deps(dotnet): Bump sqlite-net-pcl from 1.9.172 to 1.11.285

[dependabot]

Updated sqlite-net-pcl from 1.9.172 to 1.11.285.

Release notes

Sourced from sqlite-net-pcl's releases.

No release notes found for this version range.

Commits viewable in compare view.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

AI Analysis

Technical Summary of the Pull Request

Title:
deps(dotnet): Bump sqlite-net-pcl from 1.9.172 to 1.11.285

---

Technical Requirements and Constraints

• Dependency Update: The PR updates the sqlite-net-pcl NuGet package from version 1.9.172 to 1.11.285.
• Compatibility: The update should maintain compatibility with the existing codebase targeting .NET platforms supported by sqlite-net-pcl.
• No release notes provided: There are no specific release notes for versions between 1.9.172 and 1.11.285, so changes introduced within that range must be verified through the upstream commit history or testing.
• Automatic conflict resolution: Dependabot is managing conflicts and rerunning rebases automatically unless manually interrupted.

Implementation Considerations

• API changes: Possible new or deprecated APIs in the updated version could require code adjustments.
• **Dependency management

---

This summary was automatically generated by AI to help with triage and may not be 100% accurate.

Suggested Labels: test

[karlspace]

Reviewed, but not merging yet: this update needs a decision about the SQLCipher bundle first.

What changes: sqlite-net-pcl 1.11.285 moves from SQLitePCLRaw 2.x (bundle_green) to SQLitePCLRaw 3.x (SQLitePCLRaw.core 3.0.3, provider.e_sqlite3 3.0.3, SourceGear.sqlite3 3.53.3). There are no GitHub release notes for 1.10/1.11; this comes from the nuspec and the commit range. No public API changes found.

Security (the reason this matters): today's build pulls SQLitePCLRaw.lib.e_sqlite3 2.1.2, flagged by CI as high severity (GHSA-2m69-gcr7-jv3q, SQLite < 3.50.2). 1.11.285 no longer uses that package; SourceGear.sqlite3 3.53.3 is above the fixed version. So this update does resolve the advisory for the sqlite-net path.

The conflict: BAUERGROUP.Shared.Data also references SQLitePCLRaw.bundle_e_sqlcipher 2.1.11.

• There is no 3.x of any e_sqlcipher package; 2.1.11 is deprecated as "Legacy" (SQLitePCLRaw v3 notes: free encryption builds are discontinued).
• sqlite-net 1.11 always initializes the e_sqlite3 provider, so the SQLCipher bundle would be inert anyway, while its native library (released before SQLite 3.50.2) likely still carries the same flaw (inferred from its release date, not verified).
• The library itself does not use SQLCipher: no SQLitePCL, Batteries or encryption key usage in src/; ConcurrentPersistentDictionary opens a plain SQLiteConnection.

Option	Effect	Risk
A (recommended) Merge this and remove SQLitePCLRaw.bundle_e_sqlcipher from Directory.Packages.props and BAUERGROUP.Shared.Data.csproj	Advisory resolved, clean 3.x dependency graph	Consumers that rely on SQLCipher transitively through Shared.Data lose it; should ship with a BREAKING CHANGE: note. SQLitePCLRaw 3 needs .NET Framework ≥ 4.7.1 for netstandard2.0 consumers.
B Merge this, keep the SQLCipher bundle	Advisory resolved for sqlite-net	Mixed 2.x/3.x graph, SQLCipher silently inactive, deprecated and probably vulnerable native library still shipped
C Keep 1.9.172	No change	High-severity advisory stays open

Open question before A: does any consuming application (e.g. OT-AutomationClient) open encrypted SQLite databases through this package? If not, A is a one-line removal plus this PR.

[karlspace]

Merged in 3ddea44 together with the SQLCipher removal in 502c28a, per your decision.

sqlite-net-pcl 1.11.285 moves to SQLitePCLRaw 3.x (SQLitePCLRaw.core 3.0.3, provider.e_sqlite3 3.0.3, SourceGear.sqlite3 3.53.3), which resolves the high-severity advisory GHSA-2m69-gcr7-jv3q that SQLitePCLRaw.lib.e_sqlite3 2.1.2 carried. dotnet list package --vulnerable --include-transitive no longer reports it for Shared.Data; only the build-time Microsoft.Build.Tasks.Git advisory remains (SourceLink, not shipped).

SQLitePCLRaw.bundle_e_sqlcipher is gone, since no 3.x exists and nothing in the library used it. Shipping as a breaking change in 4.0.0 with a migration note for applications that opened encrypted databases through it. The ConcurrentPersistentDictionary tests pass on the new native provider.

[github-actions]

🎉 This PR is included in version 4.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀