From b461b2bcf82739397bb73cb842f24c0ea60ccfa1 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Wed, 15 Jul 2026 08:17:19 -0400
Subject: [PATCH] =?UTF-8?q?fix(deps):=20clear=20CVE-2025-6965=20=E2=80=94?=
 =?UTF-8?q?=20pin=20SQLitePCLRaw=20bundle=20to=202.1.12,=20drop=20audit=20?=
 =?UTF-8?q?suppression?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The patched native SQLite bundle shipped: SQLitePCLRaw.bundle_e_sqlite3 2.1.12
is the first version outside the CVE-2025-6965 / GHSA-2m69-gcr7-jv3q vulnerable
range (<= 2.1.11), embedding the SQLite 3.50.2+ fix.

- Bump Microsoft.Data.Sqlite 9.0.0 -> 10.0.7 (aligns with the EF Core 10.0.7 family).
  This alone still pulls the native bundle 2.1.11, so:
- Add a surgical direct pin of SQLitePCLRaw.bundle_e_sqlite3 2.1.12 in Core.AlarmHistorian
  (the sole consumer), overriding the transitive 2.1.11 without enabling
  CentralPackageTransitivePinningEnabled (which breaks the Roslyn 5.0/4.12 split).
- Remove the temporary NuGetAuditSuppress from Directory.Build.props.

Verified: dotnet restore/build clean with audit active (no GHSA-2m69), every
in-solution project resolves lib.e_sqlite3 2.1.12, AlarmHistorian tests 29/29 green
against the real native bundle.

Closes #458
---
 CLAUDE.md                                         | 10 ++++++----
 Directory.Build.props                             | 15 ---------------
 Directory.Packages.props                          | 10 +++++++++-
 .../ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj  |  6 ++++++
 4 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 309e8d26..c93dd162 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -111,10 +111,12 @@ dotnet test tests/Core/ZB.MOM.WW.OtOpcUa.Core.Tests               # a single tes
 dotnet test --filter "FullyQualifiedName~MyTestClass.MyMethod"    # a single test
 ```
 
-`Directory.Build.props` carries a temporary `NuGetAuditSuppress` for
-CVE-2025-6965 / GHSA-2m69-gcr7-jv3q (transitive native `SQLitePCLRaw.lib.e_sqlite3`,
-no upstream fix yet) — so restore/build not flagging it is expected; remove the
-suppression once a patched bundle ships.
+CVE-2025-6965 / GHSA-2m69-gcr7-jv3q (transitive native `SQLitePCLRaw.lib.e_sqlite3`)
+is **resolved** — the temporary `NuGetAuditSuppress` was removed once the patched bundle
+shipped. `Core.AlarmHistorian` now carries a surgical direct pin of
+`SQLitePCLRaw.bundle_e_sqlite3` to `2.1.12` (the first fixed native bundle, embedding the
+SQLite 3.50.2+ patch), overriding the `2.1.11` that `Microsoft.Data.Sqlite` pulls
+transitively. `dotnet restore`/`build` is clean with the audit active.
 
 Test projects live under `tests/<module>/` (Core, Server, Drivers,
 Drivers/Cli, Client, Tooling) — there is no single unit-test project.
diff --git a/Directory.Build.props b/Directory.Build.props
index cbdfb25e..a8f9a2ff 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -16,21 +16,6 @@
     <LangVersion>latest</LangVersion>
   </PropertyGroup>
 
-  <!--
-    NuGet audit suppression: CVE-2025-6965 / GHSA-2m69-gcr7-jv3q affects the transitive native
-    bundle SQLitePCLRaw.lib.e_sqlite3 (advisory range <= 2.1.11), pulled in via
-    Microsoft.Data.Sqlite 9.0.0 -> SQLitePCLRaw.bundle_e_sqlite3 by Core.AlarmHistorian's
-    store-and-forward sink. As of 2026-06-20 the maintainer has NOT shipped a patched bundle
-    (SQLite fixed the underlying flaw upstream in 3.50.2 but no SQLitePCLRaw release embeds it
-    yet), so there is no package version to bump to. The flaw requires attacker-controlled
-    pathological aggregate SQL; the sink only issues internal parameterised statements, so the
-    exposure here is negligible. REMOVE this suppression once SQLitePCLRaw ships a patched native
-    bundle and bump Microsoft.Data.Sqlite to a release that references it.
-  -->
-  <ItemGroup>
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
-  </ItemGroup>
-
   <!--
     Wire the custom OTOPCUA0001 analyzer (UnwrappedCapabilityCallAnalyzer) into every project so
     the CapabilityInvoker-wrapping rule is enforced tree-wide, not just against the analyzer's own
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 5d72a22c..3888b982 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -51,7 +51,7 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Scripting" Version="4.12.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.Workspaces" Version="5.0.0" />
     <PackageVersion Include="Microsoft.Data.SqlClient" Version="6.1.1" />
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="9.0.0" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.7" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.7" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.7" />
@@ -95,6 +95,14 @@
     <PackageVersion Include="Serilog.Sinks.Console" Version="6.0.0" />
     <PackageVersion Include="Serilog.Sinks.File" Version="7.0.0" />
     <PackageVersion Include="Shouldly" Version="4.3.0" />
+    <!--
+      Surgical transitive pin: Microsoft.Data.Sqlite pulls SQLitePCLRaw.bundle_e_sqlite3 2.1.11
+      (native lib.e_sqlite3 2.1.11 — the top of the CVE-2025-6965 / GHSA-2m69-gcr7-jv3q vulnerable
+      range, <= 2.1.11). 2.1.12 is the first fixed native bundle (embeds the SQLite 3.50.2+ patch).
+      A direct PackageReference in Core.AlarmHistorian promotes this to the resolved version,
+      clearing the advisory without CentralPackageTransitivePinningEnabled (which breaks the Roslyn split).
+    -->
+    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
     <PackageVersion Include="System.CommandLine" Version="2.0.5" />
     <PackageVersion Include="System.Data.SqlClient" Version="4.9.0" />
     <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="8.11.0" />
diff --git a/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj b/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj
index 8dce2e65..62515df4 100644
--- a/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj
+++ b/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj
@@ -13,6 +13,12 @@
 
     <ItemGroup>
         <PackageReference Include="Microsoft.Data.Sqlite"/>
+        <!--
+          Direct pin of the native SQLite bundle to 2.1.12 (first version outside the
+          CVE-2025-6965 / GHSA-2m69-gcr7-jv3q range) — overrides the 2.1.11 that
+          Microsoft.Data.Sqlite pulls transitively. See Directory.Packages.props.
+        -->
+        <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3"/>
         <PackageReference Include="Serilog"/>
     </ItemGroup>
 
-- 
2.52.0