Skip to content

Commit 597acf3

Browse files
CopilotCopilot
authored
Fix SQLitePCLRaw.lib.e_sqlite3 vulnerability by replacing SemanticKernel connectors with CommunityToolkit (#7579)
* Replace Microsoft.SemanticKernel.Connectors.SqliteVec with CommunityToolkit.VectorData.SqliteVec * Replace Microsoft.SemanticKernel.Connectors.InMemory with CommunityToolkit.VectorData.InMemory * Fix System.Linq.AsyncEnumerable downgrade in templates * Add SQLitePCLRaw.bundle_e_sqlite3 3.0.3 to ProjectTemplates.props and the AIChatWeb template to override the vulnerable transitive SQLitePCLRaw.lib.e_sqlite3 (2.1.11, GHSA-2m69-gcr7-jv3q) with the safe SourceGear.sqlite3 3.50.4.5 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
1 parent d2e069a commit 597acf3

10 files changed

Lines changed: 16 additions & 12 deletions

File tree

‎eng/Versions.props‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,6 @@
227227
<XUnitRunnerVisualStudioVersion>2.8.2</XUnitRunnerVisualStudioVersion>
228228
<!-- MEVD is still part of the Semantic Kernel repo -->
229229
<MicrosoftExtensionsVectorDataAbstractionsVersion>9.7.0</MicrosoftExtensionsVectorDataAbstractionsVersion>
230-
<MicrosoftSemanticKernelConnectorsVersion>1.67.0-preview</MicrosoftSemanticKernelConnectorsVersion>
231230
<MarkdigSignedVersion>0.43.0</MarkdigSignedVersion>
232231
</PropertyGroup>
233232
</Project>

‎eng/packages/ProjectTemplates.props‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,9 @@
2828
<PackageVersion Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="$(MicrosoftMLTokenizersVersion)" />
2929
<PackageVersion Include="Microsoft.SemanticKernel.Connectors.AzureAISearch" Version="1.67.1-preview" />
3030
<PackageVersion Include="Microsoft.SemanticKernel.Connectors.Qdrant" Version="1.67.1-preview" />
31-
<PackageVersion Include="Microsoft.SemanticKernel.Connectors.SqliteVec" Version="1.67.1-preview" />
31+
<PackageVersion Include="CommunityToolkit.VectorData.SqliteVec" Version="1.0.0-preview.3" />
32+
<PackageVersion Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
33+
<PackageVersion Update="System.Linq.AsyncEnumerable" Version="10.0.6" />
3234
<PackageVersion Include="ModelContextProtocol" Version="1.2.0" />
3335
<PackageVersion Include="ModelContextProtocol.AspNetCore" Version="1.2.0" />
3436
<PackageVersion Include="OllamaSharp" Version="5.4.12" />

‎eng/packages/Tests.props‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@
1515
<PackageVersion Include="Microsoft.Extensions.Configuration.UserSecrets" Version="9.0.0" />
1616
<PackageVersion Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="$(MicrosoftMLTokenizersVersion)" />
1717
<PackageVersion Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="$(MicrosoftMLTokenizersVersion)" />
18-
<PackageVersion Include="Microsoft.SemanticKernel.Connectors.InMemory" Version="$(MicrosoftSemanticKernelConnectorsVersion)" />
19-
<PackageVersion Include="Microsoft.SemanticKernel.Connectors.SqliteVec" Version="$(MicrosoftSemanticKernelConnectorsVersion)" />
18+
<PackageVersion Include="CommunityToolkit.VectorData.InMemory" Version="1.0.0-preview.3" />
19+
<PackageVersion Include="CommunityToolkit.VectorData.SqliteVec" Version="1.0.0-preview.3" />
2020
<PackageVersion Include="Microsoft.TemplateEngine.Authoring.TemplateVerifier" Version="9.0.201" />
2121
<PackageVersion Include="Microsoft.TemplateEngine.TestHelper" Version="9.0.200-rtm.25066.4" />
2222
<PackageVersion Include="Moq" Version="4.18.4" />

‎src/ProjectTemplates/Microsoft.Extensions.AI.Templates/templates/AIChatWeb-CSharp/AIChatWeb-CSharp.Web/AIChatWeb-CSharp.Web.csproj-in‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,8 @@
5353
<PackageReference Include="Aspire.Qdrant.Client" Version="${PackageVersion:Aspire.Qdrant.Client}" />
5454
<PackageReference Include="Microsoft.SemanticKernel.Connectors.Qdrant" Version="${PackageVersion:Microsoft.SemanticKernel.Connectors.Qdrant}" />
5555
<!--#elif (IsLocalVectorStore)-->
56-
<PackageReference Include="Microsoft.SemanticKernel.Connectors.SqliteVec" Version="${PackageVersion:Microsoft.SemanticKernel.Connectors.SqliteVec}" />
56+
<PackageReference Include="CommunityToolkit.VectorData.SqliteVec" Version="${PackageVersion:CommunityToolkit.VectorData.SqliteVec}" />
57+
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="${PackageVersion:SQLitePCLRaw.bundle_e_sqlite3}" />
5758
<!--#endif -->
5859
</ItemGroup>
5960
<!--#if (IsAspire) -->

‎test/Libraries/Microsoft.Extensions.DataIngestion.Tests/IngestionPipelineTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,9 @@
88
using System.Linq;
99
using System.Threading;
1010
using System.Threading.Tasks;
11+
using CommunityToolkit.VectorData.InMemory;
1112
using Microsoft.Extensions.AI;
1213
using Microsoft.ML.Tokenizers;
13-
using Microsoft.SemanticKernel.Connectors.InMemory;
1414
using OpenTelemetry;
1515
using OpenTelemetry.Resources;
1616
using OpenTelemetry.Trace;

‎test/Libraries/Microsoft.Extensions.DataIngestion.Tests/Microsoft.Extensions.DataIngestion.Tests.csproj‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@
2222
<PackageReference Include="DocumentFormat.OpenXml" />
2323
<PackageReference Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" />
2424
<PackageReference Include="Microsoft.ML.Tokenizers.Data.O200kBase" />
25-
<PackageReference Include="Microsoft.SemanticKernel.Connectors.InMemory" />
26-
<PackageReference Include="Microsoft.SemanticKernel.Connectors.SqliteVec" />
25+
<PackageReference Include="CommunityToolkit.VectorData.InMemory" />
26+
<PackageReference Include="CommunityToolkit.VectorData.SqliteVec" />
2727
<!-- Lift CVE-impacted transitive dependency; remove once the direct dependency updates. -->
2828
<PackageReference Include="OpenTelemetry.Api" />
2929
<PackageReference Include="OpenTelemetry.Exporter.InMemory" />

‎test/Libraries/Microsoft.Extensions.DataIngestion.Tests/Writers/InMemoryVectorStoreWriterTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
// Licensed to the .NET Foundation under one or more agreements.
22
// The .NET Foundation licenses this file to you under the MIT license.
33

4+
using CommunityToolkit.VectorData.InMemory;
45
using Microsoft.Extensions.VectorData;
5-
using Microsoft.SemanticKernel.Connectors.InMemory;
66

77
namespace Microsoft.Extensions.DataIngestion.Writers.Tests;
88

‎test/Libraries/Microsoft.Extensions.DataIngestion.Tests/Writers/SqliteVectorStoreWriterTests.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
using System;
55
using System.IO;
6+
using CommunityToolkit.VectorData.SqliteVec;
67
using Microsoft.Extensions.VectorData;
7-
using Microsoft.SemanticKernel.Connectors.SqliteVec;
88

99
namespace Microsoft.Extensions.DataIngestion.Writers.Tests;
1010

‎test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb.A.verified/aichatweb/aichatweb.Web/aichatweb.Web.csproj‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@
1616
<PackageReference Include="Microsoft.Extensions.DataIngestion.MarkItDown" Version="{VERSION}" />
1717
<PackageReference Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="{VERSION}" />
1818
<PackageReference Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="{VERSION}" />
19-
<PackageReference Include="Microsoft.SemanticKernel.Connectors.SqliteVec" Version="{VERSION}" />
19+
<PackageReference Include="CommunityToolkit.VectorData.SqliteVec" Version="{VERSION}" />
20+
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="{VERSION}" />
2021
</ItemGroup>
2122

2223
<ItemGroup>

‎test/ProjectTemplates/Microsoft.Extensions.AI.Templates.IntegrationTests/Snapshots/aichatweb/aichatweb._defaults.verified/aichatweb/aichatweb.csproj‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@
1515
<PackageReference Include="PdfPig" Version="{VERSION}" />
1616
<PackageReference Include="Microsoft.ML.Tokenizers.Data.Cl100kBase" Version="{VERSION}" />
1717
<PackageReference Include="Microsoft.ML.Tokenizers.Data.O200kBase" Version="{VERSION}" />
18-
<PackageReference Include="Microsoft.SemanticKernel.Connectors.SqliteVec" Version="{VERSION}" />
18+
<PackageReference Include="CommunityToolkit.VectorData.SqliteVec" Version="{VERSION}" />
19+
<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="{VERSION}" />
1920
</ItemGroup>
2021

2122
</Project>

0 commit comments

Comments
 (0)