[release/8.0] Switch Microsoft.Data.Sqlite and EFCore.Sqlite to SQLite3MC.PCLRaw.bundle#38534
Open
ViveliDuCh wants to merge 5 commits into
Open
[release/8.0] Switch Microsoft.Data.Sqlite and EFCore.Sqlite to SQLite3MC.PCLRaw.bundle#38534ViveliDuCh wants to merge 5 commits into
ViveliDuCh wants to merge 5 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Backports the SQLite bundle swap on release/8.0 so the shipped Microsoft.Data.Sqlite and Microsoft.EntityFrameworkCore.Sqlite packages depend on SQLite3MC.PCLRaw.bundle (instead of SQLitePCLRaw.bundle_e_sqlite3), addressing reported SQLite vulnerability concerns.
Changes:
- Update
Microsoft.Data.Sqliteto referenceSQLite3MC.PCLRaw.bundlev2.3.5. - Update
EFCore.Sqliteto referenceSQLite3MC.PCLRaw.bundlev2.3.5.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/Microsoft.Data.Sqlite/Microsoft.Data.Sqlite.csproj | Switch default bundled SQLite dependency to SQLite3MC.PCLRaw.bundle v2.3.5. |
| src/EFCore.Sqlite/EFCore.Sqlite.csproj | Switch default bundled SQLite dependency to SQLite3MC.PCLRaw.bundle v2.3.5. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
AndriySvyryd
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #38257
Backports #38402
Description
Backports #38402 to
release/8.0, switchingMicrosoft.Data.SqliteandMicrosoft.EntityFrameworkCore.Sqliteto the encryption-capableSQLite3MC.PCLRaw.bundle(2.3.5); unlikerelease/10.0, noSQLitePCLRawbump is needed since 8.0 doesn't use Central Package Management, so the product change is two inline.csprojedits. Breaking-change guidance is in dotnet/EntityFramework.Docs#5385.Customer impact
Gives net8.0 customers an actively maintained, encryption-capable native SQLite by default, replacing the aging
bundle_e_sqlite3that was flagged against known SQLite CVEs in #38257.How found
Raised by customers in #38257 asking that the vulnerable native SQLite dependency be updated or replaced.
Regression
No. This is a deliberate security/servicing alignment with net11.0 and a documented breaking change, not a regression fix.
Testing
Added a
Microsoft.Data.Sqlite.sqlite3mc.Testsproject and pointedEFCore.Sqlite.FunctionalTestsat SQLite3MC so CI exercises the shipped bundle; one functional test (Parameter_collection_Concat_column_collection) is skipped under #32561.Risk
Low-to-moderate; it swaps the default native SQLite engine but mirrors the change already validated in net11.0 preview 6 (#38402) and lets customers opt back into
bundle_e_sqlite3per the published guidance.Links