Update MessagePack version to 2.5.302

[emanueldejanu]

Upgrade MessagePack version because of vulnerability GHSA-hv8m-jj95-wg3x

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the centrally managed MessagePack dependency version for the repository.

Changes:

• Bumped MessagePackVersion from 2.5.198 to 2.5.302.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[mitchdenny]

👋 from the .NET Aspire team. We just shipped microsoft/aspire#18155 which pins MessagePack to 2.5.302 directly in Aspire.Hosting purely to silence the NU1903 warning that GHSA-hv8m-jj95-wg3x raises for every consumer AppHost project generated by dotnet new aspire-starter (issue: microsoft/aspire#18153). Aspire doesn't actually use MessagePack at runtime — all our JsonRpc instances use SystemTextJsonFormatter — so this pin is purely warning hygiene for our downstream consumers.

We'd love to drop the pin once this PR (or an equivalent) ships in a StreamJsonRpc release on NuGet. Happy to test a preview if that helps.

[AArnott]

This PR is targeting 2.26 which won't release for some time. I'm going to create a different PR against a new v2.25 branch so you can get the update more quickly.

[AArnott]

See #1459

[AArnott]

https://github.com/microsoft/vs-streamjsonrpc/releases/tag/v2.25.28