Skip to content

Update dependency MessagePack to v3 - #1714

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-messagepack-csharp
Closed

Update dependency MessagePack to v3#1714
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-messagepack-csharp

Conversation

@renovate

@renovate renovate Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
MessagePack 2.5.305 → 3.1.11 age confidence

Release Notes

MessagePack-CSharp/MessagePack-CSharp (MessagePack)

v3.1.11

Security fix

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.10...v3.1.11

v3.1.10

Security fix

Other fixes

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.9...v3.1.10

v3.1.9

What's Changed

Security fix
Other fixes

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.8...v3.1.9

v3.1.8

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.7...v3.1.8

v3.1.7

What's Changed

Security release details

This release fixes 3 high severity and 9 moderate severity security vulnerabilities.

High severity advisory fixes
Moderage severity advisory fixes
Fixes with no security advisory
  • fb0fe9f Honor TypeFormatter options hooks for CWE-470
  • c1c06a6 Fix WriteRawX methods to advance by written length
  • 46c6a0f Fix CWE-190 map header length overflow

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.6...v3.1.7

v3.1.6

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.5...v3.1.6

v3.1.5

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.4...v3.1.5

v3.1.4

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.3...v3.1.4

v3.1.3

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.2...v3.1.3

v3.1.2

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.1...v3.1.2

v3.1.1

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.0...v3.1.1

v3.1.0

What's Changed

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.0.301...v3.1.0

v3.0.300

Fixed version, release notes see v3.0.3.

v3.0.3

See our migration guide.
Details blog article

What's new

  • AOT source generation of formatters by default using roslyn source generators. mpc is no longer available. Dynamic formatters still exist (for runtimes that support them), but code that compiles against v3 are unlikely to need them, resulting in better startup performance and improved debugging experience.
  • AOT source generation is hugely improved.
    • Support most or all of the data types that DynamicObjectResolver supported.
    • Support for serializing private members.
  • [MessagePackObject] types can serialize private members without the application having to switch to DynamicObjectResolverAllowPrivate.
  • Analyzers are on by default, with many new ones to help ensure your code is correct and ready for AOT source generated formatters.
  • Custom formatters are automatically used for the data types they format when defined in the same assembly, by default. No need to attribute your data types to point to the custom formatter. Opt out by attributing the formatter with [ExcludeFormatterFromSourceGeneratedResolverAttribute].
  • New CompositeResolverAttribute offers a faster runtime alternative to the CompositeResolver class.
Unity
  • Consume through NuGetForUnity and UPM instead of through .unitypackage

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copilot AI balanced review requested due to automatic review settings October 15, 2026 17:47
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 15, 2026
@azure-pipelines

azure-pipelines Bot commented Oct 15, 2026

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI reviewed Oct 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Compatibility of the major-version dependency upgrade remains unverified.

0 open findings

What changed in this PR

Updates the centrally managed MessagePack dependency to v3, incorporating upstream security fixes and serialization changes.

Changes:

  • Upgrades MessagePack from 2.5.305 to 3.1.11.
File Description
Directory.Packages.props Updates the central MessagePack version.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@renovate

renovate Bot commented Oct 15, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate
renovate Bot deleted the renovate/major-messagepack-csharp branch October 15, 2026 17:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@AArnott