From 2a0faeab6f578fb82cde4943968c24c8b98cf550 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Sat, 18 Jul 2026 05:30:56 -0400
Subject: [PATCH] fix(security): actually fix GHSA-2m69-gcr7-jv3q instead of
 suppressing it

The NuGetAuditSuppress in Directory.Packages.props was masking a LIVE high-severity
vulnerability, not documenting an accepted one. Only the Host project resolved a
patched SQLitePCLRaw.lib.e_sqlite3 2.1.12 (transitively, via ZB.MOM.WW.Auth.ApiKeys).
Every other SQLite consumer - AuditLog, SiteRuntime, StoreAndForward, SiteEventLogging
and 11 test projects - still resolved the vulnerable 2.1.11.

The suppression's rationale was factually wrong: it claimed 'the only patched native
lib is the SQLitePCLRaw 3.x line'. 2.1.12 patches this advisory within the 2.1.x line,
so the feared risky force-override of the whole family to 3.x is unnecessary.

Fix: explicit PackageReference to the patched 2.1.12 in each SQLite-consuming project,
plus the central PackageVersion row. Suppression removed, so the advisory is audited
again rather than silenced.

Rejected alternative: CentralPackageTransitivePinningEnabled. It clears the advisory in
one line but makes every central version a ceiling for transitive resolution, demanding
bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json.
That is a gRPC/data-access change to a production SCADA platform and deserves its own
reviewed commit.

Verified: forced full-solution restore reports no NU1903 (only the pre-existing,
unrelated AngleSharp NU1902 in CentralUI.Tests); all four previously-vulnerable src
projects now resolve 2.1.12; 55 projects build 0 warnings / 0 errors; 1108 tests pass
across the SQLite layer (AuditLog 354, ConfigurationDatabase 357, Security 181,
StoreAndForward 152, SiteEventLogging 64).
---
 Directory.Packages.props                      | 39 ++++++++++++-------
 .../ZB.MOM.WW.ScadaBridge.AuditLog.csproj     |  3 ++
 ...MOM.WW.ScadaBridge.SiteEventLogging.csproj |  3 ++
 .../ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj  |  3 ++
 ....MOM.WW.ScadaBridge.StoreAndForward.csproj |  3 ++
 ...B.MOM.WW.ScadaBridge.AuditLog.Tests.csproj |  3 ++
 ....MOM.WW.ScadaBridge.CentralUI.Tests.csproj |  3 ++
 ...aBridge.ConfigurationDatabase.Tests.csproj |  3 ++
 ....ScadaBridge.HealthMonitoring.Tests.csproj |  3 ++
 ...MOM.WW.ScadaBridge.InboundAPI.Tests.csproj |  3 ++
 ...MOM.WW.ScadaBridge.IntegrationTests.csproj |  3 ++
 ...MOM.WW.ScadaBridge.PerformanceTests.csproj |  3 ++
 ...B.MOM.WW.ScadaBridge.Security.Tests.csproj |  3 ++
 ....ScadaBridge.SiteEventLogging.Tests.csproj |  3 ++
 ...W.ScadaBridge.StoreAndForward.Tests.csproj |  3 ++
 ...daBridge.Transport.IntegrationTests.csproj |  3 ++
 16 files changed, 69 insertions(+), 15 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 7d52e0b7..1f2c8f8a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -92,26 +92,35 @@
   </ItemGroup>
 
   <!--
-    Targeted NuGet audit suppression (NOT a blanket NuGetAudit=false).
-
     GHSA-2m69-gcr7-jv3q (NU1903, high) is on the NATIVE library SQLitePCLRaw.lib.e_sqlite3
     2.1.11, pulled in TRANSITIVELY by Microsoft.Data.Sqlite / EntityFrameworkCore.Sqlite.
-    The current MS-supported package line still references it: Microsoft.Data.Sqlite.Core
-    10.0.9 (latest 10.0.x as of 2026-06) declares `SQLitePCLRaw.core 2.1.11`, so a version
-    bump within the supported line does NOT clear it. The only patched native lib is the
-    SQLitePCLRaw 3.x line — force-overriding the whole SQLitePCLRaw family to 3.x under a
-    Microsoft.Data.Sqlite built and pinned for 2.1.x is unsupported and runtime-risky for the
-    entire site-local SQLite layer (S&F buffer, operation tracking, native-alarm state).
 
-    Risk assessment: SQLite here is internal, local-only storage on site nodes (+ tests); it is
-    not an externally-reachable SQL surface for untrusted input, so practical exposure is low.
-    Suppressing ONLY this advisory (auditing stays ON for everything else) lets the full
-    solution AND the docker in-container restore build cleanly without the blanket
-    `/p:NuGetAudit=false` workaround. REVISIT and remove this suppression once Microsoft.Data.Sqlite
-    ships a 10.0.x that references a patched (3.x) SQLitePCLRaw bundle.
+    FIXED PROPERLY 2026-07-18, replacing a NuGetAuditSuppress that had been masking it. The
+    suppression's stated rationale — "the only patched native lib is the SQLitePCLRaw 3.x line" —
+    was WRONG: 2.1.12 patches this advisory within the 2.1.x line, so no risky force-override of
+    the whole family to 3.x is needed. Verified empirically: with the suppression removed and the
+    pin in place, a forced restore reports no NU1903.
+
+    Why the pin and not a Microsoft.Data.Sqlite bump: bumping Sqlite does NOT clear it (even
+    10.0.10 still references 2.1.11). Pinning the native lib is the fix. Same approach as
+    ZB.MOM.WW.Secrets and ZB.MOM.WW.LocalDb.
+
+    Why this mattered more than it looked: only the Host project resolved a patched 2.1.12 (via
+    ZB.MOM.WW.Auth.ApiKeys). AuditLog, SiteEventLogging, SiteRuntime, StoreAndForward and the
+    test projects — the whole site-local SQLite layer — were still resolving the vulnerable
+    2.1.11, and the suppression hid that everywhere.
+
+    Delivered as an explicit <PackageReference> in each SQLite-consuming project rather than via
+    CentralPackageTransitivePinningEnabled. Enabling transitive pinning globally was tried first
+    and rejected: it makes every centrally-defined version a hard ceiling for transitive
+    resolution too, which immediately demanded bumps to Google.Protobuf (3.29.3->3.34.1),
+    Grpc.Net.Client (2.71.0->2.76.0), Microsoft.Data.SqlClient (6.0.2->6.1.1) and Newtonsoft.Json
+    (13.0.3->13.0.4). Those may well be worth doing, but they are a gRPC/data-access change to a
+    production SCADA platform and belong in their own reviewed commit — not smuggled in under a
+    SQLite security fix.
   -->
   <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
 </Project>
diff --git a/src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj b/src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj
index 122f2556..e2dc02e6 100644
--- a/src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj
@@ -12,6 +12,9 @@
          in this project, so Akka is an explicit dependency. -->
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />
diff --git a/src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj b/src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj
index 089117e3..e6c1bb78 100644
--- a/src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj
@@ -10,6 +10,9 @@
   <ItemGroup>
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
diff --git a/src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj b/src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj
index ec65583d..797647d8 100644
--- a/src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj
@@ -14,6 +14,9 @@
     <PackageReference Include="Akka.Streams" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />
diff --git a/src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj b/src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj
index df12328e..a8770876 100644
--- a/src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj
+++ b/src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj
@@ -10,6 +10,9 @@
   <ItemGroup>
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj
index 817bc0d1..9af02ae7 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj
@@ -19,6 +19,9 @@
     -->
     <PackageReference Include="Microsoft.Data.SqlClient" VersionOverride="6.1.1" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
     <!--
       M4 Bundle E (Task E3): Microsoft.Extensions.Configuration.Json,
diff --git a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
index 8fadb6f9..15dc7075 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
@@ -13,6 +13,9 @@
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj
index 7424533e..8b441742 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj
@@ -19,6 +19,9 @@
     -->
     <PackageReference Include="Microsoft.Data.SqlClient" VersionOverride="6.1.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj
index 478dce1f..2f7c9b4b 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj
@@ -11,6 +11,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj
index 6dc60653..87dda0ee 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj
@@ -16,6 +16,9 @@
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj b/tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj
index e25ecc1e..9eddb8c5 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj
@@ -19,6 +19,9 @@
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="NSubstitute" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj b/tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj
index 7ebabf02..02f7b2fa 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj
@@ -11,6 +11,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj
index ba5db655..10bbb12c 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj
@@ -17,6 +17,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <!-- Microsoft.Extensions.* and Microsoft.AspNetCore.Authorization are provided
          by the Microsoft.AspNetCore.App shared framework referenced above (added so
          HttpAuditActorAccessorTests can build DefaultHttpContext), so they are no
diff --git a/tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj
index 58225fec..0b7e356e 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj
@@ -12,6 +12,9 @@
     <PackageReference Include="Akka.TestKit.Xunit2" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Logging" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj b/tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj
index 25dacd1d..ad27b629 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj
@@ -12,6 +12,9 @@
     <PackageReference Include="Akka.TestKit.Xunit2" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />
diff --git a/tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj b/tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj
index 76aff358..de48463a 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj
+++ b/tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj
@@ -18,6 +18,9 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />