From 309429b5812e5cae1290ff71458f67eb85ed73a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ricardo=20Gro=C3=9F?= <ricardo@mr-gross.de>
Date: Wed, 28 Oct 2026 11:21:38 +0100
Subject: [PATCH] chore: pin SQLitePCLRaw 2.1.14 in the test project for
 CVE-2025-6965

EF Core Sqlite 10.0.0, the floor the test project pins, brings
SQLitePCLRaw 2.1.11 and SQLite 3.49.1 with it. 2.1.14 ships SQLite 3.54.
Only the native library moves: EF Core and Microsoft.Data.Sqlite stay at
10.0.0. The EfFloat lane drops the pin, since a floated patch brings its
own and a later one would fail the restore as a downgrade. Dependabot
ignores SQLitePCLRaw majors.

Closes #202

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml                                       | 4 ++++
 test/Directory.Build.targets                                 | 3 +++
 .../EFCore.ComplexIndexes.Tests.csproj                       | 5 +++++
 3 files changed, 12 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e1c1039..6bf4aff 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -50,6 +50,10 @@ updates:
     ignore:
       - dependency-name: "Microsoft.EntityFrameworkCore*"
       - dependency-name: "Npgsql.EntityFrameworkCore.PostgreSQL*"
+      # Pinned for a SQLite advisory (#202). 3.x renames the native package, and
+      # Microsoft.Data.Sqlite 10 is built against 2.x.
+      - dependency-name: "SQLitePCLRaw.*"
+        update-types: [ "version-update:semver-major" ]
       - dependency-name: "System.Security.Cryptography.Xml"
       - dependency-name: "System.Security.Cryptography.Pkcs"
 
diff --git a/test/Directory.Build.targets b/test/Directory.Build.targets
index 7537dd0..da4391f 100644
--- a/test/Directory.Build.targets
+++ b/test/Directory.Build.targets
@@ -22,6 +22,9 @@
         <PackageReference Update="Microsoft.EntityFrameworkCore.Sqlite" Version="$(EfFloat)" />
         <PackageReference Update="Microsoft.EntityFrameworkCore.SqlServer" Version="$(EfFloat)" />
         <PackageReference Update="Microsoft.EntityFrameworkCore.Design" Version="$(EfFloat)" />
+        <!-- The SQLitePCLRaw pin exists for the floor (#202). A floated patch brings its own, and a
+             later one than the pin would fail the restore as a downgrade (NU1605). -->
+        <PackageReference Remove="SQLitePCLRaw.bundle_e_sqlite3" />
     </ItemGroup>
 
     <ItemGroup Condition="'$(NpgsqlEfFloat)' != ''">
diff --git a/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj b/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
index 36020dc..f544a5f 100644
--- a/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
+++ b/test/EFCore.ComplexIndexes.Tests/EFCore.ComplexIndexes.Tests.csproj
@@ -22,6 +22,11 @@
             <PrivateAssets>none</PrivateAssets>
             <IncludeAssets>all</IncludeAssets>
         </PackageReference>
+        <!-- EF Core Sqlite 10.0.0 brings SQLitePCLRaw 2.1.11, whose native SQLite 3.49.1 has
+             CVE-2025-6965 (#202). 2.1.12 and later ship SQLite 3.53. Only the native library
+             moves: Microsoft.Data.Sqlite stays at the floor, and no package under src/ references
+             SQLite. test/Directory.Build.targets drops the pin when EF Core floats. -->
+        <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.14" />
         <PackageReference Include="MSTest" Version="4.5.1" />
         <PackageReference Include="Testcontainers.MsSql" Version="4.16.0" />
         <PackageReference Include="Testcontainers.PostgreSql" Version="4.16.0" />