Adopt CentralPackageTransitivePinningEnabled instead of per-project SQLitePCLRaw pins #79

New Issue

2026-11-06T15:26:20-05:00

dohertj2 commented

2026-11-06 15:26:20 -05:00

GHSA-2m69-gcr7-jv3q (NU1903) was fixed in 2a0faeab with an explicit SQLitePCLRaw.lib.e_sqlite3 2.1.12 PackageReference in each SQLite-consuming project (16 csproj files reference SQLitePCLRaw today). CentralPackageTransitivePinningEnabled was tried and rejected at the time, because every central version would become a transitive ceiling, forcing bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json. It was recorded as the better long-term posture and left as an open follow-up.

Current state: transitive pinning is still not enabled in Directory.Packages.props. Most of the blocking bumps have since landed for other reasons: gRPC 2.76.0 and Protobuf 3.34.1 for LocalDb adoption, and SqlClient 6.1.1 in the 2026-09-09 Low review. The switch should now be much cheaper. Remaining: enable the flag, drop the per-project pins, fix any new NU1605/ceiling conflicts (Newtonsoft.Json?), and confirm a clean NuGet audit.

Source: scadaproj components/secrets/GAPS.md (SQLite vulnerability note, "Still open as a follow-up"); Directory.Packages.props comment block (~:119-145)

GHSA-2m69-gcr7-jv3q (NU1903) was fixed in `2a0faeab` with an explicit `SQLitePCLRaw.lib.e_sqlite3` 2.1.12 `PackageReference` in each SQLite-consuming project (16 csproj files reference SQLitePCLRaw today). `CentralPackageTransitivePinningEnabled` was tried and rejected at the time, because every central version would become a transitive ceiling, forcing bumps to Google.Protobuf, Grpc.Net.Client, Microsoft.Data.SqlClient and Newtonsoft.Json. It was recorded as the better long-term posture and left as an open follow-up. **Current state:** transitive pinning is still not enabled in `Directory.Packages.props`. Most of the blocking bumps have since landed for other reasons: gRPC 2.76.0 and Protobuf 3.34.1 for LocalDb adoption, and SqlClient 6.1.1 in the 2026-09-09 Low review. The switch should now be much cheaper. Remaining: enable the flag, drop the per-project pins, fix any new NU1605/ceiling conflicts (Newtonsoft.Json?), and confirm a clean NuGet audit. Source: scadaproj `components/secrets/GAPS.md` (SQLite vulnerability note, "Still open as a follow-up"); `Directory.Packages.props` comment block (~:119-145)

dohertj2 added the type:debt priority:p3 migrated labels 2026-11-06 15:26:20 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/ScadaBridge#79