Awesome/awesome-copilot
1
0
Fork 0
mirror of https://github.com/github/awesome-copilot.git synced 2026-08-25 02:11:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

dotnet-mcp-builder: pin sample dependency versions (#2699)

Browse Source 
The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an
unpinned major-version tag (@1), which Snyk flags as an unverifiable
external dependency / third-party content exposure risk (indirect
prompt-injection surface, since the imported module can call
app.updateModelContext and app.callServerTool). Pin it to the current
release (1.7.5).

Also pin the sample `dotnet add package` commands for the
ModelContextProtocol* and Microsoft.Extensions.Hosting packages to
their current exact versions (2.2.0 / 10.0.11), and correct a stale
"2.0.0 is current" note in packages.md.
This commit is contained in:
jeanpaulhassane-225
2026-08-21 02:19:47 +00:00
committed by GitHub
parent 927c1b5b38
commit 89e85e6060
5 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/dotnet-mcp-builder/references/transport-http.md
+1 -1
View File
@@ -18,7 +18,7 @@ For local single-user scenarios, [STDIO](./transport-stdio.md) is simpler.
```bash
dotnet new web -n MyHttpServer -f net10.0
cd MyHttpServer
dotnet add package ModelContextProtocol.AspNetCore
dotnet add package ModelContextProtocol.AspNetCore --version 2.2.0
```
```csharp