From 17d83e4d16f745848d7316d072bfda77eac882da Mon Sep 17 00:00:00 2001 From: Joseph Doherty Date: Mon, 9 Nov 2026 15:05:02 -0500 Subject: [PATCH] build(deps): Microsoft.Data.Sqlite 10.0.13 + SQLitePCLRaw.bundle_e_sqlite3 2.1.13 (lmxopcua#772) Microsoft.Data.Sqlite 10.0.7's connection pool can hand one handle to two users (dotnet/efcore#39009, fixed in 10.0.13; family tracker scadaproj#26). 10.0.13 requires bundle_e_sqlite3 >= 2.1.13, so the surgical native pin moves with it (2.1.12 fails restore with NU1109). No lockstep bumps needed: the repo has no EF Core Sqlite provider, and Microsoft.Data.Sqlite 10.0.13 depends only on Microsoft.Data.Sqlite.Core 10.0.13 and the SQLitePCLRaw bundle, so no other Microsoft.* pin moves. All 25 projects that resolve SQLite now get 10.0.13 / 2.1.13; restore with NuGetAudit on is clean and `--vulnerable --include-transitive` reports nothing. The shared-lib re-pins (LocalDb 0.3.5 etc.) wait for publication. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV --- Directory.Packages.props | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 642f4b0f..e2c21d19 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -69,7 +69,7 @@ - + @@ -151,8 +151,11 @@ range, <= 2.1.11). 2.1.12 is the first fixed native bundle (embeds the SQLite 3.50.2+ patch). A direct PackageReference in Core.AlarmHistorian promotes this to the resolved version, clearing the advisory without CentralPackageTransitivePinningEnabled (which breaks the Roslyn split). + Now 2.1.13 because Microsoft.Data.Sqlite 10.0.13 (above — the dotnet/efcore#39009 pool + double-handout fix, lmxopcua#772 / scadaproj#26) depends on bundle_e_sqlite3 >= 2.1.13; a + 2.1.12 pin fails restore with NU1109. Move the two pins together. --> - +