Skip to content

.NET 10 migration and SQLite test dependency hardening - #1

Merged
rodri-oliveira-dev merged 12 commits into
masterfrom
chore/net10-migration
Jul 26, 2026
Merged

.NET 10 migration and SQLite test dependency hardening#1
rodri-oliveira-dev merged 12 commits into
masterfrom
chore/net10-migration

Conversation

@rodri-oliveira-dev

Copy link
Copy Markdown
Owner

Summary

This draft PR publishes the current chore/net10-migration branch.

It includes the accumulated work from the branch lineage:

  • feature-modernizacao content, because chore/net10-migration was created from that branch
  • .NET 10 test migration documentation and validation work
  • xUnit 3 test migration
  • SQLite test dependency hardening for SQLitePCLRaw.lib.e_sqlite3

SQLite hardening

The latest commit pins SQLitePCLRaw.bundle_e_sqlite3 to 2.1.12 in test/Dapper.FluentMap.Tests with PrivateAssets="all", so the test graph resolves SQLitePCLRaw.lib.e_sqlite3 2.1.12 instead of vulnerable 2.1.11.

The affected chain was:

Microsoft.Data.Sqlite 10.0.10
  -> SQLitePCLRaw.bundle_e_sqlite3 2.1.11
      -> SQLitePCLRaw.lib.e_sqlite3 2.1.11

Advisory addressed: GHSA-2m69-gcr7-jv3q / CVE-2025-6965.

Validation

Validated locally before pushing:

  • dotnet restore
  • dotnet package list --project test/Dapper.FluentMap.Tests/Dapper.FluentMap.Tests.csproj --include-transitive
  • dotnet package list --project test/Dapper.FluentMap.Tests/Dapper.FluentMap.Tests.csproj --include-transitive --vulnerable
  • dotnet package list --project test/Dapper.FluentMap.Dommel.Tests/Dapper.FluentMap.Dommel.Tests.csproj --include-transitive --vulnerable
  • dotnet package list --project src/Dapper.FluentMap/Dapper.FluentMap.csproj --include-transitive --vulnerable
  • dotnet package list --project src/Dapper.FluentMap.Dommel/Dapper.FluentMap.Dommel.csproj --include-transitive --vulnerable
  • dotnet build --configuration Release
  • dotnet test test/Dapper.FluentMap.Tests/Dapper.FluentMap.Tests.csproj --configuration Release --no-build --filter FullyQualifiedName~DapperIntegrationTests
  • dotnet test test/Dapper.FluentMap.Tests/Dapper.FluentMap.Tests.csproj --configuration Release --no-build
  • dotnet test --configuration Release --no-build
  • dotnet pack src/Dapper.FluentMap/Dapper.FluentMap.csproj --configuration Release --no-build

Results:

  • SQLite/Dapper integration tests: 7/7 passed
  • Dapper.FluentMap.Tests: 45/45 passed
  • full Release test suite: 52/52 passed
  • NuGet vulnerability audit: no vulnerable packages reported for affected test project, Dommel test project, or src projects
  • production package inspection: no Microsoft.Data.Sqlite or SQLitePCLRaw.* dependency in Dapper.FluentMap.2.0.0.nupkg

Notes

This is intentionally opened as a draft because the branch was created from feature-modernizacao, not directly from master. Reviewers should confirm whether that branch lineage is intended for this PR.

@rodri-oliveira-dev rodri-oliveira-dev self-assigned this Jul 26, 2026
@rodri-oliveira-dev
rodri-oliveira-dev marked this pull request as ready for review July 26, 2026 10:46
@rodri-oliveira-dev
rodri-oliveira-dev merged commit 6a193d4 into master Jul 26, 2026
2 checks passed
@rodri-oliveira-dev
rodri-oliveira-dev deleted the chore/net10-migration branch July 26, 2026 10:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant