From 3cc6a5f30dc3a5761f66594e779f8bfc34a97db6 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Sat, 20 Jun 2026 22:43:15 -0400
Subject: [PATCH] build: suppress NU1903 for CVE-2025-6965 (SQLitePCLRaw, no
 upstream fix)

Transitive native bundle SQLitePCLRaw.lib.e_sqlite3 (via Microsoft.Data.Sqlite ->
Core.AlarmHistorian) is flagged by GHSA-2m69-gcr7-jv3q with no patched package yet
published. Add the documented NuGetAuditSuppress so the solution restores/builds;
remove once a patched SQLitePCLRaw bundle ships. Incidental to the code-review pass.
---
 Directory.Build.props | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/Directory.Build.props b/Directory.Build.props
index 9d534b05..10a2a1d1 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -15,4 +15,19 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <LangVersion>latest</LangVersion>
   </PropertyGroup>
+
+  <!--
+    NuGet audit suppression: CVE-2025-6965 / GHSA-2m69-gcr7-jv3q affects the transitive native
+    bundle SQLitePCLRaw.lib.e_sqlite3 (advisory range <= 2.1.11), pulled in via
+    Microsoft.Data.Sqlite 9.0.0 -> SQLitePCLRaw.bundle_e_sqlite3 by Core.AlarmHistorian's
+    store-and-forward sink. As of 2026-06-20 the maintainer has NOT shipped a patched bundle
+    (SQLite fixed the underlying flaw upstream in 3.50.2 but no SQLitePCLRaw release embeds it
+    yet), so there is no package version to bump to. The flaw requires attacker-controlled
+    pathological aggregate SQL; the sink only issues internal parameterised statements, so the
+    exposure here is negligible. REMOVE this suppression once SQLitePCLRaw ships a patched native
+    bundle and bump Microsoft.Data.Sqlite to a release that references it.
+  -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+  </ItemGroup>
 </Project>