fix: suppress SQLitePCLRaw.lib.e_sqlite3 audit warning (GHSA-2m69-gcr7-jv3q) - #1424
Merged
Merged
Conversation
…7-jv3q) All versions of SQLitePCLRaw.lib.e_sqlite3 (<= 2.1.11) depend on SQLite < 3.50.2 which has a memory corruption vulnerability (HIGH severity). No patched NuGet package exists yet. This suppresses the NU1903 audit warning that breaks CI builds due to TreatWarningsAsErrors=true. The suppression should be removed once a patched SQLitePCLRaw version is published.
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.sh | bash -s -- 1424Or
iex "& { $(irm https://raw.githubusercontent.com/CommunityToolkit/Aspire/main/eng/scripts/dogfood-pr.ps1) } 1424" |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository-wide MSBuild configuration to suppress a specific NuGet vulnerability audit warning for SQLitePCLRaw.lib.e_sqlite3 (GHSA-2m69-gcr7-jv3q) while no patched upstream package is available, keeping CI unblocked given TreatWarningsAsErrors=true.
Changes:
- Adds a
NuGetAuditSuppressentry for advisoryGHSA-2m69-gcr7-jv3qinDirectory.Build.props. - Documents the suppression rationale inline (unpatched transitive SQLite vulnerability).
aaronpowell
enabled auto-merge (squash)
June 23, 2026 05:20
aaronpowell
approved these changes
Jun 23, 2026
This was referenced Aug 25, 2026
This was referenced Sep 1, 2026
Closed
deps: Bump the all-dependencies group with 46 updates
ministryofjustice/CFO-DataManagementSystem#130
Closed
This was referenced Sep 8, 2026
deps: Bump the all-dependencies group with 46 updates
ministryofjustice/CFO-DataManagementSystem#134
Closed
This was referenced Sep 12, 2026
deps: Bump the all-dependencies group with 46 updates
ministryofjustice/CFO-DataManagementSystem#137
Closed
This was referenced Sep 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a NuGetAuditSuppress entry for GHSA-2m69-gcr7-jv3q — a HIGH severity vulnerability in SQLitePCLRaw.lib.e_sqlite3.
Problem
All versions of SQLitePCLRaw.lib.e_sqlite3 (<= 2.1.11, which is the latest) depend on SQLite < 3.50.2, which has a memory corruption vulnerability. Since no patched NuGet package exists yet, the NU1903 audit warning fires on every restore for any project that transitively references SQLite.
Combined with
TreatWarningsAsErrors=trueinDirectory.Build.props, this breaks CI builds for all SQLite-related projects (Hosting.Sqlite, tests, examples, etc.).Fix
Added a
NuGetAuditSuppressentry following the existing pattern (GHSA-4mjw-xr5x-prpc is already suppressed the same way). This is a temporary suppression that should be removed once upstream ships a patchedSQLitePCLRawversion.Impact