Joseph Doherty
2f0cfe33bf
The suppression's own comment said 'Remove once an upstream fix ships'. It has: SQLitePCLRaw.lib.e_sqlite3 2.1.12 patches this advisory within the 2.1.x line, so the premise that no patched release existed is no longer true. The Server project already resolved 2.1.12, but only incidentally - transitively via ZB.MOM.WW.Auth.ApiKeys. An explicit PackageReference makes that floor intentional, so a change to the Auth dependency graph cannot silently regress to the vulnerable 2.1.11. Removing the suppression restores auditing for exactly that case. Verified: forced restore of the NonWindows solution reports no NU1903; build is 0 warnings / 0 errors; test results unchanged from baseline (781 passed, 44 failed - all 44 pre-existing macOS Unix-domain-socket path-length failures in the fake-worker harness, identical count before and after).
50 lines
2.4 KiB
XML
50 lines
2.4 KiB
XML
<Project>
|
|
<PropertyGroup>
|
|
<LangVersion>latest</LangVersion>
|
|
<Nullable>enable</Nullable>
|
|
<ImplicitUsings>enable</ImplicitUsings>
|
|
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
|
|
<AnalysisLevel>latest</AnalysisLevel>
|
|
<EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
|
|
<Deterministic>true</Deterministic>
|
|
</PropertyGroup>
|
|
|
|
<!-- TST-11: single-source the .NET-side version for Server, Worker, Contracts, and tests
|
|
(they otherwise stamp the SDK default 1.0.0, so a deployed gateway cannot be correlated
|
|
to a release). Kept at 0.1.2 to match the Contracts package and the aligned Python/Rust/
|
|
Go clients; the Java client leads at 0.2.0 after its JDK-17 retarget. The git short SHA is
|
|
appended to InformationalVersion (0.1.2+<sha>) so support can map a running binary to a
|
|
commit; the query is guarded so a build outside a git checkout still succeeds. -->
|
|
<PropertyGroup>
|
|
<Version>0.1.2</Version>
|
|
</PropertyGroup>
|
|
|
|
<Target Name="StampSourceRevision"
|
|
BeforeTargets="GetAssemblyVersion;GenerateAssemblyInfo"
|
|
Condition="'$(SourceRevisionId)' == ''">
|
|
<Exec Command="git -C "$(MSBuildThisFileDirectory)" rev-parse --short HEAD"
|
|
ConsoleToMSBuild="true"
|
|
StandardOutputImportance="Low"
|
|
ContinueOnError="true"
|
|
IgnoreExitCode="true">
|
|
<Output TaskParameter="ConsoleOutput" PropertyName="_StampedGitSha" />
|
|
</Exec>
|
|
<PropertyGroup>
|
|
<SourceRevisionId Condition="'$(_StampedGitSha)' != ''">$(_StampedGitSha.Trim())</SourceRevisionId>
|
|
</PropertyGroup>
|
|
</Target>
|
|
|
|
<!-- GHSA-2m69-gcr7-jv3q (NU1903, high) on the native SQLitePCLRaw.lib.e_sqlite3, pulled in
|
|
transitively by Microsoft.Data.Sqlite.
|
|
|
|
The suppression that used to live here said "No patched e_sqlite3 release exists yet
|
|
(2.1.11 is latest) ... Remove once an upstream fix ships." That fix HAS shipped: 2.1.12
|
|
patches this advisory within the 2.1.x line. Suppression removed 2026-07-18, so the
|
|
advisory is audited again instead of silenced.
|
|
|
|
The Server project already resolved 2.1.12, but only incidentally — transitively via
|
|
ZB.MOM.WW.Auth.ApiKeys. The pin in that project makes the floor intentional, so a change
|
|
to the Auth dependency graph cannot silently drop it back to the vulnerable 2.1.11.
|
|
Verified: forced restore with no suppression reports no NU1903. -->
|
|
</Project>
|