Skip to content

chore(deps): Bump the nuget-dependencies group with 2 updates#122

Merged
JerrettDavis merged 1 commit into
mainfrom
dependabot/nuget/nuget-dependencies-97536be51c
Jun 16, 2026
Merged

chore(deps): Bump the nuget-dependencies group with 2 updates#122
JerrettDavis merged 1 commit into
mainfrom
dependabot/nuget/nuget-dependencies-97536be51c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 16, 2026

Copy link
Copy Markdown
Contributor

Updated MessagePack from 2.5.301 to 3.1.7.

Release notes

Sourced from MessagePack's releases.

3.1.7

What's Changed

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes

Moderage severity advisory fixes

Fixes with no security advisory

  • fb0fe9f0 Honor TypeFormatter options hooks for CWE-470
  • c1c06a6f Fix WriteRawX methods to advance by written length
  • 46c6a0fe Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

3.1.6

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

3.1.5

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

3.1.4

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

3.1.3

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

3.1.2

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

3.1.1

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

3.1.0

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

3.0.301

Note

Tag and Unity's version is 3.0.301 but published NuGet version is 3.0.308.
The version mismatch due to release process inconsistencies will be fixed in the next release.

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.300...v3.0.301

3.0.300

Fixed version, release notes see v3.0.3.

3.0.238-rc.1

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.233-rc.1...v3.0.238-rc.1

3.0.233-rc.1

Changes

Enhancements

  • #​2013: Secure by default

Fixes

  • #​2031: Use generic type argument used for custom formatters
  • #​2029: Apply scoped in more places
  • #​2030: Support nesting formatters within generic data types
  • #​2024: Source code generation fails for generic type with private member serialization
  • #​2028: Avoid collecting fields with custom formatter recusively
  • #​2023: Suppress MsgPack004 on private base members when only public is interesting
  • #​2022: Ignore abstract implementations of IMessagePackFormatter<T>
  • #​2012: MsgPack004 Analyzer triggering on not attributed private property on base class eventhough source generator shouldn't include private properties
  • #​2017: MsgPack013 should not report diagnostics on abstract classes
  • #​2021: Add scoped modifier to in parameters of ref struct
  • #​2016: Avoid collecting members when it doesn't have [Key]
  • #​2005: custom formatters code source generator error

Others

  • #​2032: Use simpler C# syntax for nullable value types

3.0.214-rc.1

Changes:

  • #​2015: Use a collision-resistant hash algorithm for untrusted data to address GHSA-4qm4-8hg2-g2xm
  • #​2009: Build nuget package with semver v2

This list of changes was auto generated.

3.0.208-rc.1

Breaking changes

Enhancements

Fixes

Other changes

New Contributors

3.0.134-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.129-beta...v3.0.134-beta

3.0.129-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.111-alpha...v3.0.129-beta

3.0.111-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.54-alpha...v3.0.111-alpha

3.0.54-alpha

What's Changed

High level

  • mpc tool is gone. We use roslyn source generators now.
  • Source generation is enabled by default. At runtime MessagePack v3 will look for these source generated formatters and avoid generating them dynamically if found.

Pull requests

New Contributors

... (truncated)

3.0.3

See our migration guide.
Details blog article

What's new

  • AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.
  • AOT source generation is hugely improved.
    • Support most or all of the data types that DynamicObjectResolver supported.
    • Support for serializing private members.
  • [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate.
  • Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.
  • Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute].
  • New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.

Unity

  • Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

2.6.100-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.6.95-alpha...v2.6.100-alpha

2.6.95-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v2.5.108...v2.6.95-alpha

2.5.302

This is a merge release, combining the security fix from the https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.205 release with the several security fixes from the https://github.com/MessagePack-CSharp/MessagePack-CSharp/releases/tag/v2.5.301 release.

Commits viewable in compare view.

Updated MessagePack.Annotations from 2.5.301 to 3.1.7.

Release notes

Sourced from MessagePack.Annotations's releases.

3.1.7

What's Changed

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes

Moderage severity advisory fixes

Fixes with no security advisory

  • fb0fe9f0 Honor TypeFormatter options hooks for CWE-470
  • c1c06a6f Fix WriteRawX methods to advance by written length
  • 46c6a0fe Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

3.1.6

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

3.1.5

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

3.1.4

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

3.1.3

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

3.1.2

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

3.1.1

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

3.1.0

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

3.0.301

Note

Tag and Unity's version is 3.0.301 but published NuGet version is 3.0.308.
The version mismatch due to release process inconsistencies will be fixed in the next release.

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.300...v3.0.301

3.0.300

Fixed version, release notes see v3.0.3.

3.0.238-rc.1

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.233-rc.1...v3.0.238-rc.1

3.0.233-rc.1

Changes

Enhancements

  • #​2013: Secure by default

Fixes

  • #​2031: Use generic type argument used for custom formatters
  • #​2029: Apply scoped in more places
  • #​2030: Support nesting formatters within generic data types
  • #​2024: Source code generation fails for generic type with private member serialization
  • #​2028: Avoid collecting fields with custom formatter recusively
  • #​2023: Suppress MsgPack004 on private base members when only public is interesting
  • #​2022: Ignore abstract implementations of IMessagePackFormatter<T>
  • #​2012: MsgPack004 Analyzer triggering on not attributed private property on base class eventhough source generator shouldn't include private properties
  • #​2017: MsgPack013 should not report diagnostics on abstract classes
  • #​2021: Add scoped modifier to in parameters of ref struct
  • #​2016: Avoid collecting members when it doesn't have [Key]
  • #​2005: custom formatters code source generator error

Others

  • #​2032: Use simpler C# syntax for nullable value types

3.0.214-rc.1

Changes:

  • #​2015: Use a collision-resistant hash algorithm for untrusted data to address GHSA-4qm4-8hg2-g2xm
  • #​2009: Build nuget package with semver v2

This list of changes was auto generated.

3.0.208-rc.1

Breaking changes

Enhancements

Fixes

Other changes

New Contributors

3.0.134-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.129-beta...v3.0.134-beta

3.0.129-beta

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.111-alpha...v3.0.129-beta

3.0.111-alpha

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.54-alpha...v3.0.111-alpha

3.0.54-alpha

What's Changed

High level

  • mpc tool is gone. We use roslyn source generators now.
  • Source generation is enabled by default. At runtime MessagePack v3 will look for these source generated formatters and avoid generating them dynamically if found.

Pull requests

New Contributors

... (truncated)

3.0.3

See our migration guide.
Details blog article

What's new

  • AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.
  • AOT source generation is hugely improved.
    • Support most or all of the data types that DynamicObjectResolver supported.
    • Support for serializing private members.
  • [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate.
  • Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.
  • Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute].
  • New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.

Unity

  • Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

Description has been truncated

@dependabot
chore(deps): Bump the nuget-dependencies group with 2 updates
eef68ea 
Bumps MessagePack from 2.5.301 to 3.1.7
Bumps MessagePack.Annotations from 2.5.301 to 3.1.7

---
updated-dependencies:
- dependency-name: MessagePack
  dependency-version: 3.1.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
- dependency-name: MessagePack.Annotations
  dependency-version: 3.1.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: nuget-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot requested a review from JerrettDavis as a code owner June 16, 2026 01:59
@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Test Results

118 tests  ±0   118 ✅ ±0   5s ⏱️ ±0s
  2 suites ±0     0 💤 ±0 
  2 files   ±0     0 ❌ ±0 

Results for commit eef68ea. ± Comparison against base commit 3e80569.

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

🔍 PR Validation Results

Version: 0.0.0-g3c2d3a8433

📦 Detected NuGet Packages (17)

  • Demo.JsonApi
  • Demo.SoapApi
  • QuickApiMapper.Application
  • QuickApiMapper.Behaviors
  • QuickApiMapper.Contracts
  • QuickApiMapper.CustomTransformers
  • QuickApiMapper.Extensions.RabbitMQ
  • QuickApiMapper.Extensions.ServiceBus
  • QuickApiMapper.Extensions.gRPC
  • QuickApiMapper.Management.Contracts
  • QuickApiMapper.MessageCapture.Abstractions
  • QuickApiMapper.MessageCapture.InMemory
  • QuickApiMapper.Persistence.Abstractions
  • QuickApiMapper.Persistence.PostgreSQL
  • QuickApiMapper.Persistence.SQLite
  • QuickApiMapper.StandardTransformers
  • QuickApiMapper.Tools.Migrator

🚀 Detected Executables (2)

  • QuickApiMapper.Host.AppHost
  • QuickApiMapper.Tools.Migrator

✅ Validation Steps

  • Build solution
  • Run unit tests
  • Run integration tests
  • Dry-run NuGet packaging
  • Dry-run executable publishing

📊 Artifacts

Dry-run artifacts have been uploaded and will be available for 7 days.

This comment was automatically generated by the PR validation workflow.

@JerrettDavis JerrettDavis merged commit aebcab0 into main Jun 16, 2026
7 checks passed
@JerrettDavis JerrettDavis deleted the dependabot/nuget/nuget-dependencies-97536be51c branch June 16, 2026 02:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JerrettDavis JerrettDavis Awaiting requested review from JerrettDavis JerrettDavis is a code owner

Assignees

No one assigned

Labels

dependencies size/xs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JerrettDavis