Awesome/awesome-copilot
1
0
Fork 0
mirror of https://github.com/github/awesome-copilot.git synced 2026-08-25 18:25:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

dotnet-mcp-builder: pin sample dependency versions (#2699)

Browse Source 
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).

Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
This commit is contained in:
jeanpaulhassane-225
2026-08-21 02:19:47 +00:00
committed by GitHub
parent 927c1b5b38
commit 89e85e6060
5 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/dotnet-mcp-builder/references/mcp-apps.md
+1 -1
View File
@@ -147,7 +147,7 @@ A minimum viable bundle: vanilla JS using `@modelcontextprotocol/ext-apps`. The
<body>
<div id="root">Loading…</div>
<script type="module">
import { App } from "https://esm.sh/@modelcontextprotocol/ext-apps@1";
import { App } from "https://esm.sh/@modelcontextprotocol/ext-apps@1.7.5";
const app = new App();
await app.connect();