fix(security): stop suppressing GHSA-2m69-gcr7-jv3q, pin the patched native lib

The suppression's own comment said 'Remove once an upstream fix ships'. It has: SQLitePCLRaw.lib.e_sqlite3 2.1.12 patches this advisory within the 2.1.x line, so the premise that no patched release existed is no longer true. The Server project already resolved 2.1.12, but only incidentally - transitively via ZB.MOM.WW.Auth.ApiKeys. An explicit PackageReference makes that floor intentional, so a change to the Auth dependency graph cannot silently regress to the vulnerable 2.1.11. Removing the suppression restores auditing for exactly that case. Verified: forced restore of the NonWindows solution reports no NU1903; build is 0 warnings / 0 errors; test results unchanged from baseline (781 passed, 44 failed - all 44 pre-existing macOS Unix-domain-socket path-length failures in the fake-worker harness, identical count before and after).
2026-07-18 05:32:28 -04:00
parent b021e292ee
commit 2f0cfe33bf
2 changed files with 15 additions and 6 deletions
@@ -25,6 +25,9 @@
    <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.0" />
    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.7" />
+    <!-- Security pin: GHSA-2m69-gcr7-jv3q. Microsoft.Data.Sqlite pulls the vulnerable
+         native 2.1.11; 2.1.12 patches it. Bumping Sqlite does not clear it. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
    <PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.2" />
    <PackageReference Include="Polly.Core" Version="8.6.6" />
  </ItemGroup>