Skip to content

Resolve NuGet security advisories + upgrade ModelContextProtocol to 1.4.0 #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rockfordlhotka wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Resolve NuGet security advisories + upgrade ModelContextProtocol to 1.4.0 #485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4361b28
Resolve NuGet security advisories (MessagePack, Nerdbank.MessagePack,…
rockfordlhotka Jun 18, 2026
04c1c2c
Upgrade ModelContextProtocol 0.8.0-preview.1 -> 1.4.0
rockfordlhotka Jun 18, 2026
b57f996
Bump version to 0.14.0
rockfordlhotka Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Directory.Build.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
<!-- Version can be overridden from the command line: -p:Version=0.3.1
AssemblyVersion and FileVersion are derived automatically by the SDK
(prerelease suffixes like -beta001 are stripped for assembly versions). -->
<Version>0.13.1</Version>
<Version>0.14.0</Version>
</PropertyGroup>

<!-- NuGet package metadata (shared across all packable projects) -->
Expand Down
2 changes: 1 addition & 1 deletion src/McpServer.Introspection/McpServer.Introspection.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="0.8.0-preview.1" />
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="1.4.0" />
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion src/McpServer.OpenRouter/McpServer.OpenRouter.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="0.8.0-preview.1" />
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="1.4.0" />
</ItemGroup>

</Project>
2 changes: 1 addition & 1 deletion src/McpServer.TodoApp/McpServer.TodoApp.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="0.8.0-preview.1" />
<PackageReference Include="ModelContextProtocol.AspNetCore" Version="1.4.0" />
</ItemGroup>

</Project>
7 changes: 6 additions & 1 deletion src/RockBot.Agent/RockBot.Agent.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,12 @@
<PackageReference Include="Microsoft.Extensions.AI.OpenAI" Version="10.3.0" />
<PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.*" />
<PackageReference Include="Microsoft.Identity.Client" Version="4.*" />
<PackageReference Include="ModelContextProtocol" Version="0.8.0-preview.1" />
<PackageReference Include="ModelContextProtocol" Version="1.4.0" />
<!-- Transitive pins: override the vulnerable MessagePack/Nerdbank.MessagePack pulled in via
RockBot.Llm.Copilot -> GitHub.Copilot.SDK -> StreamJsonRpc
(GHSA-hv8m-jj95-wg3x, GHSA-2cwq-pwfr-wcw3, GHSA-92vj-hp7m-gwcj, GHSA-qjvr-435c-5fjh). -->
<PackageReference Include="MessagePack" Version="2.5.302" />
<PackageReference Include="Nerdbank.MessagePack" Version="1.2.4" />
</ItemGroup>

<ItemGroup>
Expand Down
4 changes: 4 additions & 0 deletions src/RockBot.Llm.Copilot/RockBot.Llm.Copilot.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@
<PackageReference Include="GitHub.Copilot.SDK" Version="0.2.0" />
<PackageReference Include="Microsoft.Extensions.AI.Abstractions" Version="10.*" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.*" />
<!-- Transitive pins: override GitHub.Copilot.SDK/StreamJsonRpc's vulnerable MessagePack/Nerdbank.MessagePack
(GHSA-hv8m-jj95-wg3x, GHSA-2cwq-pwfr-wcw3, GHSA-92vj-hp7m-gwcj, GHSA-qjvr-435c-5fjh). -->
<PackageReference Include="MessagePack" Version="2.5.302" />
<PackageReference Include="Nerdbank.MessagePack" Version="1.2.4" />
</ItemGroup>

</Project>
2 changes: 1 addition & 1 deletion src/RockBot.Scripts.Container/RockBot.Scripts.Container.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="KubernetesClient" Version="16.*" />
<PackageReference Include="KubernetesClient" Version="17.*" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.*" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.*" />
</ItemGroup>
Expand Down
4 changes: 2 additions & 2 deletions src/RockBot.Tools.Mcp/McpToolExecutor.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,8 +78,8 @@ public async Task<ToolInvokeResponse> ExecuteAsync(ToolInvokeRequest request, Ca
blocks.Add(block switch
{
TextContentBlock text => new ToolContentBlock { Type = "text", Text = text.Text },
ImageContentBlock img => new ToolContentBlock { Type = "image", Data = img.Data, MimeType = img.MimeType },
AudioContentBlock audio => new ToolContentBlock { Type = "audio", Data = audio.Data, MimeType = audio.MimeType },
ImageContentBlock img => new ToolContentBlock { Type = "image", Data = Convert.ToBase64String(img.Data.Span), MimeType = img.MimeType },
AudioContentBlock audio => new ToolContentBlock { Type = "audio", Data = Convert.ToBase64String(audio.Data.Span), MimeType = audio.MimeType },
Comment on lines +81 to +82
_ => new ToolContentBlock { Type = block.Type ?? "unknown", Text = $"[{block.Type ?? "unknown"} content block]" }
});
}
Expand Down
2 changes: 1 addition & 1 deletion src/RockBot.Tools.Mcp/RockBot.Tools.Mcp.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.*" />
<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.*" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.*" />
<PackageReference Include="ModelContextProtocol" Version="0.8.0-preview.1" />
<PackageReference Include="ModelContextProtocol" Version="1.4.0" />
</ItemGroup>

<ItemGroup>
Expand Down
2 changes: 1 addition & 1 deletion tests/RockBot.Scripts.Tests/RockBot.Scripts.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
<PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.0.*" />
<PackageReference Include="Microsoft.Extensions.Logging" Version="10.0.*" />
<PackageReference Include="Docker.DotNet" Version="3.*" />
<PackageReference Include="KubernetesClient" Version="16.*" />
<PackageReference Include="KubernetesClient" Version="17.*" />
</ItemGroup>

<ItemGroup>
Expand Down
5 changes: 3 additions & 2 deletions tests/RockBot.Tools.Tests/McpToolExecutorTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,20 +240,21 @@ public void MapContentBlocks_ExtractsTextContent()
[TestMethod]
public void MapContentBlocks_PreservesImageContent()
{
var imageBytes = new byte[] { 0xDE, 0xAD, 0xBE, 0xEF };
var result = new CallToolResult
{
Content =
[
new TextContentBlock { Text = "Here is an image:" },
new ImageContentBlock { Data = "abc123", MimeType = "image/png" }
new ImageContentBlock { Data = imageBytes, MimeType = "image/png" }
]
};
var blocks = McpToolExecutor.MapContentBlocks(result);
Assert.IsNotNull(blocks);
Assert.AreEqual(2, blocks.Count);
Assert.AreEqual("text", blocks[0].Type);
Assert.AreEqual("image", blocks[1].Type);
Assert.AreEqual("abc123", blocks[1].Data);
Assert.AreEqual(Convert.ToBase64String(imageBytes), blocks[1].Data);
Assert.AreEqual("image/png", blocks[1].MimeType);
// TextFromBlocks only returns text parts
Assert.AreEqual("Here is an image:", McpToolExecutor.TextFromBlocks(blocks));
Expand Down
Loading