From a81798cffe4023a720fd648842f88421d59dc358 Mon Sep 17 00:00:00 2001
From: James Wampler <james@wamp.dev>
Date: Thu, 2 Jul 2026 13:01:37 -0700
Subject: [PATCH] Pin MessagePack to patched 2.5.302 in AppHost

Aspire.Hosting.PostgreSQL/JavaScript pull in MessagePack 2.5.192
transitively, which has multiple known vulnerabilities and fails the
build with TreatWarningsAsErrors. Pinned a direct reference to the
patched 2.5.302 (same major, no API break).
---
 src/MicCheck.AppHost/MicCheck.AppHost.csproj | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/MicCheck.AppHost/MicCheck.AppHost.csproj b/src/MicCheck.AppHost/MicCheck.AppHost.csproj
index 6de3e45..b5c1bb8 100755
--- a/src/MicCheck.AppHost/MicCheck.AppHost.csproj
+++ b/src/MicCheck.AppHost/MicCheck.AppHost.csproj
@@ -8,6 +8,7 @@
   <ItemGroup>
     <PackageReference Include="Aspire.Hosting.JavaScript" Version="13.4.2" />
     <PackageReference Include="Aspire.Hosting.PostgreSQL" Version="13.4.0" />
+    <PackageReference Include="MessagePack" Version="2.5.302" />
   </ItemGroup>
 
   <PropertyGroup>