dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

build: adopt CentralPackageTransitivePinningEnabled, drop per-project SQLitePCLRaw pins (ScadaBridge#79)

Browse Source 
Enables transitive pinning so the central SQLitePCLRaw.lib.e_sqlite3 2.1.12
pin applies everywhere (41 projects verified at 2.1.12). Required raising the
central floors: Newtonsoft.Json 13.0.4 and Microsoft.Extensions.* 10.0.13.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-09 12:32:05 -05:00
parent 42443b4659
commit 4918210b78
17 changed files with 22 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Directory.Packages.props
+22 -22
View File
@@ -2,6 +2,7 @@
<PropertyGroup>
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
<CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
</PropertyGroup>
<ItemGroup>
@@ -55,22 +56,24 @@
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.SqlServer" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
<PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Hosting.WindowsServices" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Http" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Logging" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.13" />
<PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.13" />
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
<PackageVersion Include="Microsoft.Playwright" Version="1.58.0" />
<PackageVersion Include="Moq" Version="4.20.72" />
<!-- Pinned to the version Akka.NET already pulls transitively (no version-bump ride-along);
<!-- 13.0.4 is the floor OPCFoundation.NetStandard.Opc.Ua.Core 1.5.378.106 demands; surfaced when
CentralPackageTransitivePinningEnabled was turned on (Gitea #79). Also used by the
Commons.Tests contract-lock tests;
used by Commons.Tests contract-lock tests that exercise the Akka default JSON serializer. -->
<PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
<PackageVersion Include="Newtonsoft.Json" Version="13.0.4" />
<PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
<PackageVersion Include="NSubstitute" Version="5.3.0" />
<PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
@@ -134,16 +137,13 @@
test projects — the whole site-local SQLite layer — were still resolving the vulnerable
2.1.11, and the suppression hid that everywhere.
Delivered as an explicit <PackageReference> in each SQLite-consuming project rather than via
CentralPackageTransitivePinningEnabled. Enabling transitive pinning globally was tried first
and rejected: it makes every centrally-defined version a hard ceiling for transitive
resolution too, which immediately demanded bumps to Google.Protobuf (3.29.3->3.34.1),
Grpc.Net.Client (2.71.0->2.76.0), Microsoft.Data.SqlClient (6.0.2->6.1.1) and Newtonsoft.Json
(13.0.3->13.0.4). Those may well be worth doing, but they are a gRPC/data-access change to a
production SCADA platform and belong in their own reviewed commit — not smuggled in under a
SQLite security fix.
Adopting CentralPackageTransitivePinningEnabled is tracked as Gitea issue #79.
Delivered since Gitea #79 via CentralPackageTransitivePinningEnabled (top of this file): the
PackageVersion below is applied to the transitive SQLitePCLRaw.lib.e_sqlite3 in EVERY project,
so the per-project <PackageReference> pins (16 csproj files) were removed. Enabling it forced
centrally-defined versions to be a floor for transitive resolution, which required:
Newtonsoft.Json 13.0.3 -> 13.0.4 (OPC UA core floor) and Microsoft.Extensions.* 10.0.7 ->
10.0.13 (the SignalR.Common 10.0.13 security pin in the CLI floors Options/DI at 10.0.13).
Google.Protobuf, Grpc.* and SqlClient had already been raised for other reasons.
-->
<ItemGroup>
<PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
src/ZB.MOM.WW.ScadaBridge.AuditLog/ZB.MOM.WW.ScadaBridge.AuditLog.csproj
-1
View File
@@ -14,7 +14,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Options" />
src/ZB.MOM.WW.ScadaBridge.SiteEventLogging/ZB.MOM.WW.ScadaBridge.SiteEventLogging.csproj
-1
View File
@@ -12,7 +12,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
src/ZB.MOM.WW.ScadaBridge.SiteRuntime/ZB.MOM.WW.ScadaBridge.SiteRuntime.csproj
-1
View File
@@ -16,7 +16,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Http" />
src/ZB.MOM.WW.ScadaBridge.StoreAndForward/ZB.MOM.WW.ScadaBridge.StoreAndForward.csproj
-1
View File
@@ -12,7 +12,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Options" />
tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests/ZB.MOM.WW.ScadaBridge.AuditLog.Tests.csproj
-1
View File
@@ -16,7 +16,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
<!--
M4 Bundle E (Task E3): Microsoft.Extensions.Configuration.Json,
tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests.csproj
-1
View File
@@ -15,7 +15,6 @@
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="NSubstitute" />
<PackageReference Include="xunit" />
tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests/ZB.MOM.WW.ScadaBridge.ConfigurationDatabase.Tests.csproj
-1
View File
@@ -15,7 +15,6 @@
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" />
<PackageReference Include="Microsoft.AspNetCore.DataProtection" />
<PackageReference Include="Microsoft.AspNetCore.DataProtection.EntityFrameworkCore" />
tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests/ZB.MOM.WW.ScadaBridge.HealthMonitoring.Tests.csproj
-1
View File
@@ -13,7 +13,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
<PackageReference Include="Microsoft.Extensions.Options" />
tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests/ZB.MOM.WW.ScadaBridge.InboundAPI.Tests.csproj
-1
View File
@@ -18,7 +18,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="NSubstitute" />
<PackageReference Include="xunit" />
tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/ZB.MOM.WW.ScadaBridge.IntegrationTests.csproj
-1
View File
@@ -21,7 +21,6 @@
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="xunit" />
<PackageReference Include="NSubstitute" />
tests/ZB.MOM.WW.ScadaBridge.PerformanceTests/ZB.MOM.WW.ScadaBridge.PerformanceTests.csproj
-1
View File
@@ -13,7 +13,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.runner.visualstudio" />
tests/ZB.MOM.WW.ScadaBridge.Security.Tests/ZB.MOM.WW.ScadaBridge.Security.Tests.csproj
-1
View File
@@ -19,7 +19,6 @@
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<!-- Microsoft.Extensions.* and Microsoft.AspNetCore.Authorization are provided
by the Microsoft.AspNetCore.App shared framework referenced above (added so
HttpAuditActorAccessorTests can build DefaultHttpContext), so they are no
tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests/ZB.MOM.WW.ScadaBridge.SiteEventLogging.Tests.csproj
-1
View File
@@ -14,7 +14,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection" />
<PackageReference Include="Microsoft.Extensions.Logging" />
<PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests/ZB.MOM.WW.ScadaBridge.StoreAndForward.Tests.csproj
-1
View File
@@ -14,7 +14,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="xunit" />
<PackageReference Include="xunit.runner.visualstudio" />
tests/ZB.MOM.WW.ScadaBridge.TestSupport/ZB.MOM.WW.ScadaBridge.TestSupport.csproj
-1
View File
@@ -18,7 +18,6 @@
<PackageReference Include="Microsoft.Data.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<!-- Microsoft.Extensions.Configuration comes in transitively via ZB.MOM.WW.LocalDb;
central package management has no PackageVersion for it, matching how the
Phase 1 fixture in SiteEventLogging.Tests already consumed it. -->
tests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests/ZB.MOM.WW.ScadaBridge.Transport.IntegrationTests.csproj
-1
View File
@@ -20,7 +20,6 @@
<PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
<!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the
vulnerable native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not help. -->
<PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" />
<PackageReference Include="Microsoft.NET.Test.Sdk" />
<PackageReference Include="NSubstitute" />
<PackageReference Include="xunit" />