From 5f288c085c491814ac1169af01e6301610e4126e Mon Sep 17 00:00:00 2001 From: jeanpaulhassane-225 Date: Tue, 18 Aug 2026 00:09:38 +0000 Subject: [PATCH] dotnet-mcp-builder: pin sample dependency versions The MCP Apps sample HTML bundle imported ext-apps from esm.sh using an unpinned major-version tag (@1), which Snyk flags as an unverifiable external dependency / third-party content exposure risk (indirect prompt-injection surface, since the imported module can call app.updateModelContext and app.callServerTool). Pin it to the current release (1.7.5). Also pin the sample `dotnet add package` commands for the ModelContextProtocol* and Microsoft.Extensions.Hosting packages to their current exact versions (2.2.0 / 10.0.11), and correct a stale "2.0.0 is current" note in packages.md. --- skills/dotnet-mcp-builder/references/client.md | 4 ++-- skills/dotnet-mcp-builder/references/mcp-apps.md | 2 +- skills/dotnet-mcp-builder/references/packages.md | 10 +++++----- skills/dotnet-mcp-builder/references/transport-http.md | 2 +- .../dotnet-mcp-builder/references/transport-stdio.md | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/skills/dotnet-mcp-builder/references/client.md b/skills/dotnet-mcp-builder/references/client.md index ee114dd05e..f6c8d00c3c 100644 --- a/skills/dotnet-mcp-builder/references/client.md +++ b/skills/dotnet-mcp-builder/references/client.md @@ -7,9 +7,9 @@ For just *running* a server, ignore this file. ## Packages ```bash -dotnet add package ModelContextProtocol.Core # minimal: just client + transports +dotnet add package ModelContextProtocol.Core --version 2.2.0 # minimal: just client + transports # or -dotnet add package ModelContextProtocol # adds DI/hosting helpers +dotnet add package ModelContextProtocol --version 2.2.0 # adds DI/hosting helpers ``` ## Connecting via STDIO (launching a server process) diff --git a/skills/dotnet-mcp-builder/references/mcp-apps.md b/skills/dotnet-mcp-builder/references/mcp-apps.md index e045346563..59ae6291db 100644 --- a/skills/dotnet-mcp-builder/references/mcp-apps.md +++ b/skills/dotnet-mcp-builder/references/mcp-apps.md @@ -147,7 +147,7 @@ A minimum viable bundle: vanilla JS using `@modelcontextprotocol/ext-apps`. The
Loading…