Remove SQLitePCLRaw.bundle_green dependency from the package - #18
Open
tomcurran wants to merge 1 commit into
Open
Remove SQLitePCLRaw.bundle_green dependency from the package#18tomcurran wants to merge 1 commit into
tomcurran wants to merge 1 commit into
Conversation
The library never uses SQLitePCL APIs directly and depends on sqlite-net-base precisely so consumers control their SQLitePCLRaw provider. Shipping bundle_green in the package nuspec takes that choice back: consumers with their own provider stack get duplicate batteries_v2 assemblies resolved silently by version, and every consumer inherits NU1903 audit warnings from the transitive lib.e_sqlite3 2.1.11 (GHSA-2m69-gcr7-jv3q) even when the vulnerable native never ships. The packed nuspec now depends only on sqlite-net-base. UnitTests gains its own explicit bundle_green reference (previously transitive via the library), matching what both sample apps already do. README updated to state the bundle choice belongs to the consumer. Fixes yurkinh#17 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016q57YbzZxttLptRzv8Nbe5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the proposal in #17: the packed
SQLiteNetExtensions.Modernnuspec now depends only onsqlite-net-base, leaving the SQLitePCLRaw bundle/provider choice to consumers — which is what the README's Security section already describes as the design intent.Changes
SQLiteNetExtensions.csproj: removed theSQLitePCLRaw.bundle_green 2.1.11PackageReference(the library never usesSQLitePCL.*APIs directly;SQLitePCLRaw.corestill arrives viasqlite-net-base). Added a release-notes bullet.UnitTests.csproj: added an explicitSQLitePCLRaw.bundle_green 2.1.11reference — the tests need a native provider at runtime and previously got it transitively via the library. This matches what both sample apps already do.README.md: Installation section now states the package ships without a provider and the bundle choice is the consumer's, with a note that other SQLitePCLRaw setups (e.g.config.e_sqlite3+SourceGear.sqlite3) work too.Why
SQLitePCLRaw.batteries_v2.dllassemblies in the graph, silently resolved by assembly version.NU1903audit warnings from the transitivelib.e_sqlite3 2.1.11(GHSA-2m69-gcr7-jv3q, no patched 2.x exists), breaking CI with audit gates even when the vulnerable native never ships. This also addresses SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite #16 at the root.bundle_greenimplies the Apple-OS-provided SQLite — a surprising default the consumer should opt into, not inherit.Verification
dotnet buildof the library succeeds.dotnet testUnitTests: 16/16 pass.dotnet packoutput nuspec dependencies:Note: this is technically breaking for consumers who relied on the implicit bundle — they now need to add a bundle reference themselves (the README already instructed them to). A minor version bump on release seems appropriate; happy to adjust
PackageVersionif you tell me the number you want.🤖 Generated with Claude Code
https://claude.ai/code/session_016q57YbzZxttLptRzv8Nbe5