_MigratesDeprecatedConfig	Recording · Job · CLI logs
✅	AgentInit_NonInteractive_BundleOnlySkillsNotInCatalog	Recording · Job · CLI logs
✅	AgentMcpListResources_ExcludesResourceMarkedWithExcludeFromMcp	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_DevLocalhost	Recording · Job · CLI logs
✅	AgentMcpListStructuredLogsReturnsLogsFromStarterApp_Isolated	Recording · Job · CLI logs
✅	AllPublishMethodsBuildDockerImages	Recording · Job · CLI logs
✅	AspireAddAndStartWorkAgainstLegacyAppHostTs	Recording · Job · CLI logs
✅	AspireAddPackageVersionToDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireInitSingleFileAppHostRunsViaDotnetRunAppHost	Recording · Job · CLI logs
✅	AspireInit_ExistingAppHostDir_RecreatesNuGetConfigKeepsFiles	Recording · Job · CLI logs
❔	AspireInit_SolutionFile_BuildsAgainstChannelHive	Recording · Job · CLI logs
✅	AspireStartUpdatesStaleTypeScriptAppHostPath	Recording · Job · CLI logs
✅	AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	Recording · Job · CLI logs
✅	AspireUpdateRemovesOrphanAppHostPackageVersionWhenSdkAlreadyCurrent	Recording · Job · CLI logs
✅	Banner_DisplayedOnFirstRun	Recording · Job · CLI logs
✅	Banner_DisplayedWithExplicitFlag	Recording · Job · CLI logs
✅	Banner_NotDisplayedWithNoLogoFlag	Recording · Job · CLI logs
✅	CertificatesClean_RemovesCertificates	Recording · Job · CLI logs
✅	CertificatesTrust_WithNoCert_CreatesAndTrustsCertificate	Recording · Job · CLI logs
✅	CertificatesTrust_WithUntrustedCert_TrustsCertificate	Recording · Job · CLI logs
✅	ConfigSetGet_CreatesNestedJsonFormat	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProject	Recording · Job · CLI logs
✅	CreateAndRunAspireStarterProjectWithBundle	Recording · Job · CLI logs
✅	CreateAndRunEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJavaEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunJsReactProject	Recording · Job · CLI logs
✅	CreateAndRunPolyglotAppHostWithDevLocalhostUrls	Recording · Job · CLI logs
✅	CreateAndRunPythonReactProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptEmptyAppHostProject	Recording · Job · CLI logs
✅	CreateAndRunTypeScriptStarterProject	Recording · Job · CLI logs
✅	CreateJavaAppHostWithViteApp	Recording · Job · CLI logs
✅	CreateTypeScriptAppHostWithViteApp_UsesConfiguredToolchain	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithAgentMcpListTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces	Recording · Job · CLI logs
✅	DashboardRunWithOtelTracesReturnsNoTraces_DevLocalhost	Recording · Job · CLI logs
✅	DeployK8sBasicApiService	Recording · Job · CLI logs
✅	DeployK8sWithExternalHelmChart	Recording · Job · CLI logs
✅	DeployK8sWithGarnet	Recording · Job · CLI logs
✅	DeployK8sWithMongoDB	Recording · Job · CLI logs
✅	DeployK8sWithMySql	Recording · Job · CLI logs
✅	DeployK8sWithPostgres	Recording · Job · CLI logs
✅	DeployK8sWithRabbitMQ	Recording · Job · CLI logs
✅	DeployK8sWithRedis	Recording · Job · CLI logs
✅	DeployK8sWithSqlServer	Recording · Job · CLI logs
✅	DeployK8sWithValkey	Recording · Job · CLI logs
✅	DeployTypeScriptAppToKubernetes	Recording · Job · CLI logs
✅	DescribeCommandResolvesReplicaNames	Recording · Job · CLI logs
✅	DescribeCommandShowsRunningResources	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJson	Recording · Job · CLI logs
✅	DetachFormatJsonProducesValidJsonWhenRestartingExistingInstance	Recording · Job · CLI logs
✅	DoPublishAndDeployListStepsWork	Recording · Job · CLI logs
✅	DocsCommand_RendersInteractiveMarkdownFromLocalSource	Recording · Job · CLI logs
✅	DoctorCommand_DetectsDeprecatedAgentConfig	Recording · Job · CLI logs
✅	DoctorCommand_TypeScriptAppHostReportsMissingConfiguredToolchain	Recording · Job · CLI logs
✅	DoctorCommand_WithSslCertDir_ShowsTrusted	Recording · Job · CLI logs
✅	DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	Recording · Job · CLI logs
✅	DotNetRunFileBasedAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	DotNetRunProjectAppHostUsesAspireCliBundle	Recording · Job · CLI logs
✅	GatewayWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	GeneratedAspireDevScript_StartsWatchMode_WithConfiguredToolchain	Recording · Job · CLI logs
✅	GlobalMigration_HandlesCommentsAndTrailingCommas	Recording · Job · CLI logs
✅	GlobalMigration_HandlesMalformedLegacyJson	Recording · Job · CLI logs
✅	GlobalMigration_PreservesAllValueTypes	Recording · Job · CLI logs
✅	GlobalMigration_SkipsWhenNewConfigExists	Recording · Job · CLI logs
✅	GlobalSettings_MigratedFromLegacyFormat	Recording · Job · CLI logs
✅	IngressWithoutExternalEndpoint_FailsPublishWithGuidance	Recording · Job · CLI logs
✅	InitTypeScriptAppHost_AugmentsExistingViteRepoInWorkspaceSubdirectory	Recording · Job · CLI logs
✅	InteractiveCSharpInitCreatesExpectedFiles	Recording · Job · CLI logs
✅	InvalidAppHostPathWithComments_IsHealedOnRun	Recording · Job · CLI logs
✅	JavaScriptHostingApisRunFromTypeScriptAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelAppHost	Recording · Job · CLI logs
✅	LatestCliCanStartStableChannelTypeScriptAppHost	Recording · Job · CLI logs
✅	LegacySettingsMigration_AdjustsRelativeAppHostPath	Recording · Job · CLI logs
✅	LogsCommandShowsResourceLogs	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterApp	Recording · Job · CLI logs
✅	OtelLogsReturnsStructuredLogsFromStarterAppIsolated	Recording · Job · CLI logs
✅	ProcessCommandCallbackReceivesCliArguments	Recording · Job · CLI logs
✅	PsCommandListsRunningAppHost	Recording · Job · CLI logs
✅	PsFormatJsonOutputsOnlyJsonToStdout	Recording · Job · CLI logs
✅	PublishJavaScriptPatternsGeneratesExpectedDockerComposeArtifacts	Recording · Job · CLI logs
✅	PublishWithConfigureEnvFileUpdatesEnvOutput	Recording · Job · CLI logs
✅	PublishWithDockerComposeServiceCallbackSucceeds	Recording · Job · CLI logs
✅	PublishWithoutOutputPathUsesAppHostDirectoryDefault	Recording · Job · CLI logs
✅	ResourceCommand_FailedExec_ShowsLogPathAndLogHasEntries	Recording · Job · CLI logs
✅	ResourceCommand_SetAndDeleteParameterUpdatesDescribeOutput	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles	Recording · Job · CLI logs
✅	RestoreGeneratesSdkFiles_WithConfiguredToolchain	Recording · Job · CLI logs
✅	RestoreRefreshesGeneratedSdkAfterAddingIntegration	Recording · Job · CLI logs
✅	RestoreSupportsConfigOnlyHelperPackageAndCrossPackageTypes	Recording · Job · CLI logs
✅	RunFromParentDirectory_UsesExistingConfigNearAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	RunReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	SecretCrudOnDotNetAppHost	Recording · Job · CLI logs
✅	SecretCrudOnTypeScriptAppHost	Recording · Job · CLI logs
✅	StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	Recording · Job · CLI logs
✅	StartAndWaitForTypeScriptSqlServerAppHostWithNativeAssets	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForDotNetAppHost	Recording · Job · CLI logs
✅	StartReportsSyntaxErrorsForTypeScriptAppHost	Recording · Job · CLI logs
✅	StopAllAppHostsFromAppHostDirectory	Recording · Job · CLI logs
✅	StopJavaPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopNonInteractiveSingleAppHost	Recording · Job · CLI logs
✅	StopTypeScriptPolyglotAppHostUsingApphostDirectory	Recording · Job · CLI logs
✅	StopWithNoRunningAppHostExitsSuccessfully	Recording · Job · CLI logs
✅	TerminalAttachFrontend_ShowsViteHelpAndDetaches	Recording · Job · CLI logs
✅	TypeScriptAppHostRunDoesNotDeadlockWhenLazyOptionsInvokeAsyncCallback	Recording · Job · CLI logs
✅	TypeScriptAppHostWithVite_AllowsDifferentGuestPkgManager	Recording · Job · CLI logs
✅	UnAwaitedChainsCompileWithAutoResolvePromises	Recording · Job · CLI logs
❔	UpdateToStable_CSharpEmptyAppHost_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_CSharpSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScriptSingleFileInit_KeepsConfigChannel	Recording · Job · CLI logs
✅	UpdateToStable_TypeScript_PreviewsStablePkgsAndKeepsChannel	Recording · Job · CLI logs

---

_{📹 Recordings uploaded automatically from CI run #27416008774}

[Copilot]

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1