From 3324f83da48386ba2b22fee97400801d5c88147a Mon Sep 17 00:00:00 2001
From: Kevin Hahn <kevin_hahn@sil.org>
Date: Thu, 16 Jul 2026 16:49:10 +0700
Subject: [PATCH] Fix NU1903 vulnerability warning for transitive SQLitePCLRaw
 dependency

EF Core 10.0.7 (and all current 10.x releases) pull in SQLitePCLRaw
2.1.11 transitively, which has a known high severity vulnerability
(GHSA-2m69-gcr7-jv3q). Enable central transitive pinning and pin the
SQLitePCLRaw bundle to the patched 2.1.12 release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Directory.Packages.props | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 6c90d98..b669336 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -1,11 +1,15 @@
 <Project>
   <PropertyGroup>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
+    <CentralPackageTransitivePinningEnabled>true</CentralPackageTransitivePinningEnabled>
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.7" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.7" />
     <PackageVersion Include="Microsoft.EntityFrameworkCore" Version="10.0.7" />
+    <!-- Transitive pin: EF Core 10.0.7 pulls SQLitePCLRaw 2.1.11, which has a known high severity
+         vulnerability (GHSA-2m69-gcr7-jv3q / NU1903). 2.1.12 is the patched release. -->
+    <PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.12" />
     <PackageVersion Include="Microsoft.Testing.Platform" Version="2.0.0" />
     <PackageVersion Include="Nito.AsyncEx.Coordination" Version="5.1.2" />
     <PackageVersion Include="System.IO.Hashing" Version="10.0.7" />