CommunityToolkit / CommunityToolkit/AI
Bump Microsoft.Data.Sqlite dependency when new version becomes available
- Dominant language
- C#
- Stars
- 7
- Forks
- 4
- Avg merge
- 5h 54m
- Merged PRs (30d)
- 8
Description
In https://github.com/CommunityToolkit/AI/pull/17, we have added a direct dependency to `SQLitePCLRaw.bundle_e_sqlite3` package in order to avoid getting NU1902/NU1903 errors due to known vulnerabilities:
- `SQLitePCLRaw.bundle_e_sqlite3` 3.0.3 (fixes GHSA-2m69-gcr7-jv3q)
Once a new version of `Microsoft.Data.Sqlite` gets released and it references newer versions, we need to remove:
https://github.com/CommunityToolkit/AI/blob/e966e4f56b1ec2ded2a5bbeb0c723ab05f4b28d9/MEVD/src/SqliteVec/SqliteVec.csproj#L20
https://github.com/CommunityToolkit/AI/blob/1697580470910074cdf0890d27fa7e06111688df/Directory.Packages.props#L24
And bump `Microsoft.Data.Sqlite` here:
https://github.com/CommunityToolkit/AI/blob/1697580470910074cdf0890d27fa7e06111688df/Directory.Packages.props#L15
Contributor guide
Assessment
This issue has not been assessed yet.