Skip to content

Fix SQLitePCLRaw vulnerability warnings in examples - #8277

Closed
orange-dot wants to merge 1 commit into
akkadotnet:devfrom
orange-dot:fix/sqlitepclraw-nu1903
Closed

Fix SQLitePCLRaw vulnerability warnings in examples#8277
orange-dot wants to merge 1 commit into
akkadotnet:devfrom
orange-dot:fix/sqlitepclraw-nu1903

Conversation

@orange-dot

Copy link
Copy Markdown
Contributor

Summary

  • Pin SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 in the SQLite-backed examples.
  • Keep the existing Microsoft.Data.Sqlite and Akka.Persistence.Sql package versions unchanged.

Root cause

CodeQL autobuild restores the solution with warnings as errors. These example projects resolved vulnerable transitive SQLitePCLRaw.lib.e_sqlite3 versions, which triggered NU1903 for GHSA-2m69-gcr7-jv3q.

Validation

  • dotnet restore src/examples/Akka.Persistence.Custom/Akka.Persistence.Custom.csproj
  • dotnet restore src/examples/Akka.Persistence.Custom.Tests/Akka.Persistence.Custom.Tests.csproj
  • dotnet restore src/examples/Cluster/ClusterSharding/ClusterSharding.Node/ClusterSharding.Node.csproj
  • dotnet build -c Release --no-restore src/examples/Akka.Persistence.Custom/Akka.Persistence.Custom.csproj
  • dotnet build -c Release --no-restore src/examples/Cluster/ClusterSharding/ClusterSharding.Node/ClusterSharding.Node.csproj
  • confirmed project.assets.json resolves SQLitePCLRaw.lib.e_sqlite3/3.50.3 for the affected projects
  • confirmed the pushed commit is GPG signed and GitHub verified

@Aaronontheweb

Copy link
Copy Markdown
Member

Not sure this is the right fix, because SQLitePCLRaw.lib.e_sqlite 3.50.3 is an unlisted version probably for a good reason.

I dealt with this over the weekend on another Akka.NET-based project netclaw-dev/netclaw#1444 - just suppressed it for the time being, because there is an upstream fix on the way: dotnet/efcore#38402

@Aaronontheweb

Aaronontheweb commented Jun 22, 2026

Copy link
Copy Markdown
Member

I appreciate you trying to fix this though!

@Aaronontheweb Aaronontheweb reopened this Jun 22, 2026
@Aaronontheweb

Copy link
Copy Markdown
Member

Whoops, didn't mean to close it lol

@orange-dot

Copy link
Copy Markdown
Contributor Author

I will close it, no worries.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants