Skip to content

deps: Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.4 #407

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
erikdarlingdata merged 2 commits into from
Jul 25, 2026
Merged

deps: Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.4 #407

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8abe682
deps: Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.4
dependabot[bot] Jul 25, 2026
bc4bb6d
Update the SQLitePCLRaw pin comment for 3.0.4
erikdarlingdata Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions server/PlanShare/PlanShare.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,8 +10,11 @@
<PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.10" />
<!-- Direct ref lifts the transitive SQLitePCLRaw above 2.1.11, which bundles a
SQLite vulnerable to CVE-2025-6965 (GHSA-2m69-gcr7-jv3q). Microsoft.Data.Sqlite
still floors at 2.1.11 — remove this once its floor reaches 2.1.12+. -->
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
still floors at 2.1.11, so this ref is what keeps the native library patched;
drop it only once that floor moves past 2.1.11 on its own. 3.0.4 bundles
SQLite 3.53.3, and Microsoft.Data.Sqlite 10.0.10 works against the 3.x
native layer (full CRUD verified). -->
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.4" />
Comment on lines 11 to +17

@erikdarlingdata erikdarlingdata Jul 25, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a major version bump (2.1.12 → 3.0.4) on a package that ships the native SQLite binary. Per the upstream v3 release notes the package ID of SQLitePCLRaw.lib.e_sqlite3 was renamed to SourceGear.sqlite3 and the bundled native was moved to SourceGear.sqlite3 3.53.3, so restore/lock/pack outputs will change even though the managed API surface for bundle_e_sqlite3 is stable. Worth a manual smoke of PlanShare against a real SQLite DB on every OS you ship (esp. Linux, where native-asset RIDs regress most often — see the SkiaSharp pin in .github/dependabot.yml).

The rationale comment on L11–13 is now stale: the CVE-2025-6965 mitigation reason no longer describes intent (we're far past 2.1.12), and "remove this once its floor reaches 2.1.12+" would now argue for removing the direct ref, which would silently drop us back to whatever transitive Microsoft.Data.Sqlite carries (still 2.1.11 per that comment). If this bump lands, rewrite the comment to state the new intent — pinning to 3.x ahead of Microsoft.Data.Sqlite — otherwise a future cleanup will delete the ref for the wrong reason.

Generated by Claude Code

</ItemGroup>

</Project>
Loading