fix(security): actually fix GHSA-2m69-gcr7-jv3q instead of suppressing it

The NuGetAuditSuppress in Directory.Packages.props was masking a LIVE high-severity
vulnerability, not documenting an accepted one. Only the Host project resolved a
patched SQLitePCLRaw.lib.e_sqlite3 2.1.12 (transitively, via ZB.MOM.WW.Auth.ApiKeys).
Every other SQLite consumer - AuditLog, SiteRuntime, StoreAndForward, SiteEventLogging
and 11 test projects - still resolved the vulnerable 2.1.11.

The suppression's rationale was factually wrong: it claimed 'the only patched native
lib is the SQLitePCLRaw 3.x line'. 2.1.12 patches this advisory within the 2.1.x line,
so the feared risky force-override of the whole family to 3.x is unnecessary.

Fix: explicit PackageReference to the patched 2.1.12 in each SQLite-consuming project,
plus the central PackageVersion row. Suppression removed, so the advisory is audited
again rather than silenced.

Rejected alternative: CentralPackageTransitivePinningEnabled. It clears the advisory in
one line but makes every central version a ceiling for transitive resolution, demanding
bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json.
That is a gRPC/data-access change to a production SCADA platform and deserves its own
reviewed commit.

Verified: forced full-solution restore reports no NU1903 (only the pre-existing,
unrelated AngleSharp NU1902 in CentralUI.Tests); all four previously-vulnerable src
projects now resolve 2.1.12; 55 projects build 0 warnings / 0 errors; 1108 tests pass
across the SQLite layer (AuditLog 354, ConfigurationDatabase 357, Security 181,
StoreAndForward 152, SiteEventLogging 64).

Directory.Packages.props

@@ -92,26 +92,35 @@
   </ItemGroup>
 
   <!--
-    Targeted NuGet audit suppression (NOT a blanket NuGetAudit=false).
-
     GHSA-2m69-gcr7-jv3q (NU1903, high) is on the NATIVE library SQLitePCLRaw.lib.e_sqlite3
     2.1.11, pulled in TRANSITIVELY by Microsoft.Data.Sqlite / EntityFrameworkCore.Sqlite.
-    The current MS-supported package line still references it: Microsoft.Data.Sqlite.Core
-    10.0.9 (latest 10.0.x as of 2026-06) declares `SQLitePCLRaw.core 2.1.11`, so a version
-    bump within the supported line does NOT clear it. The only patched native lib is the
-    SQLitePCLRaw 3.x line — force-overriding the whole SQLitePCLRaw family to 3.x under a
-    Microsoft.Data.Sqlite built and pinned for 2.1.x is unsupported and runtime-risky for the
-    entire site-local SQLite layer (S&F buffer, operation tracking, native-alarm state).
 
-    Risk assessment: SQLite here is internal, local-only storage on site nodes (+ tests); it is
+    FIXED PROPERLY 2026-07-18, replacing a NuGetAuditSuppress that had been masking it. The
-    not an externally-reachable SQL surface for untrusted input, so practical exposure is low.
+    suppression's stated rationale — "the only patched native lib is the SQLitePCLRaw 3.x line" —
-    Suppressing ONLY this advisory (auditing stays ON for everything else) lets the full
+    was WRONG: 2.1.12 patches this advisory within the 2.1.x line, so no risky force-override of
-    solution AND the docker in-container restore build cleanly without the blanket
+    the whole family to 3.x is needed. Verified empirically: with the suppression removed and the
-    `/p:NuGetAudit=false` workaround. REVISIT and remove this suppression once Microsoft.Data.Sqlite
+    pin in place, a forced restore reports no NU1903.
-    ships a 10.0.x that references a patched (3.x) SQLitePCLRaw bundle.
+
+    Why the pin and not a Microsoft.Data.Sqlite bump: bumping Sqlite does NOT clear it (even
+    10.0.10 still references 2.1.11). Pinning the native lib is the fix. Same approach as
+    ZB.MOM.WW.Secrets and ZB.MOM.WW.LocalDb.
+
+    Why this mattered more than it looked: only the Host project resolved a patched 2.1.12 (via
+    ZB.MOM.WW.Auth.ApiKeys). AuditLog, SiteEventLogging, SiteRuntime, StoreAndForward and the
+    test projects — the whole site-local SQLite layer — were still resolving the vulnerable
+    2.1.11, and the suppression hid that everywhere.
+
+    Delivered as an explicit <PackageReference> in each SQLite-consuming project rather than via
+    CentralPackageTransitivePinningEnabled. Enabling transitive pinning globally was tried first
+    and rejected: it makes every centrally-defined version a hard ceiling for transitive
+    resolution too, which immediately demanded bumps to Google.Protobuf (3.29.3->3.34.1),
+    Grpc.Net.Client (2.71.0->2.76.0), Microsoft.Data.SqlClient (6.0.2->6.1.1) and Newtonsoft.Json
+    (13.0.3->13.0.4). Those may well be worth doing, but they are a gRPC/data-access change to a
+    production SCADA platform and belong in their own reviewed commit — not smuggled in under a
+    SQLite security fix.
   -->
   <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
   </ItemGroup>
 
 </Project>

src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj

@@ -12,6 +12,9 @@
          in this project, so Akka is an explicit dependency. -->
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />

src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj

@@ -10,6 +10,9 @@
   <ItemGroup>
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />

src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj

@@ -14,6 +14,9 @@
     <PackageReference Include="Akka.Streams" />
     <PackageReference Include="Microsoft.CodeAnalysis.CSharp.Scripting" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Http" />

src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj

@@ -10,6 +10,9 @@
   <ItemGroup>
     <PackageReference Include="Akka" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />

tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj

@@ -19,6 +19,9 @@
     -->
     <PackageReference Include="Microsoft.Data.SqlClient" VersionOverride="6.1.1" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
     <!--
       M4 Bundle E (Task E3): Microsoft.Extensions.Configuration.Json,

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj

@@ -13,6 +13,9 @@
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />

tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj

@@ -19,6 +19,9 @@
     -->
     <PackageReference Include="Microsoft.Data.SqlClient" VersionOverride="6.1.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection" />
     <PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />

tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj

@@ -11,6 +11,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.Options" />

tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj

@@ -16,6 +16,9 @@
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />

tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj

@@ -19,6 +19,9 @@
     <PackageReference Include="Microsoft.AspNetCore.TestHost" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="NSubstitute" />

tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj

@@ -11,6 +11,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />

tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj

@@ -17,6 +17,9 @@
   <ItemGroup>
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <!-- Microsoft.Extensions.* and Microsoft.AspNetCore.Authorization are provided
          by the Microsoft.AspNetCore.App shared framework referenced above (added so
          HttpAuditActorAccessorTests can build DefaultHttpContext), so they are no

tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj

@@ -12,6 +12,9 @@
     <PackageReference Include="Akka.TestKit.Xunit2" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" />
     <PackageReference Include="Microsoft.Extensions.Logging" />
     <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />

tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj

@@ -12,6 +12,9 @@
     <PackageReference Include="Akka.TestKit.Xunit2" />
     <PackageReference Include="coverlet.collector" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="xunit" />
     <PackageReference Include="xunit.runner.visualstudio" />

tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj

@@ -18,6 +18,9 @@
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
+         vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" />
     <PackageReference Include="NSubstitute" />
     <PackageReference Include="xunit" />