From 1e417caa539661e0be17dce5494c9f18e3b6f4d1 Mon Sep 17 00:00:00 2001 From: Andrew Skowronski Date: Tue, 15 Sep 2026 09:25:30 -0400 Subject: [PATCH] [#100] Update SQLite to 3.53.3 to mitigate CVE-2025-6965 Bump Microsoft.Data.Sqlite from 9.0.1 to 9.0.20 in Analyzer and ReferenceFinder. 9.0.20 requires SQLitePCLRaw.bundle_e_sqlite3 2.1.12, which bundles SQLite 3.53.3 -- past the 3.50.2 fix for CVE-2025-6965 (and the 3.53.2 fix for the FTS5 memory-corruption CVEs). No explicit SQLitePCLRaw pin is needed. When this was first investigated the newest native package carried SQLite 3.49.1, still affected; 2.1.12 shipped in July 2026 and Microsoft.Data.Sqlite 9.0.19+ depends on it. The 2.1.12 native build is compiled with SQLITE_DQS=0, so double-quoted string literals no longer fall back from a failed identifier lookup. Production SQL was already clean, but four literals in AddressablesBuildLayoutTests needed converting to single quotes. Co-Authored-By: Claude Opus 5 --- Analyzer/Analyzer.csproj | 2 +- ReferenceFinder/ReferenceFinder.csproj | 2 +- UnityDataTool.Tests/AddressablesBuildLayoutTests.cs | 8 ++++---- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Analyzer/Analyzer.csproj b/Analyzer/Analyzer.csproj index 533e5a3..2429088 100644 --- a/Analyzer/Analyzer.csproj +++ b/Analyzer/Analyzer.csproj @@ -14,7 +14,7 @@ - + diff --git a/ReferenceFinder/ReferenceFinder.csproj b/ReferenceFinder/ReferenceFinder.csproj index 1762447..29e72a1 100644 --- a/ReferenceFinder/ReferenceFinder.csproj +++ b/ReferenceFinder/ReferenceFinder.csproj @@ -17,7 +17,7 @@ - + diff --git a/UnityDataTool.Tests/AddressablesBuildLayoutTests.cs b/UnityDataTool.Tests/AddressablesBuildLayoutTests.cs index fd70835..a75299d 100644 --- a/UnityDataTool.Tests/AddressablesBuildLayoutTests.cs +++ b/UnityDataTool.Tests/AddressablesBuildLayoutTests.cs @@ -50,17 +50,17 @@ public async Task Analyze_BuildLayout_ContainsExpectedSQLContent() // Sanity check some expected content in the output SQLite database SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds", 2, "Unexpected number of builds"); - SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds WHERE name = \"buildlayout_2025.01.28.16.35.01.json\"", 1, + SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds WHERE name = 'buildlayout_2025.01.28.16.35.01.json'", 1, "Failed to find build matching reference filename"); SQLTestHelper.AssertQueryString(db, "SELECT unity_version FROM addressables_builds WHERE id = 1", "6000.1.0b2", "Unexpected Unity Version"); SQLTestHelper.AssertQueryString(db, "SELECT package_version FROM addressables_builds WHERE id = 1", "com.unity.addressables: 2.2.2", "Unexpected Addressables version"); - SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_build_bundles WHERE build_id = 1 and name = \"samplepack1_assets_0.bundle\"", 1, + SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_build_bundles WHERE build_id = 1 and name = 'samplepack1_assets_0.bundle'", 1, "Expected to find specific AssetBundle by name"); - SQLTestHelper.AssertQueryInt(db, "SELECT file_size FROM addressables_build_bundles WHERE build_id = 2 and name = \"samplepack1_assets_0.bundle\"", 33824, + SQLTestHelper.AssertQueryInt(db, "SELECT file_size FROM addressables_build_bundles WHERE build_id = 2 and name = 'samplepack1_assets_0.bundle'", 33824, "Unexpected size for specific AssetBundle in build 2"); - SQLTestHelper.AssertQueryString(db, "SELECT packing_mode FROM addressables_build_groups WHERE build_id = 1 and name = \"SamplePack1\"", "PackSeparately", + SQLTestHelper.AssertQueryString(db, "SELECT packing_mode FROM addressables_build_groups WHERE build_id = 1 and name = 'SamplePack1'", "PackSeparately", "Unexpected packing_mode for group"); SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM archives", 0, "Expected no AssetBundles found in reference folder");