fix(deps): clear CVE-2025-6965 — pin SQLitePCLRaw bundle to 2.1.12, drop audit suppression #460

2026-07-15T08:17:34-04:00

dohertj2 commented

2026-07-15 08:17:34 -04:00

Resolves #458. The patched native bundle shipped (SQLitePCLRaw.bundle_e_sqlite3 2.1.12, first version outside the <= 2.1.11 advisory range, embedding SQLite 3.50.2+). Bumps Microsoft.Data.Sqlite 9.0.0→10.0.7, adds a surgical direct pin of the native bundle in Core.AlarmHistorian, and removes the NuGetAuditSuppress. Verified: clean restore/build with audit active, all in-solution projects resolve lib.e_sqlite3 2.1.12, AlarmHistorian tests 29/29 green.

Closes #458

Resolves #458. The patched native bundle shipped (`SQLitePCLRaw.bundle_e_sqlite3` 2.1.12, first version outside the `<= 2.1.11` advisory range, embedding SQLite 3.50.2+). Bumps `Microsoft.Data.Sqlite` 9.0.0→10.0.7, adds a surgical direct pin of the native bundle in `Core.AlarmHistorian`, and removes the `NuGetAuditSuppress`. Verified: clean restore/build with audit active, all in-solution projects resolve `lib.e_sqlite3` 2.1.12, AlarmHistorian tests 29/29 green. Closes #458

dohertj2 added 1 commit 2026-07-15 08:17:36 -04:00

fix(deps): clear CVE-2025-6965 — pin SQLitePCLRaw bundle to 2.1.12, drop audit suppression

v2-ci / build (pull_request) Successful in 5m41s

Details

v2-ci / unit-tests (pull_request) Failing after 10m49s

Details

b461b2bcf8

The patched native SQLite bundle shipped: SQLitePCLRaw.bundle_e_sqlite3 2.1.12
is the first version outside the CVE-2025-6965 / GHSA-2m69-gcr7-jv3q vulnerable
range (<= 2.1.11), embedding the SQLite 3.50.2+ fix.

- Bump Microsoft.Data.Sqlite 9.0.0 -> 10.0.7 (aligns with the EF Core 10.0.7 family).
  This alone still pulls the native bundle 2.1.11, so:
- Add a surgical direct pin of SQLitePCLRaw.bundle_e_sqlite3 2.1.12 in Core.AlarmHistorian
  (the sole consumer), overriding the transitive 2.1.11 without enabling
  CentralPackageTransitivePinningEnabled (which breaks the Roslyn 5.0/4.12 split).
- Remove the temporary NuGetAuditSuppress from Directory.Build.props.

Verified: dotnet restore/build clean with audit active (no GHSA-2m69), every
in-solution project resolves lib.e_sqlite3 2.1.12, AlarmHistorian tests 29/29 green
against the real native bundle.

Closes #458

dohertj2 merged commit 5908339d67 into master

2026-07-15 08:17:59 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#460