[niemyjski]

The AppHost sample resolves MessagePack 2.5.302 through Aspire and emits NU1902 for GHSA-qhrr-8q5h-9q3h. Pin the patched 2.5.303 release in this non-packable sample so the dependency correction can be reviewed separately from #570.

Validation: sample Release build passed with only the existing ASPIRE010 warning; the transitive vulnerability audit reported no affected packages. The unpatched main sample reproduced NU1902 as a warning. PR CI and push CI passed at fcabda84.

Verification and implementation details

Base: main be10785cfed4e1850350dfaa024e1c3f25b7fac7. Head: fcabda84.

This is the one-line correction already present in #570 as d2c24efd, extracted into an independent PR. Merge this dependency correction first, then refresh #570 so its dependency diff disappears. The shipped serializer package already uses MessagePack 3.1.12.

The advisory lists 2.5.303 and 3.1.9 as patched releases. The sample's direct pin upgrades its existing 2.x transitive dependency without changing major versions or suppressing the warning.

Reproducible checks:

dotnet build samples/Foundatio.AppHost/Foundatio.AppHost.csproj -c Release
dotnet list samples/Foundatio.AppHost/Foundatio.AppHost.csproj package --vulnerable --include-transitive
git diff --check

The analogous RabbitMQ test-AppHost pin remains separate provider work; this PR does not claim that unmodified provider source builds. No workflow, library API, or runtime default changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T04:07:03.707008Z	fcabda8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.