Skip to content

[WrapGod] bump SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 (GHSA-2m69-gcr7-jv3q)#227

Merged
JerrettDavis merged 1 commit into
mainfrom
fix/sqlite-vuln-ghsa-2m69-gcr7-jv3q
Jun 22, 2026
Merged

[WrapGod] bump SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 (GHSA-2m69-gcr7-jv3q)#227
JerrettDavis merged 1 commit into
mainfrom
fix/sqlite-vuln-ghsa-2m69-gcr7-jv3q

Conversation

@JerrettDavis

Copy link
Copy Markdown
Owner

Summary

  • Pins SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 (patched) in the efcore-dapper-bidirectional DapperApp example
  • Microsoft.Data.Sqlite 9.0.8 transitively pulls SQLitePCLRaw.lib.e_sqlite3 2.1.10 which is affected by GHSA-2m69-gcr7-jv3q
  • Explicit PackageReference forces NuGet to resolve the patched version

Test plan

  • dotnet restore — NU1903 warning gone
  • dotnet build — 0 errors, 0 warnings

🤖 Generated with Claude Code

)

Force the patched SQLitePCLRaw.lib.e_sqlite3 v3.50.3 to override the
vulnerable 2.1.10 transitive pin from Microsoft.Data.Sqlite 9.0.8
in the efcore-dapper-bidirectional example.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
nuget/SQLitePCLRaw.lib.e_sqlite3 3.50.3 UnknownUnknown

Scanned Files

  • examples/migrations/efcore-dapper-bidirectional/DapperApp/DapperApp.csproj

@github-actions

Copy link
Copy Markdown

Test Results

920 tests   919 ✅  2m 21s ⏱️
  1 suites    1 💤
  1 files      0 ❌

Results for commit 3985942.

@JerrettDavis JerrettDavis merged commit 44bc417 into main Jun 22, 2026
12 checks passed
@JerrettDavis JerrettDavis deleted the fix/sqlite-vuln-ghsa-2m69-gcr7-jv3q branch June 22, 2026 19:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant