Upgrade vulnerable .NET dependencies

[teesofttech]

Summary

• upgrade Entity Framework Core 8 packages from 8.0.15 to the current 8.0.29 servicing release
• override vulnerable transitive dependencies with System.Text.Json 8.0.6 and SQLitePCLRaw.bundle_e_sqlite3 3.0.3
• add a reusable high/critical NuGet vulnerability audit and scheduled GitHub Actions workflow
• add weekly Dependabot updates for NuGet and GitHub Actions
• document the dependency decisions and native SQLite migration risk

Dependabot vulnerability alerts and automated security updates have also been enabled at repository level.

TDD

• Red: scripts/check-vulnerable-packages.sh failed across all four projects on the two high-severity dependency chains
• Green: the same audit now reports no vulnerable packages
• added a native SQLite regression test that opens an in-memory database and requires SQLite 3.50.2 or later

Advisory review

• GHSA-2m69-gcr7-jv3q / CVE-2025-6965: SQLite versions before 3.50.2
• GHSA-hh2w-p6rv-4g7w / CVE-2024-30105: patched in System.Text.Json 8.0.4
• GHSA-8g4q-xg66-9fp4 / CVE-2024-43485: patched in System.Text.Json 8.0.5

EF Core 8.0.29 still declares SQLitePCLRaw bundle 2.1.6, so the explicit 3.0.3 bundle reference is intentional.

Senior .NET review

• verified the resolved graph removes SQLitePCLRaw.lib.e_sqlite3 and resolves SourceGear.sqlite3 3.50.4.5
• packed the SDK and verified patched dependency versions propagate to NuGet consumers
• kept all gateway APIs, database models, and non-SQLite database provider versions unchanged
• made the audit script preserve and report NuGet command failures

Validation

• .NET SDK 8.0.413 Release build: passed
• tests: 92 passed, 2 intentionally skipped
• high/critical NuGet vulnerability audit: passed, no vulnerable packages
• native SQLite smoke test: passed
• NuGet package dependency inspection: passed
• targeted dotnet format: passed
• GitHub Actions actionlint: passed
• git diff --check: passed

One existing nullable warning remains in PaymentController.cs and is tracked by #70.

Closes #59

Summary by CodeRabbit

• Bug Fixes

  • Updated .NET dependencies to address known security vulnerabilities.
  • Ensured the embedded SQLite runtime meets the patched security version.

• Chores

  • Added automated dependency update scheduling.
  • Added automated checks that block builds when high- or critical-severity vulnerabilities are detected.

• Documentation

  • Documented dependency auditing, remediation changes, and local verification steps.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change updates vulnerable .NET dependencies, adds an SQLite version regression test, introduces a NuGet vulnerability audit script and CI workflow, configures Dependabot for NuGet and GitHub Actions, and documents the dependency security process and remediation details.

Changes

Dependency Security

Layer / File(s)	Summary
Dependency remediation and runtime verification PayBridge.SDK/PayBridge.SDK.csproj, PayBridge.SDK.Test/Unit/DependencySecurityTests.cs	Entity Framework Core, SQLite, and System.Text.Json package versions are updated or pinned, and an xUnit test verifies the embedded SQLite version is at least 3.50.2.
Vulnerability audit automation scripts/check-vulnerable-packages.sh, .github/workflows/dependency-security.yml	A script audits transitive NuGet packages for high or critical vulnerabilities, and GitHub Actions runs the audit on pull requests, pushes, a weekly schedule, and manual dispatch.
Dependency update policy .github/dependabot.yml, docs/dependency-security.md	Dependabot schedules NuGet and GitHub Actions updates, while documentation describes auditing, remediation versions, and release verification requirements.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: upgrading vulnerable .NET dependencies.
Linked Issues check	✅ Passed	The changes address #59 with dependency upgrades, Dependabot config, a scheduled audit, docs, and test coverage; validation is also noted.
Out of Scope Changes check	✅ Passed	All changes map to dependency security, auditing, documentation, or tests, with no obvious unrelated scope in the summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/upgrade-vulnerable-dependencies

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/dependency-security.yml (1)

24-25: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable credential persistence in the checkout action.

Since this workflow does not push changes back to the repository, setting persist-credentials: false is a recommended security best practice. It prevents the GitHub token from remaining in the local git configuration, reducing the risk of token leakage if subsequent steps inadvertently run untrusted code.

🔒️ Proposed fix

       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependency-security.yml around lines 24 - 25, Update the
actions/checkout@v4 step in the dependency security workflow to set
persist-credentials to false, leaving the repository checkout behavior otherwise
unchanged.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/dependency-security.yml:
- Around line 24-25: Update the actions/checkout@v4 step in the dependency
security workflow to set persist-credentials to false, leaving the repository
checkout behavior otherwise unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cc8e3119-ad2e-46dc-b0ce-d15b25802b89

📥 Commits

Reviewing files that changed from the base of the PR and between 9d5331c and c566305.

📒 Files selected for processing (6)

• .github/dependabot.yml
• .github/workflows/dependency-security.yml
• PayBridge.SDK.Test/Unit/DependencySecurityTests.cs
• PayBridge.SDK/PayBridge.SDK.csproj
• docs/dependency-security.md
• scripts/check-vulnerable-packages.sh

[Copilot]

Pull request overview

This PR hardens PayBridge’s .NET 8 dependency supply chain by upgrading EF Core servicing packages, pinning patched transitive dependencies to address high-severity advisories, and adding automated vulnerability auditing via script + GitHub Actions (with Dependabot scheduling and documentation).

Changes:

• Upgrade EF Core 8 packages from 8.0.15 to 8.0.29 and pin System.Text.Json (8.0.6) + SQLitePCLRaw.bundle_e_sqlite3 (3.0.3) to remediate known advisories.
• Add a reusable dotnet list package --vulnerable --include-transitive audit script and a scheduled/PR GitHub Actions workflow to fail on high/critical vulnerabilities.
• Add a native SQLite regression test to assert the embedded SQLite version meets the security-fix minimum, plus documentation and weekly Dependabot updates.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/check-vulnerable-packages.sh	Adds a reusable high/critical NuGet vulnerability audit script for local/CI use.
PayBridge.SDK/PayBridge.SDK.csproj	Updates EF Core packages and pins patched dependency versions to override vulnerable transitive resolutions.
PayBridge.SDK.Test/Unit/DependencySecurityTests.cs	Adds a unit test to verify embedded SQLite runtime version meets the remediation threshold.
docs/dependency-security.md	Documents the new dependency security policy, workflow, and remediation rationale.
.github/workflows/dependency-security.yml	Introduces an automated vulnerability-audit workflow (PR/push/scheduled/manual).
.github/dependabot.yml	Configures weekly Dependabot updates for NuGet and GitHub Actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.