From ef184eb9a768a6f5903912c77f647873ce0e6ccf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 1 Jul 2026 15:33:13 +0000
Subject: [PATCH 1/2] Fix vulnerable transitive dependencies in MEVD projects

Pin safe versions of vulnerable transitive dependencies:
- SQLitePCLRaw.bundle_e_sqlite3 3.0.3 (fixes GHSA-2m69-gcr7-jv3q)
- SharpCompress 0.49.1 (fixes GHSA-6c8g-7p36-r338)
- Snappier 1.3.1 (fixes GHSA-pggp-6c3x-2xmx)

Enable CentralPackageTransitivePinningEnabled to enforce transitive
dependency version pinning via Directory.Packages.props.
---
 Directory.Build.props    | 1 +
 Directory.Packages.props | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/Directory.Build.props b/Directory.Build.props
index 4f0bab7..c449f87 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -7,6 +7,7 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 800e10b..114e66a 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -19,6 +19,9 @@
     <PackageVersion Include="Pgvector" Version="0.3.2" />
     <PackageVersion Include="Pinecone.Client" Version="3.1.0" /> <!-- TODO: Upgrade to 4 -->
     <PackageVersion Include="Qdrant.Client" Version="1.17.0" />
+    <PackageVersion Include="SharpCompress" Version="0.49.1" />
+    <PackageVersion Include="Snappier" Version="1.3.1" />
+    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
     <PackageVersion Include="sqlite-vec" Version="0.1.7-alpha.2.1" />
   </ItemGroup>
 

From ec935d177f280606804e64977d6735298f60d4fa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:02:47 +0000
Subject: [PATCH 2/2] Use direct PackageReference instead of
 CentralPackageTransitivePinningEnabled

Revert CentralPackageTransitivePinningEnabled and add direct PackageReference
entries in the source projects so shipped packages reference safe versions
directly, without requiring consumers to enable transitive pinning.

- SqliteVec.csproj: add SQLitePCLRaw.bundle_e_sqlite3
- CosmosMongoDB.csproj: add SharpCompress, Snappier
---
 Directory.Build.props                       | 1 -
 MEVD/src/CosmosMongoDB/CosmosMongoDB.csproj | 2 ++
 MEVD/src/SqliteVec/SqliteVec.csproj         | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index c449f87..4f0bab7 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -7,7 +7,6 @@
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
-    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
     <IsPackable>false</IsPackable>
   </PropertyGroup>
 
diff --git a/MEVD/src/CosmosMongoDB/CosmosMongoDB.csproj b/MEVD/src/CosmosMongoDB/CosmosMongoDB.csproj
index dd18629..8bca71a 100644
--- a/MEVD/src/CosmosMongoDB/CosmosMongoDB.csproj
+++ b/MEVD/src/CosmosMongoDB/CosmosMongoDB.csproj
@@ -21,6 +21,8 @@
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.AI.Abstractions" />
     <PackageReference Include="MongoDB.Driver" />
+    <PackageReference Include="SharpCompress" />
+    <PackageReference Include="Snappier" />
   </ItemGroup>
 
 </Project>
diff --git a/MEVD/src/SqliteVec/SqliteVec.csproj b/MEVD/src/SqliteVec/SqliteVec.csproj
index 544cbe7..22676cc 100644
--- a/MEVD/src/SqliteVec/SqliteVec.csproj
+++ b/MEVD/src/SqliteVec/SqliteVec.csproj
@@ -17,6 +17,7 @@
     <PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
     <PackageReference Include="Microsoft.Extensions.AI.Abstractions" />
     <PackageReference Include="Microsoft.Data.Sqlite" />
+    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" />
     <PackageReference Include="sqlite-vec" />
   </ItemGroup>