fix(deps): Microsoft.Data.Sqlite 10.0.7 -> 10.0.13 in Secrets, LocalDb, Auth (scadaproj#26)

10.0.7's pool can hand one handle to two users (efcore#39009). 10.0.13 floors SQLitePCLRaw 2.1.13, so the transitive lib.e_sqlite3 pin moves 2.1.12 -> 2.1.13 (the old pin is a NU1109 downgrade error). NuGetAudit clean; all suites green. Versions bumped, NOT published: Secrets 0.6.5, LocalDb 0.3.5, Auth 0.4.3. GalaxyRepository and Overview do not use Microsoft.Data.Sqlite. Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
2026-11-09 14:17:11 -05:00
parent 2fea619da3
commit 1baa384cbe
10 changed files with 32 additions and 15 deletions
@@ -42,4 +42,6 @@ MxAccessGateway & HistorianGateway → the original four; ScadaBridge → those

 **`tools/LdapProbe`** (`ldapprobe`, not packable, outside the Auth solution) is the diagnostic that found the above: it drives the **real** `LdapAuthService` so its verdict is what the four apps produce, then separately queries the directory for what the library cannot report — full group DNs, **nested** groups via `LDAP_MATCHING_RULE_IN_CHAIN`, the **primary group** (which AD omits from `memberOf`, so it can never be a role group), group type (security vs distribution), decoded `userAccountControl`, referral counts, and the TLS chain with key sizes. `--list-groups '<pat>'` enumerates every group in the directory matching a pattern, which a membership dump structurally cannot do. Findings recorded in [`ldap_setup.md`](ldap_setup.md), including the **`UG_WW_*` Wonderware group convention (39 groups)** that partly overturns that doc's earlier "no group→role convention exists" claim — it was true of Ignition, false of the domain.

+**`0.4.3` (unpublished, scadaproj#26):** `Microsoft.Data.Sqlite` 10.0.7 -> 10.0.13 (efcore#39009 pool fault); `SQLitePCLRaw.lib.e_sqlite3` transitive pin 2.1.12 -> 2.1.13 (10.0.13 floors 2.1.13). No API change.
+
 **`0.4.2` (unpublished, scadaproj#23 + #22):** `ZB.MOM.WW.Auth.ApiKeys.ApiKeyPepperUnavailableException : InvalidOperationException` (message still `"pepper unavailable"`) is now thrown by `ApiKeyAdminCommands` create/rotate when the pepper is missing, so consumers can catch it by type; existing `catch (InvalidOperationException)` blocks keep working (only exact-type assertions like xunit `ThrowsAsync<InvalidOperationException>` need updating). **Release note: consumers can drop their own `IApiKeyPepperProvider` pre-checks** — mxaccessgw's `DashboardApiKeyManagementService` and any similar code. Also pins `System.Security.Cryptography.Pkcs 9.0.21` (transitive, via SqlClient 6.0.2) to clear NuGetAudit NU1902/NU1903. Not yet published to the feed.
@@ -12,7 +12,7 @@
         in both bind modes (ServiceAccount-mode behaviour change); template docs prefer EXAMPLE\{0}. -->
    <!-- 0.4.2: typed ApiKeyPepperUnavailableException (: InvalidOperationException) for a missing pepper on
         create/rotate; patched System.Security.Cryptography.Pkcs transitive pin (SqlServer package). -->
-    <Version>0.4.2</Version>
+    <Version>0.4.3</Version>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>

@@ -11,10 +11,10 @@
    <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />

    <!-- Data -->
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
-    <!-- Transitive security pin: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11,
-         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.12 native lib. -->
-    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.13" />
+    <!-- Transitive security pin: Microsoft.Data.Sqlite pulled SQLitePCLRaw.lib.e_sqlite3 2.1.11 (10.0.7); 10.0.13 floors 2.1.13 (scadaproj#26),
+         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.13 native lib. -->
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
    <!-- Shared SQL-Server API-key store (ZB.MOM.WW.Auth.ApiKeys.SqlServer). 6.0.2 matches the
         family pin used by ZB.MOM.WW.Secrets' SQL-Server store, so a consumer taking both gets one
         SqlClient rather than a downgrade warning. -->
@@ -4,6 +4,8 @@ Shared embedded SQLite cache + 2-node LWW sync library for the **ZB.MOM.WW SCADA

 **Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #16 (resurrection guard past `TombstoneRetention`). The history below is a record, not a status tracker; file new follow-ups as issues.

+**`0.3.5` (unpublished, scadaproj#26):** `Microsoft.Data.Sqlite` 10.0.7 -> 10.0.13 (efcore#39009 pool fault, which a LocalDb consumer is exposed to); `SQLitePCLRaw.lib.e_sqlite3` transitive pin 2.1.12 -> 2.1.13 (10.0.13 floors 2.1.13). 216/216; no wire/schema change.
+
 ## Index history (migrated from the scadaproj root CLAUDE.md)

 > Moved verbatim out of the scadaproj root `CLAUDE.md` on 2026-09-03 so it loads only when needed. **This file is now the authoritative place for this history — append new entries here and keep the root index row short.**
@@ -5,7 +5,7 @@
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <LangVersion>latest</LangVersion>
-    <Version>0.3.4</Version>
+    <Version>0.3.5</Version>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <!-- NU1510 (package-pruning advice): the Replication and Tests projects carry a
@@ -5,10 +5,10 @@
    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
  </PropertyGroup>
  <ItemGroup>
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
-    <!-- Transitive security pin: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11,
-         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.12 native lib. -->
-    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.13" />
+    <!-- Transitive security pin: Microsoft.Data.Sqlite pulled SQLitePCLRaw.lib.e_sqlite3 2.1.11 (10.0.7); 10.0.13 floors 2.1.13 (scadaproj#26),
+         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.13 native lib. -->
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />
    <PackageVersion Include="Microsoft.Extensions.Options" Version="10.0.7" />
    <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="10.0.7" />
    <PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.7" />
@@ -5,6 +5,17 @@ follows [Keep a Changelog](https://keepachangelog.com/); versions are shared acr
 package in the family (see `Directory.Build.props`) even when a given release only touches
 one of them.

+## 0.6.5 — unreleased (NOT published to the feed)
+
+### Changed
+
+- **`Microsoft.Data.Sqlite` 10.0.7 -> 10.0.13** (scadaproj#26): 10.0.7's connection pool can hand one
+  handle to two users (dotnet/efcore#39009). 10.0.13 floors `SQLitePCLRaw.bundle_e_sqlite3` at 2.1.13, so the
+  central transitive pin on `SQLitePCLRaw.lib.e_sqlite3` moves 2.1.12 -> 2.1.13 (the old pin is now a hard
+  NU1109 downgrade error). NuGetAudit clean.
+- Tests (scadaproj#27): the two Unix-permission tests are `[SkippableFact]` (they threw `SkipException` from a plain
+  `[Fact]` and failed on Windows); `Resolver_Works_EndToEnd_ThroughDi` clears the SQLite pools before deleting its temp DB.
+
 ## 0.6.4 — unreleased (NOT published to the feed)

 ### Fixed
@@ -4,6 +4,8 @@ Shared encrypted secret store + `${secret:}` resolution for the **ZB.MOM.WW SCAD

 **Backlog / open work:** lives in Gitea issues on `dohertj2/scadaproj` (`tea issues list --repo dohertj2/scadaproj`) — currently #7 (ignitionoee router pins), #8 (Replicator.Grpc / `0.6.3` fate), #18 (migrator retry jitter). The history below is a record, not a status tracker; file new follow-ups as issues.

+**`0.6.5` — built, NOT published (2026-11-09, scadaproj#26/#27):** `Microsoft.Data.Sqlite` 10.0.7 -> 10.0.13 (efcore#39009 pool fault) with `SQLitePCLRaw.lib.e_sqlite3` pin 2.1.12 -> 2.1.13; Windows test fixes. See `CHANGELOG.md`.
+
 **`0.6.4` — built, NOT published (2026-11-09, scadaproj#25):** `Directory.Build.props` says `0.6.4` but the feed's newest is still `0.6.3`. Concurrent SQLite migration of one store is now gated per normalised path, runs on an unpooled `BEGIN IMMEDIATE` connection and retries `SQLITE_BUSY`/`SQLITE_LOCKED` (see `CHANGELOG.md`). Tests: `tests/ZB.MOM.WW.Secrets.Tests/Sqlite/SqliteSecretsStoreConcurrentInitTests.cs` + the gate/retry cases in `SqliteSecretsStoreMigratorTests.cs`; also run on windev.

 ## Index history (migrated from the scadaproj root CLAUDE.md)
@@ -5,7 +5,7 @@
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <LangVersion>latest</LangVersion>
-    <Version>0.6.4</Version>
+    <Version>0.6.5</Version>
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
    <PackageReadmeFile>README.md</PackageReadmeFile>
  </PropertyGroup>
@@ -11,10 +11,10 @@
    <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />

    <!-- Data -->
-    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.7" />
-    <!-- Transitive security pin: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11,
-         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.12 native lib. -->
-    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.12" />
+    <PackageVersion Include="Microsoft.Data.Sqlite" Version="10.0.13" />
+    <!-- Transitive security pin: Microsoft.Data.Sqlite pulled SQLitePCLRaw.lib.e_sqlite3 2.1.11 (10.0.7); 10.0.13 floors 2.1.13 (scadaproj#26),
+         which carries advisory GHSA-2m69-gcr7-jv3q (NU1903). Pin the patched 2.1.13 native lib. -->
+    <PackageVersion Include="SQLitePCLRaw.lib.e_sqlite3" Version="2.1.13" />

    <!-- Shared SQL-Server secret store (ZB.MOM.WW.Secrets.Replication.SqlServer).
         6.0.2 matches the version ScadaBridge and ZB.MOM.WW.GalaxyRepository already resolve, so a