Aspire 13.6.2 released with MessagePack pinned for security fixes

Microsoft has released Aspire 13.6.2, a patch on the 13.6 line. The main change pins the MessagePack dependency to 2.5.307 to pick up security fixes. Because the release is maintenance-focused, it is a low-effort upgrade for Aspire developers, but the dependency pin is worth checking in your own projects.

Key points

• Aspire 13.6 line moves to the 13.6.2 patch release.
• MessagePack is pinned to 2.5.307 to pick up security fixes.
• Check indirect MessagePack references with dotnet list package --include-transitive.
• The notes list no feature changes, so the upgrade is a low-risk patch.

Microsoft shipped Aspire 13.6.2 on October 20, 2026, as a servicing release for the 13.6 line. The headline change is a security update: the MessagePack dependency is now pinned to version 2.5.307, which includes fixes for known security issues. The version number was bumped as part of the same release, so this is mainly a maintenance drop rather than a feature release.

For most teams, the upgrade is routine: move your Aspire packages to 13.6.2 and confirm which MessagePack version your project resolves, since MessagePack often arrives as an indirect dependency and the pin decides what gets used. The release notes list only these two changes, so no behavior shifts are expected. Still, it is worth reading the full commit details on the original release page before rolling the update into production.

Real-world use

• An ASP.NET Core service orchestrated by Aspire that needs the latest security patches in its dependency graph.
• A team auditing transitive NuGet packages in a solution before a production release.

Why it matters

If your Aspire app pulls MessagePack indirectly, updating gives you the patched version now, so schedule it as routine maintenance instead of waiting for a feature release.

Related stories

• A secure enterprise chat with React, .NET 10 and Microsoft FoundryDVDEV Community: #dotnet1 d ago
• ASP.NET Core Authentication & Authorization Explained: What to Use, When, and How to Ship It SafelyDVDEV Community: #aspnetcore1 d ago
• Mastering Rate Limiting and Resource Governance for MCP Servers at ScaleDVDEV Community: #aspnetcore1 d ago