Remove temporary SQLitePCLRaw native SQLite vulnerability workaround #2

New issue

Open

opened 2026-07-25 20:53:54 +00:00 by sleepless · 0 comments

sleepless commented

2026-07-25 20:53:54 +00:00

Owner

Auzi temporarily pins SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 to work around CVE-2025-6965 / GHSA-2m69-gcr7-jv3q, following the approach described in microsoft/EventLogExpert#604.

Remove this workaround once Microsoft.Data.Sqlite / Microsoft.EntityFrameworkCore.Sqlite ship a version that transitively resolves a non-vulnerable native SQLite bundle. Upstream tracking: dotnet/efcore#38257, with related fix PR dotnet/efcore#38402.

Edit: Updated the temporary pin to 3.53.3 in e3bb704d5b.

Auzi [temporarily](https://source.tube/sleepless/auzi/commit/350ad8b8f41e10a2786e612430aa728f642f56cc) pins `SQLitePCLRaw.lib.e_sqlite3` to `3.50.3` to work around [CVE-2025-6965 / GHSA-2m69-gcr7-jv3q](https://github.com/advisories/GHSA-2m69-gcr7-jv3q), following the approach described in [microsoft/EventLogExpert#604](https://github.com/microsoft/EventLogExpert/issues/604). Remove this workaround once `Microsoft.Data.Sqlite` / `Microsoft.EntityFrameworkCore.Sqlite` ship a version that transitively resolves a non-vulnerable native SQLite bundle. Upstream tracking: [dotnet/efcore#38257](https://github.com/dotnet/efcore/issues/38257), with related fix PR [dotnet/efcore#38402](https://github.com/dotnet/efcore/pull/38402). **Edit:** Updated the temporary pin to `3.53.3` in https://source.tube/sleepless/auzi/commit/e3bb704d5ba76f1c734f66adef53f6ed935bc26d.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

sleepless/auzi#2

No description provided.

Rows
Columns