From 8abe68208efeff014d377d1e45f99ce579d4c4ef Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:09:27 +0000
Subject: [PATCH 1/2] deps: Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to
 3.0.4

---
updated-dependencies:
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
  dependency-version: 3.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 server/PlanShare/PlanShare.csproj | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/PlanShare/PlanShare.csproj b/server/PlanShare/PlanShare.csproj
index 67530a6..d2c9ec8 100644
--- a/server/PlanShare/PlanShare.csproj
+++ b/server/PlanShare/PlanShare.csproj
@@ -11,7 +11,7 @@
     <!-- Direct ref lifts the transitive SQLitePCLRaw above 2.1.11, which bundles a
          SQLite vulnerable to CVE-2025-6965 (GHSA-2m69-gcr7-jv3q). Microsoft.Data.Sqlite
          still floors at 2.1.11 — remove this once its floor reaches 2.1.12+. -->
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>
 
 </Project>

From bc4bb6dea834401a69bf4c29469a4da0a8fac9b4 Mon Sep 17 00:00:00 2001
From: Erik Darling <2136037+erikdarlingdata@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:48:14 -0400
Subject: [PATCH 2/2] Update the SQLitePCLRaw pin comment for 3.0.4

The comment said "remove this once its floor reaches 2.1.12+", which is
stale now that the ref is on the 3.x line. Microsoft.Data.Sqlite 10.0.10
still floors its transitive at the vulnerable 2.1.11, so this direct ref
is still what keeps the native library patched.

Records what was verified: 3.0.4 bundles SQLite 3.53.3 (past the 3.50.2
CVE fix), and Microsoft.Data.Sqlite 10.0.10 works against the 3.x native
layer - stats aggregates, insert, select round-trip, parameterized
delete, and 404-after-delete all exercised against a running instance.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 server/PlanShare/PlanShare.csproj | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/server/PlanShare/PlanShare.csproj b/server/PlanShare/PlanShare.csproj
index d2c9ec8..8d30dcd 100644
--- a/server/PlanShare/PlanShare.csproj
+++ b/server/PlanShare/PlanShare.csproj
@@ -10,7 +10,10 @@
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.10" />
     <!-- Direct ref lifts the transitive SQLitePCLRaw above 2.1.11, which bundles a
          SQLite vulnerable to CVE-2025-6965 (GHSA-2m69-gcr7-jv3q). Microsoft.Data.Sqlite
-         still floors at 2.1.11 — remove this once its floor reaches 2.1.12+. -->
+         still floors at 2.1.11, so this ref is what keeps the native library patched;
+         drop it only once that floor moves past 2.1.11 on its own. 3.0.4 bundles
+         SQLite 3.53.3, and Microsoft.Data.Sqlite 10.0.10 works against the 3.x
+         native layer (full CRUD verified). -->
     <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
   </ItemGroup>