From 0eab6eb4c6c6b5eedfcec10b4ba415c2edb70e42 Mon Sep 17 00:00:00 2001 From: Tom Curran Date: Fri, 7 Aug 2026 12:38:11 +0100 Subject: [PATCH] Remove SQLitePCLRaw.bundle_green dependency from the package The library never uses SQLitePCL APIs directly and depends on sqlite-net-base precisely so consumers control their SQLitePCLRaw provider. Shipping bundle_green in the package nuspec takes that choice back: consumers with their own provider stack get duplicate batteries_v2 assemblies resolved silently by version, and every consumer inherits NU1903 audit warnings from the transitive lib.e_sqlite3 2.1.11 (GHSA-2m69-gcr7-jv3q) even when the vulnerable native never ships. The packed nuspec now depends only on sqlite-net-base. UnitTests gains its own explicit bundle_green reference (previously transitive via the library), matching what both sample apps already do. README updated to state the bundle choice belongs to the consumer. Fixes #17 Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_016q57YbzZxttLptRzv8Nbe5 --- README.md | 4 +++- .../SQLiteNetExtensions.Modern/SQLiteNetExtensions.csproj | 2 +- src/SQLiteNetExtensions.Modern/UnitTests/UnitTests.csproj | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4ba68af..1a7a7e6 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ You can update foreign keys manually if you feel more comfortable handling some ## Installation The easiest way of installing the library in your project is by adding a reference to [_SQLiteNetExtensions.Modern_ NuGet package](https://www.nuget.org/packages/SQLiteNetExtensions.Modern/). -This package uses `sqlite-net-base` so you need to also add a SQLitePCLRaw bundle. The recommended combination is: +This package uses `sqlite-net-base`, which deliberately ships **without** a SQLite provider — the package itself only depends on `sqlite-net-base`, so the choice of SQLitePCLRaw bundle/provider is entirely yours. You must add one to your app. The recommended combination is: ```xml @@ -72,6 +72,8 @@ This package uses `sqlite-net-base` so you need to also add a SQLitePCLRaw bundl ``` +Any other SQLitePCLRaw setup works too — e.g. `SQLitePCLRaw.config.e_sqlite3` + `SourceGear.sqlite3` (3.x line) if you want a current statically-linked SQLite under your own control. + > **Do not** use `sqlite-net-pcl 1.9.172` — it introduces a high-severity SQLite vulnerability via its bundled `SQLitePCLRaw.lib.e_sqlite3 2.1.2`. See the [Security](#security) section above. The NuGet package contains both sync and async extension versions. You can also download and compile the sources and add the reference to your compiled DLL, or add the SQLite-Net Extensions project as a dependency directly. diff --git a/src/SQLiteNetExtensions.Modern/SQLiteNetExtensions.Modern/SQLiteNetExtensions.csproj b/src/SQLiteNetExtensions.Modern/SQLiteNetExtensions.Modern/SQLiteNetExtensions.csproj index f1904f5..ad6a4c5 100644 --- a/src/SQLiteNetExtensions.Modern/SQLiteNetExtensions.Modern/SQLiteNetExtensions.csproj +++ b/src/SQLiteNetExtensions.Modern/SQLiteNetExtensions.Modern/SQLiteNetExtensions.csproj @@ -27,6 +27,7 @@ nuget.png SQLiteNetExtensions.Modern + * Removed the SQLitePCLRaw.bundle_green dependency - consumers now choose their own SQLitePCLRaw bundle/provider * Upgraded sqlite-net-base to 1.11.272-beta * Addresses SQLite high-severity vulnerability GHSA-2m69-gcr7-jv3q (use sqlite-net-base + SQLitePCLRaw.bundle_green >= 2.1.11 @@ -36,7 +37,6 @@ - diff --git a/src/SQLiteNetExtensions.Modern/UnitTests/UnitTests.csproj b/src/SQLiteNetExtensions.Modern/UnitTests/UnitTests.csproj index efee45e..ea40818 100644 --- a/src/SQLiteNetExtensions.Modern/UnitTests/UnitTests.csproj +++ b/src/SQLiteNetExtensions.Modern/UnitTests/UnitTests.csproj @@ -19,6 +19,7 @@ runtime; build; native; contentfiles; analyzers; buildtransitive +