dohertj2/lmxopcua
1
0
Fork 0
Code Issues 29 Pull Requests Actions 1 Packages Projects Releases Wiki Activity

build(deps): Microsoft.Data.Sqlite 10.0.13 + SQLitePCLRaw.bundle_e_sqlite3 2.1.13 (lmxopcua#772)
v2-ci / unit-tests (push) Has been cancelled
Details

Browse Source 
Microsoft.Data.Sqlite 10.0.7's connection pool can hand one handle to two
users (dotnet/efcore#39009, fixed in 10.0.13; family tracker scadaproj#26).
10.0.13 requires bundle_e_sqlite3 >= 2.1.13, so the surgical native pin
moves with it (2.1.12 fails restore with NU1109).

No lockstep bumps needed: the repo has no EF Core Sqlite provider, and
Microsoft.Data.Sqlite 10.0.13 depends only on Microsoft.Data.Sqlite.Core
10.0.13 and the SQLitePCLRaw bundle, so no other Microsoft.* pin moves.
All 25 projects that resolve SQLite now get 10.0.13 / 2.1.13; restore with
NuGetAudit on is clean and `--vulnerable --include-transitive` reports
nothing. The shared-lib re-pins (LocalDb 0.3.5 etc.) wait for publication.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-09 15:05:02 -05:00
parent 342a825d69
commit 17d83e4d16
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Directory.Packages.props
+5 -2
View File
@@ -69,7 +69,7 @@
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="4.12.0" />
<PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
<PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.1" />
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
<PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.13" />
<PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.7" />
<PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.7" />
@@ -151,8 +151,11 @@
range, <= 2.1.11). 2.1.12 is the first fixed native bundle (embeds the SQLite 3.50.2+ patch).
A direct PackageReference in Core.AlarmHistorian promotes this to the resolved version,
clearing the advisory without CentralPackageTransitivePinningEnabled (which breaks the Roslyn split).
Now 2.1.13 because Microsoft.Data.Sqlite 10.0.13 (above — the dotnet/efcore#39009 pool
double-handout fix, lmxopcua#772 / scadaproj#26) depends on bundle_e_sqlite3 >= 2.1.13; a
2.1.12 pin fails restore with NU1109. Move the two pins together.
-->
<PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
<PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.13" />
<!--
Surgical transitive pin #2. Four NU1903 high-severity advisories (GHSA-23rf-6693-g89p,
GHSA-8q5v-6pqq-x66h, GHSA-cvvh-rhrc-wg4q, GHSA-g8r8-53c2-pm3f) landed in the NuGet audit