Dependencies: Pin SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version (closes #23325)

[AndyButland]

Description

SQLitePCLRaw.lib.e_sqlite3 was resolving to the vulnerable 2.1.11 (GHSA-2m69-gcr7-jv3q, high severity). It is a purely transitive dependency, reached via Microsoft.Data.Sqlite (used by Umbraco.Cms.Persistence.Sqlite) and Microsoft.EntityFrameworkCore.Sqlite (used by the EF Core persistence projects), both of which pull it in through SQLitePCLRaw.bundle_e_sqlite3.

SQLitePCLRaw.lib.e_sqlite3 has been patched in 2.1.12 and we've run all Umbraco integration tests on this version, which pass (as CI on this PR should confirm).

I was waiting a few days for our direct dependencies to pin their versions on 2.1.12. However as yet they haven't. The latest available versions of those direct dependencies (Microsoft.Data.Sqlite / Microsoft.EntityFrameworkCore.Sqlite 10.0.10), released two days ago, still reference bundle_e_sqlite3 2.1.11, so there is no upstream floor bump to adopt yet.

As such, I think we'll need to pin Umbraco instead so we ship referencing a non-vulnerable version and avioid the build warnings.

This pins the transitive SQLitePCLRaw.lib.e_sqlite3 forward to the patched 2.1.12 in Directory.Packages.props, following the existing convention for transitive pinned versions. Only the native lib.e_sqlite3 package is flagged, so it is the sole package pinned.

Fixes #23325.

Testing

Solution should build and CI checks pass.

[claude]

Claude finished @AndyButland's task in 1m 32s —— View job

---

PR Review

Target: origin/release/17.6 · Based on commit: beec659 · Classified as: Config-only

Pins the transitive SQLitePCLRaw.lib.e_sqlite3 from vulnerable 2.1.11 to patched 2.1.12 to address GHSA-2m69-gcr7-jv3q (high severity).

---

No issues found. The change:

• Is correctly placed in the existing "Transitive pinned versions" <ItemGroup> alongside the Microsoft.OpenApi and other prior security pins
• Follows the established comment convention (explains the CVE, the packages pulling it in, and the exit condition)
• Will take effect automatically since CentralPackageTransitivePinningEnabled is true in the file

---

Approved

This looks good to be merged as-is, but please do a manual sanity check and testing before merging.

[Copilot]

Pull request overview

Pins the transitive NuGet dependency SQLitePCLRaw.lib.e_sqlite3 to a non-vulnerable version via Central Package Management, preventing resolution to the vulnerable 2.1.11 while upstream packages still reference bundle_e_sqlite3 2.1.11.

Changes:

• Adds a transitive pin for SQLitePCLRaw.lib.e_sqlite3 to 2.1.12 in Directory.Packages.props.
• Documents the rationale and advisory reference inline alongside other transitive pins.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud