Joseph Doherty
b461b2bcf8
The patched native SQLite bundle shipped: SQLitePCLRaw.bundle_e_sqlite3 2.1.12 is the first version outside the CVE-2025-6965 / GHSA-2m69-gcr7-jv3q vulnerable range (<= 2.1.11), embedding the SQLite 3.50.2+ fix. - Bump Microsoft.Data.Sqlite 9.0.0 -> 10.0.7 (aligns with the EF Core 10.0.7 family). This alone still pulls the native bundle 2.1.11, so: - Add a surgical direct pin of SQLitePCLRaw.bundle_e_sqlite3 2.1.12 in Core.AlarmHistorian (the sole consumer), overriding the transitive 2.1.11 without enabling CentralPackageTransitivePinningEnabled (which breaks the Roslyn 5.0/4.12 split). - Remove the temporary NuGetAuditSuppress from Directory.Build.props. Verified: dotnet restore/build clean with audit active (no GHSA-2m69), every in-solution project resolves lib.e_sqlite3 2.1.12, AlarmHistorian tests 29/29 green against the real native bundle. Closes #458
38 lines
2.1 KiB
XML
38 lines
2.1 KiB
XML
<Project>
|
|
<!--
|
|
Defaults inherited by every csproj. Individual projects may override.
|
|
|
|
Deviation from the original v2 plan: TreatWarningsAsErrors is NOT set globally because the
|
|
pre-v2 test projects (e.g. Admin.Tests) carry 240+ xUnit1051 analyzer warnings that would
|
|
fail the build. New v2 projects (Commons, Cluster, ControlPlane, Runtime, OpcUaServer, AdminUI,
|
|
Host, Security) MUST opt in to <TreatWarningsAsErrors>true</TreatWarningsAsErrors> in their
|
|
own csproj. Once the legacy Admin/Server projects are deleted (Phase 10, Task 56), this can
|
|
be promoted back to a global default.
|
|
-->
|
|
<PropertyGroup>
|
|
<TargetFramework>net10.0</TargetFramework>
|
|
<Nullable>enable</Nullable>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<LangVersion>latest</LangVersion>
|
|
</PropertyGroup>
|
|
|
|
<!--
|
|
Wire the custom OTOPCUA0001 analyzer (UnwrappedCapabilityCallAnalyzer) into every project so
|
|
the CapabilityInvoker-wrapping rule is enforced tree-wide, not just against the analyzer's own
|
|
unit tests (arch-review 07/C-1 — the "built-but-never-wired" failure mode). Analyzer projects
|
|
target netstandard2.0 and are loaded into the compiler host, so OutputItemType="Analyzer" +
|
|
ReferenceOutputAssembly="false" is the correct incantation (the DLL is not linked). Excluded
|
|
from the analyzer project itself (self-reference cycle) and its test project (which already
|
|
references the analyzer directly). OTOPCUA0001 defaults to Warning; projects with genuine
|
|
intentional unwrapped calls (unit tests exercising drivers at the wire level, the invoker's own
|
|
internals) carry a scoped NoWarn / pragma — see the per-project suppressions.
|
|
-->
|
|
<ItemGroup Condition="'$(MSBuildProjectName)' != 'ZB.MOM.WW.OtOpcUa.Analyzers'
|
|
and '$(MSBuildProjectName)' != 'ZB.MOM.WW.OtOpcUa.Analyzers.Tests'">
|
|
<ProjectReference Include="$(MSBuildThisFileDirectory)src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/ZB.MOM.WW.OtOpcUa.Analyzers.csproj"
|
|
OutputItemType="Analyzer"
|
|
ReferenceOutputAssembly="false"
|
|
PrivateAssets="all" />
|
|
</ItemGroup>
|
|
</Project>
|