fix(deps): pin SQLitePCLRaw.lib.e_sqlite3 to 3.50.3 (CVE-2025-6965) (#122)

The Sqlite-backed test projects pull SQLitePCLRaw.lib.e_sqlite3 2.1.11
transitively via Microsoft.Data.Sqlite. It bundles SQLite < 3.50.2 and is
flagged by GHSA-2m69-gcr7-jv3q (CVE-2025-6965); NuGetAudit raises NU1903,
failing the build under TreatWarningsAsErrors.

Pin the native binary to 3.50.3 (SQLite 3.50.3) in the four affected test
projects only; shipping libraries are untouched. core/provider stay on 2.x
(the sqlite3 C ABI is stable). Revert once Microsoft.Data.Sqlite ships a
bumped SQLitePCLRaw.

Co-authored-by: MarcelRoozekrans <claude@roozekrans.nl>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

tests/System.Data.Async.Adapters.Tests/System.Data.Async.Adapters.Tests.csproj

@@ -17,6 +17,10 @@
     <PackageReference Include="NSubstitute" Version="5.*" />
     <PackageReference Include="FluentAssertions" Version="8.1*" />
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.*" />
+    <!-- CVE-2025-6965 / GHSA-2m69-gcr7-jv3q: override the vulnerable native SQLite
+         binary (SQLitePCLRaw.lib.e_sqlite3 2.1.11, SQLite < 3.50.2) pulled in
+         transitively by Microsoft.Data.Sqlite. 3.50.3 ships SQLite 3.50.3. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.50.3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.*" />
   </ItemGroup>
 </Project>

tests/System.Data.Async.AotSmoke/System.Data.Async.AotSmoke.csproj

@@ -29,6 +29,10 @@
          the in-memory connection string keeps the smoke test hermetic — no Docker, no
          disk I/O, no service container required from the CI runner. -->
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.*" />
+    <!-- CVE-2025-6965 / GHSA-2m69-gcr7-jv3q: override the vulnerable native SQLite
+         binary (SQLitePCLRaw.lib.e_sqlite3 2.1.11, SQLite < 3.50.2) pulled in
+         transitively by Microsoft.Data.Sqlite. 3.50.3 ships SQLite 3.50.3. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.50.3" />
     <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="10.*" />
   </ItemGroup>
 </Project>

tests/System.Data.Async.Benchmarks/System.Data.Async.Benchmarks.csproj

@@ -20,5 +20,9 @@
   <ItemGroup>
     <PackageReference Include="BenchmarkDotNet" Version="0.1*" />
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.*" />
+    <!-- CVE-2025-6965 / GHSA-2m69-gcr7-jv3q: override the vulnerable native SQLite
+         binary (SQLitePCLRaw.lib.e_sqlite3 2.1.11, SQLite < 3.50.2) pulled in
+         transitively by Microsoft.Data.Sqlite. 3.50.3 ships SQLite 3.50.3. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.50.3" />
   </ItemGroup>
 </Project>

tests/System.Data.Async.Validation.Tests/System.Data.Async.Validation.Tests.csproj

@@ -15,6 +15,10 @@
     <PackageReference Include="xunit.runner.visualstudio" Version="3.*" />
     <PackageReference Include="FluentAssertions" Version="8.1*" />
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.*" />
+    <!-- CVE-2025-6965 / GHSA-2m69-gcr7-jv3q: override the vulnerable native SQLite
+         binary (SQLitePCLRaw.lib.e_sqlite3 2.1.11, SQLite < 3.50.2) pulled in
+         transitively by Microsoft.Data.Sqlite. 3.50.3 ships SQLite 3.50.3. -->
+    <PackageReference Include="SQLitePCLRaw.lib.e_sqlite3" Version="3.50.3" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
 </Project>