From b742a6542155d6b52644cc263afc376cd07c3f0f Mon Sep 17 00:00:00 2001 From: jschick04 Date: Fri, 19 Jun 2026 10:41:46 -0500 Subject: [PATCH] Update package versions and mitigate CVE-2025-6965 in transitive SQLite Bump central package versions in Directory.Packages.props: - Microsoft.WindowsAppSDK 1.7.250909003 -> 2.2.0 - Microsoft.Extensions.* 10.0.5 -> 10.0.9 - System.CommandLine 2.0.5 -> 2.0.9 - Microsoft.Data.Sqlite / Microsoft.EntityFrameworkCore.Sqlite 10.0.5 -> 10.0.9 - Microsoft.NET.Test.Sdk 18.4.0 -> 18.6.0 - coverlet.collector 8.0.1 -> 10.0.1 Add a temporary security override pinning the transitively-resolved native SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 (SQLite 3.50.3) to clear CVE-2025-6965 (GHSA-2m69-gcr7-jv3q). Microsoft.Data.Sqlite / EF Core 10.0.9 still pull SQLitePCLRaw.bundle_e_sqlite3 2.1.11 -> lib.e_sqlite3 2.1.11; lib.e_sqlite3 3.50.3 is native-only so the SQLitePCLRaw 2.x managed core is unchanged. Enabled CentralPackageTransitivePinningEnabled to allow the pin. Tracked for removal by #604. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Directory.Packages.props | 62 ++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 25 deletions(-) diff --git a/Directory.Packages.props b/Directory.Packages.props index 2697f2d3..433864ca 100644 --- a/Directory.Packages.props +++ b/Directory.Packages.props @@ -1,28 +1,40 @@ - - true - - - - - - + true + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + \ No newline at end of file