Fix CVE: Replace SQLitePCLRaw packages vulnerable to GHSA-2m69-gcr7-jv3q - #37
Fix CVE: Replace SQLitePCLRaw packages vulnerable to GHSA-2m69-gcr7-jv3q#37bkwatt wants to merge 4 commits into
Conversation
Replaces packages with a transitive dependency on SQLitePCLRaw.lib.e_sqlite3 v2.1.11, which is flagged as vulnerable by GitHub. Note: No stable (non-beta) release of sqlite-net-pcl without this dependency exists at the time of this commit. The beta is used as the best available option. SQLitePCLRaw.bundle_green has been discontinued by the author and is not required, as sqlite-net-pcl pulls in the needed dependencies directly.
bkwatt
changed the title
|
@dotMorten Hi Morten would it be possible to get this package update in? |
| <PackageReference Include="Microsoft.TestPlatform.Extensions.TrxLogger" Version="17.11.0" /> | ||
| <PackageReference Include="SQLitePCLRaw.bundle_green" Version="2.1.0" /> | ||
| <PackageReference Include="sqlite-net-pcl" Version="1.8.116" /> | ||
| <PackageReference Include="sqlite-net-pcl" Version="1.11.272-beta" /> |
There was a problem hiding this comment.
I found and interesting conversation where ericsink suggested switching to sqlite-net-e.
Would that be acceptable?
Instead of waiting for an update (I'm on vacation right now), in your own application you can just explicitly specify the version you want to use as long as it is higher than what mstestx references. Just add this to your own project file:
It is still being used by the main package. The reason it was explicitly referenced was to get a newer version (basically same reason as what I suggest you do right above), but with the version you're pointing to, it's actually referencing an even newer version, and then yes it isn't necessary to explicitly reference the higher dependency any longer. |
Switching to sqlite-net-e as suggested by ericsink here: praeclarum/sqlite-net#1307 (comment) Also switched to SQLitePCLRaw.bundle_e_sqlite3 as SQLitePCLRaw.bundle_green has been deprecated
|
Hi @dotMorten sorry for stealing your time while you are on vacation :-) |
2 participants
GHSA-2m69-gcr7-jv3q
Replace packages with a transitive dependency on SQLitePCLRaw.lib.e_sqlite3
v2.1.11, which is flagged as vulnerable by GitHub.