fix(deps): pin SQLitePCLRaw to 3.0.3 to fix CVE-2025-6965

[jas88]

Summary

• Fixes NU1903 build error: SQLitePCLRaw.lib.e_sqlite3 2.1.11 has a known high severity vulnerability (GHSA-2m69-gcr7-jv3q / CVE-2025-6965).
• The vulnerable lib ships SQLite < 3.50.2 with a memory-corruption flaw via aggregate terms exceeding column count. No fix exists in the 2.1.x line.
• Pin SQLitePCLRaw.bundle_e_sqlite3 and SQLitePCLRaw.core to 3.0.3 in Directory.Packages.props. With central package transitive pinning already enabled, this forces the chain FAnsiSql.Legacy → FAnsiSql.Sqlite → Microsoft.Data.Sqlite 10.0.x → bundle_e_sqlite3 to resolve to 3.0.3, which uses SourceGear.sqlite3 3.50.4 (patched) and drops the vulnerable lib.e_sqlite3 entirely.

Why not suppress NU1903?

Real CVE; preferable to ship the patched native lib than to mask the warning.

Why not wait for Microsoft.Data.Sqlite 11.0?

11.0 ships with .NET 11 in November 2026 (~5 months out). Currently at Preview 5. Not waiting that long with CI red.

Why is the SQLitePCLRaw 2.x → 3.x major bump safe?

Rdmp.Core/Startup/Startup.cs registers only the MS SQL / MySQL / Oracle / PostgreSQL FAnsi implementations; the SQLite implementation is pulled in transitively via FAnsiSql.Legacy but is never ImplementationManager.Load-ed and the native bridge is therefore never invoked at runtime.

Test plan

• dotnet restore succeeds for Rdmp.Core.csproj
• dotnet nuget why Rdmp.Core SQLitePCLRaw.lib.e_sqlite3 reports no dependency
• dotnet build Rdmp.Core -c Release succeeds with 0 errors
• dotnet build Rdmp.Core.Tests -c Release succeeds with 0 errors
• CI passes

---

Summary by cubic

Pin SQLitePCLRaw.bundle_e_sqlite3 and SQLitePCLRaw.core to 3.0.3 to remove the vulnerable SQLitePCLRaw.lib.e_sqlite3 and resolve NU1903. This adopts SourceGear.sqlite3 3.50.4 and fixes CVE-2025-6965 (GHSA-2m69-gcr7-jv3q).

• Dependencies

  • Pinned SQLitePCLRaw.bundle_e_sqlite3 3.0.3 and SQLitePCLRaw.core 3.0.3 in Directory.Packages.props.
  • Central pin forces FAnsiSql.Legacy → FAnsiSql.Sqlite → Microsoft.Data.Sqlite to resolve to 3.0.3.
  • Drops lib.e_sqlite3; uses SourceGear.sqlite3 3.50.4 (patched).
  • Safe bump: the SQLite implementation is not loaded at runtime in Rdmp.Core.

• Bug Fixes

  • Fixes NU1903 build error for SQLitePCLRaw.lib.e_sqlite3 (high severity vulnerability).

^{Written for commit 0c62621. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (4ada0a5) to head (0c62621).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #237   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files       1118    1118           
  Lines      66302   66302           
  Branches    8767    8767           
=====================================
  Misses     66302   66302           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jas88]

Closing in favour of upstream fix at jas88/FAnsiSql#166 — pinning SQLitePCLRaw at the FAnsiSql layer is the right home for it. Once FAnsiSql 3.6.4 is tagged and published, a smaller PR here will just bump FAnsiSql.Legacy.