DuendeSoftware/products storage-1.1.1

Duende Storage 1.1.1

on GitHub

Duende Storage 1.1.1

This is a security patch release for the 1.1.x line. It updates the .NET and SQLite dependencies of Duende Storage to versions that fix known vulnerabilities. We recommend that all users of 1.1.x upgrade.

There are no API or behavior changes.

Security fixes

• Duende.Storage.MsSql now requires System.Security.Cryptography.Pkcs 10.0.13 (CVE-2026-84008, CVE-2026-70162). Microsoft.Data.SqlClient brings in an older, vulnerable version of this package. Duende.Storage.MsSql now references the patched version directly.
• Duende.Storage.Sqlite now requires the patched SQLite native library (CVE-2025-6965). It depends on Microsoft.Data.Sqlite 10.0.9 and directly on SQLitePCLRaw.bundle_e_sqlite3 3.0.3, so applications no longer pick up the vulnerable SQLitePCLRaw.lib.e_sqlite3 2.1.11.
• Duende.Storage.CliPlugin bundles the patched assemblies: System.Security.Cryptography.Pkcs 10.0.13, Microsoft.Data.Sqlite 10.0.9 and SQLitePCLRaw 3.0.3.

Other changes

• The Microsoft.Extensions.* dependencies of all packages now require the October 2026 .NET servicing release (10.0.13).