Skip to content

Remove obsolete methods to fix security vulnerability - #163

Open
Suchiman wants to merge 2 commits into
elsa-workflows:mainfrom
Suchiman:main
Open

Suchiman wants to merge 2 commits into
elsa-workflows:mainfrom
Suchiman:main

Conversation

@Suchiman

Copy link
Copy Markdown

Nuget reports a security vulnerability for SQLitePCLRaw.lib.e_sqlite3 which is included through the following dependency chain:

  [net10.0]
  └── Elsa.Scheduling.Hangfire (v3.7.0)
      └── Hangfire.Storage.SQLite (v0.4.2)
          └── sqlite-net-pcl (v1.8.116)
              └── SQLitePCLRaw.bundle_green (v2.0.4)
                  └── SQLitePCLRaw.lib.e_sqlite3 (v2.0.4)

There's no new version of SQLitePCLRaw.lib.e_sqlite3 available since its an obsolete package, so there's currently no way to upgrade out of this issue. The simplest fix is to remove the package and assorted methods that have already been obsoleted for more than a year.

@greptile-apps

greptile-apps Bot commented Jun 22, 2026

Copy link
Copy Markdown

PR author is not in the allowed authors list.

@arledesma

Copy link
Copy Markdown
Contributor

This package now has an update to 3.53.3

dotnet/efcore#38257 (comment)

In the next few days, I will do the same for the SQLitePCLRaw.lib.e_sqlite3 package. Going forward, I will post updates, free of cost and publicly on nuget.org, promptly after each SQLite release.

The SQLitePCLRaw.lib.e_sqlite3 package on nuget.org has now also been updated to SQLite 3.53.3:

https://www.nuget.org/packages/SQLitePCLRaw.lib.e_sqlite3/3.53.3

This version of SQLite addresses all known vulnerabilities. Updating to this version of the package should be straightforward. I will be monitoring the discussion here and issues in my own repo for any issues so that I can address them right away.

Also documented in ericsink/SQLitePCL.raw#662

@sfmskywalker

Copy link
Copy Markdown
Member

Triage: needs review — community/non-draft PR on main with no review decision yet.

@Suchiman

Copy link
Copy Markdown
Author

This package now has an update to 3.53.3

That's fair, however given that these methods are marked obsolete and this design forces you to have a non optional reference for an optional storage, that stays in your output during publish of non trivial size, i'd still vote for removal

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants