From 5469408944c4800b3c87922823d5202389f59558 Mon Sep 17 00:00:00 2001
From: Rhys Bevilaqua <rhys.bevilaqua@particular.net>
Date: Mon, 19 Oct 2026 11:17:36 +0800
Subject: [PATCH] Pin pacakge in test project to avoid CVE

---
 .../testing-tool/TestingTool.AppHost/TestingTool.AppHost.csproj  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/testing-tool/TestingTool.AppHost/TestingTool.AppHost.csproj b/tools/testing-tool/TestingTool.AppHost/TestingTool.AppHost.csproj
index 36bc67fa14..16769d8545 100644
--- a/tools/testing-tool/TestingTool.AppHost/TestingTool.AppHost.csproj
+++ b/tools/testing-tool/TestingTool.AppHost/TestingTool.AppHost.csproj
@@ -20,6 +20,7 @@
   </ItemGroup>
 
   <ItemGroup Label="Direct references to transitive dependencies to avoid versions with CVE">
+    <PackageReference Include="MessagePack" Version="2.5.303" />
     <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>