From a3f58519a953ddcf1f8201c83057329fed9c7ecf Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 25 Jun 2026 11:02:26 -0400
Subject: [PATCH] build: suppress pre-existing NU1903 (transitive e_sqlite3, no
 upstream patch)

SQLitePCLRaw.lib.e_sqlite3 2.1.11 (transitive via Microsoft.Data.Sqlite)
carries GHSA-2m69-gcr7-jv3q, surfacing as NU1903 warning-as-error and
breaking the build (already red on main). No patched e_sqlite3 exists yet.
Targeted NuGetAuditSuppress keeps all other transitive packages audited.
---
 src/Directory.Build.props | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/Directory.Build.props b/src/Directory.Build.props
index 0b8cc13..1794c05 100644
--- a/src/Directory.Build.props
+++ b/src/Directory.Build.props
@@ -8,4 +8,11 @@
     <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
     <Deterministic>true</Deterministic>
   </PropertyGroup>
+
+  <!-- SQLitePCLRaw.lib.e_sqlite3 2.1.11 (transitive via Microsoft.Data.Sqlite) carries GHSA-2m69-gcr7-jv3q,
+       which surfaces as NU1903 (warning-as-error). No patched e_sqlite3 release exists yet (2.1.11 is latest),
+       so this targeted suppression keeps every OTHER transitive package audited. Remove once an upstream fix ships. -->
+  <ItemGroup>
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
+  </ItemGroup>
 </Project>