Resolve the SQLitePCLRaw advisory in the Sqlite auth templates

[danielchalmers]

Every --auth Individual template that uses Sqlite currently fails to build:

InteractivityAuto_Auth.csproj : error NU1903: Package 'SQLitePCLRaw.lib.e_sqlite3' 2.1.11
has a known high severity vulnerability, https://github.com/advisories/GHSA-2m69-gcr7-jv3q

EF Core 10 — including the current 10.0.10 — still resolves SQLitePCLRaw 2.1.11 transitively. The advisory covers <= 2.1.11, and NU1903 is an error under /warnaserror, so the build fails. Nobody has had to touch the templates for this to break; it appeared when the advisory was published.

This is what #524 surfaced. mudblazor-ci never reported it because the script did not stop on a failing build.

Fix

Reference SQLitePCLRaw.bundle_e_sqlite3 explicitly, under the same condition as the Sqlite provider, so it applies only where Sqlite is actually used and not to the --use-local-db (SqlServer) variants.

Referencing the bundle rather than lib.e_sqlite3 directly keeps the whole set on one version. After the change:

SQLitePCLRaw.bundle_e_sqlite3     2.*     2.1.12
SQLitePCLRaw.core                         2.1.12
SQLitePCLRaw.lib.e_sqlite3                2.1.12
SQLitePCLRaw.provider.e_sqlite3           2.1.12

The floating 2.* matches the existing style in this file (10.*, 9.*, 4.*) and picks up future 2.x fixes. The comment marks it for removal once EF Core resolves 2.1.12 or later on its own.

Verified

All seven Sqlite auth permutations generated and built with /warnaserror:

• InteractivityAuto_Auth, InteractivityNone_Auth, InteractivityServer_Auth, InteractivityWasm_Auth
• InteractivityAuto_Global_Auth, InteractivityServer_Global_Auth, InteractivityWasm_Global_Auth

All pass. dotnet list package --vulnerable --include-transitive reports no vulnerable packages for the generated app or its .Client project.

Merge order

This should go in before #524. Once this is merged, #524 makes the workflow able to fail and CI is genuinely green; merging #524 first would leave dev red until this lands.

[danielchalmers]

Closing this as an upstream issue.

The vulnerable resolution comes from EF Core, which still pulls SQLitePCLRaw 2.1.11 as of 10.0.10. Pinning SQLitePCLRaw.bundle_e_sqlite3 in the template works, but it puts a transitive dependency of Microsoft's into our template that we would then own and have to remember to remove. EF Core will move to 2.1.12 or later on its own, and the pin would become stale the moment it does.

Waiting for that instead. The branch fix/sqlite-advisory-nu1903 is left in place, so this can be reopened if the advisory turns out to need a faster response than upstream provides.

Holding #524 until then, since making the workflow able to fail while this is outstanding would leave dev red.