wend/Directory.Build.props at main · wendhq/wend · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
<Project>

  <!-- Solution-wide NuGet audit suppressions. Each one carries a dated reason directly above it. -->
  <ItemGroup>
    <!--
      2026-06-19: NU1903 / CVE-2025-6965. High-severity SQLite memory-corruption advisory in the
      transitive native package SQLitePCLRaw.lib.e_sqlite3 2.1.11, pulled in by
      Microsoft.EntityFrameworkCore.Sqlite. There is no fix to take: 2.1.11 is the last 2.1.x build
      (the advisory lists "Patched versions: None"), and the only newer build, 3.0.x, is a major
      release EF Core 10 was not built against.
      Not reachable in Wend: since the move to PostgreSQL, only Wend.Tests references SQLite, as an
      in-memory database for the repository tests. The running app never loads it.
      Tracked in docs/backlog.md. Revisit when EF Core ships on a patched SQLitePCLRaw and remove this.
    -->
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
  </ItemGroup>

</Project>