Visitar URL original
Bump MessagePack from 3.1.9 to 3.1.12 by dependabot[bot] · Pull Request #11 · cedric56/Queryeables · GitHub
Skip to content

Bump MessagePack from 3.1.9 to 3.1.12 - #11

Merged
cedric56 merged 1 commit into
masterfrom
dependabot/nuget/MessagePack-3.1.12
Nov 12, 2026
Merged

Bump MessagePack from 3.1.9 to 3.1.12#11
cedric56 merged 1 commit into
masterfrom
dependabot/nuget/MessagePack-3.1.12

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Updated MessagePack from 3.1.9 to 3.1.12.

Release notes

Sourced from MessagePack's releases.

3.1.12

What's Changed

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.11...v3.1.12

3.1.11

Security fix

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.10...v3.1.11

3.1.10

Security fix

Other fixes

New Contributors

Full Changelog: MessagePack-CSharp/MessagePack-CSharp@v3.1.9...v3.1.10

Commits viewable in compare view.

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

  • Chores
    • Updated an internal component; no user-facing changes.

@dependabot
Bump MessagePack from 3.1.9 to 3.1.12
b8abde5 
---
updated-dependencies:
- dependency-name: MessagePack
  dependency-version: 3.1.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 10, 2026
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

No actionable comments were generated in the recent review.

Walkthrough

The centrally managed MessagePack package version changes from 3.1.9 to 3.1.12.

Changes: MessagePack package update

Layer / File(s) Summary
Update central package version
Directory.Packages.props		 The centrally managed MessagePack package version changes from 3.1.9 to 3.1.12.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested labels: dependencies, .NET

Suggested reviewers: cedric56

Merge Risk: Minimal · up to b8abd

The update has no identified merge-blocking issue; normal build and serializer checks remain appropriate.

Security architecture risk: Low · up to b8abd

The update preserves the server’s configured untrusted-data protections and normal serializer selection. No introduced security weakness was identified, but the upgraded library’s behavior on malformed input remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • observed — The updated dependency supplies serialization and deserialization for Queryeables.Onion, including the server path that reads client-supplied entity bytes. The supplied evidence does not establish deployment-wide or tenant-specific exposure.

Trust Boundaries and Controls

  • observed — The standard MagicOnion server registration selects the hardened Server serializer, while client registration selects Default. The lower-level AddEntityServer API accepts a caller-supplied serializer, so hardening is not universally enforced by that API. These registration properties predate this PR; no increased exposure was identified.

Resilience and Maintainability Implications

  • observed — The shown request path converts non-cancellation exceptions into failure results and hides unexpected errors at dispatch. This bounds ordinary exception handling, but does not establish MessagePack 3.1.12’s exact malformed-input exceptions or resource-exhaustion behavior.
Pre-merge checks: Passed 5

Check name Status Explanation
Title check Passed The title clearly and concisely identifies the MessagePack version update, which is the main change.
Description check Passed The description explains the version update and includes release notes that give context for the change. It omits the template’s checklist section, but the description is otherwise complete.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Recent review info

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 7478b45e-2e63-4dd6-8df0-918052fe2e54
Commits

Reviewing files that changed from the base of the PR and between b3c11a2 and b8abde5.

Files selected for processing: 1

  • Directory.Packages.props

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

@cedric56
cedric56 merged commit 7b6605f into master Nov 12, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cedric56