From 0cf46e14d7e7a90f6b05fc521d4f2d3af12bba86 Mon Sep 17 00:00:00 2001
From: wd357dui <wd357dui@gmail.com>
Date: Mon, 9 Nov 2026 04:41:15 +0800
Subject: [PATCH] fix(server): upgrade MessagePack to 3.1.12 from 2.5.302 to
 remediate GHSA-qhrr-8q5h-9q3h

A previous fix pins MessagePack version to 2.5.302, which remediates GHSA-hv8m-jj95-wg3x (high severity, NU1903), but version 2.5.302 now has GHSA-qhrr-8q5h-9q3h (moderate severity, NU1902), which still fails restore/build. This fix upgrades MessagePack to the newest 3.1.12, which fixes the problem.
---
 .../CodingWithCalvin.MCPServer.Server.csproj                    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/CodingWithCalvin.MCPServer.Server/CodingWithCalvin.MCPServer.Server.csproj b/src/CodingWithCalvin.MCPServer.Server/CodingWithCalvin.MCPServer.Server.csproj
index 430eee7..b6db853 100644
--- a/src/CodingWithCalvin.MCPServer.Server/CodingWithCalvin.MCPServer.Server.csproj
+++ b/src/CodingWithCalvin.MCPServer.Server/CodingWithCalvin.MCPServer.Server.csproj
@@ -20,7 +20,7 @@
     <PackageReference Include="StreamJsonRpc" Version="2.20.20" />
     <!-- Pin MessagePack above the transitive 2.5.187 pulled in by StreamJsonRpc to
          remediate GHSA-hv8m-jj95-wg3x (high severity, NU1903). -->
-    <PackageReference Include="MessagePack" Version="2.5.302" />
+    <PackageReference Include="MessagePack" Version="3.1.12" />
   </ItemGroup>
 
   <ItemGroup>