MAUI: This solution contains packages with vulnerabilities

Question

MAUI: This solution contains packages with vulnerabilities

Sreenivasan, Sreejith 995

Last week when I open Visual Studio in windows I saw a message like below screenshot.

Screenshot 2026-07-06 160515

when I tap on Manage NuGet Packages it listed 2 packages.

SQLitePCLRaw.lib.e_sqlite3.android and SQLitePCLRaw.lib.e_sqlite3.ios

The installed version of the above packages are 2.1.11 and this is the latest stable version.

I found below in my .csproj:

<ItemGroup>
	<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.11" />
</ItemGroup>

I tried updating it like below and the above warning alert vanished.

<ItemGroup>
	<PackageReference Include="sqlite-net-pcl" Version="1.11.272-beta" />
	<PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
</ItemGroup>

But after updating like this I am not able to view the login page. When I install the app I am getting below exception in the output box:

System.InvalidOperationException: There is not a valid operation queue at System.Reactive.PlatformServices.ExceptionServicesImpl.Rethrow(Exception exception) at System.Reactive.ExceptionHelpers.Throw(Exception exception) at System.Reactive.Subjects.AsyncSubject`1[[System.Reactive.Unit, System.Reactive, Version=6.0.0.0, Culture=neutral, PublicKeyToken=94bc3704cddfc263]].GetResult() at Xamarin.Forms.Clinical6.Core.Services.CacheExtensions.SaveUploadedPushToken(ICacheService cacheService, String pushToken) in C:\Projects\Inventiva-MAUI\MAUI.Clinical6\Core\Services\CacheService.cs:line 202 at Xamarin.Forms.Clinical6.Core.Services.UserService.GetAccessToken() in C:\Projects\Inventiva-MAUI\MAUI.Clinical6\Core\Services\UserService.cs:line 209 Missing Remote Translation Key: AppInitViewModelGenerateTokenError Language: , Missing Consuming App Resx Translation Key: AppInitViewModelGenerateTokenError Language: ,

I tried adding below initialization on the MAUIProgram.cs but no luck:

SQLitePCL.Batteries_V2.Init();

0 comments

Answer accepted by question author

Varsha Dundigalla(INFOSYS LIMITED) 5,185 Microsoft External Staff

Thank you for reaching out.

The warning in Visual Studio appears because SQLitePCLRaw.lib.e_sqlite3.android and SQLitePCLRaw.lib.e_sqlite3.ios version 2.1.11 are currently flagged as having a known vulnerability. Visual Studio detects this and displays the security warning.

However, the issue you are seeing after updating the package appears to be different. The login page failure is likely not caused by the vulnerability warning itself. Based on the exception stack trace, the error is occurring during application startup while generating the access token and saving the push token, rather than during SQLite initialization.

Since you upgraded from SQLitePCLRaw 2.x to 3.x, which is a major version change, there may be a compatibility issue with other SQLite-related packages used in the application.

To help identify the root cause, please share the complete list of SQLite-related package references from your .csproj file, including any SQLitePCLRaw.*, sqlite-net-pcl, or other SQLite packages. This will help determine whether there is a package version mismatch after the upgrade.

If you found this information useful, kindly mark this as "Accept Answer" so that others facing similar issues can easily find the solution. We are closing this thread for now. If you encounter any further issues, please feel free to raise a new thread.

Sreenivasan, Sreejith 995 Reputation points

2026-07-08T12:37:45.78+00:00

@Varsha Dundigalla(INFOSYS LIMITED) I will check this and get back to you.
Sreenivasan, Sreejith 995 Reputation points

2026-07-09T08:51:20.3+00:00
@Varsha Dundigalla(INFOSYS LIMITED) I only saw below in my .csproj related to Sqlite package.

<ItemGroup> <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.11" /> </ItemGroup>
Varsha Dundigalla(INFOSYS LIMITED) 5,185 Reputation points Microsoft External Staff

2026-07-09T11:43:41.3666667+00:00

Thank you for sharing the package reference.

At this point, it is not clear whether the application startup failure is caused by the SQLite package upgrade or by another component that runs during application initialization. The exception shown in the output does not appear to point directly to a SQLite initialization issue. Instead, it occurs while the application is generating the access token and saving the push token during startup.

To identify the actual source of the failure, the complete exception details would be helpful, especially any InnerException that may be logged before or after the stack trace. Those details can provide more information about the component that is failing during startup and whether it is related to the SQLite package update.
Bruce (SqlWork.com) 84,671 Reputation points

2026-07-09T17:35:19.17+00:00

The error appears to be with a Xamarin.Forms.Clinical6 function that calls SQLite. as this library is out of support and not maintained (and has who knows how many security issues), I would not worry about the SQLite upgrade. Moving off this library is more important.

note: using a 6 year old unsupported library for authentication is high risk.
Sreenivasan, Sreejith 995 Reputation points

2026-07-13T10:05:08.2233333+00:00
@Varsha Dundigalla(INFOSYS LIMITED) Could you please confirm the approach I tried for fixing the vulnerability issue is correct or not? I mean the below one?

<ItemGroup> <PackageReference Include="sqlite-net-pcl" Version="1.11.272-beta" /> <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" /> </ItemGroup>
Varsha Dundigalla(INFOSYS LIMITED) 5,185 Reputation points Microsoft External Staff

2026-07-13T11:09:47.1866667+00:00

Thank you for the update.

Based on what you shared, updating the package references as shown below may remove the vulnerability warning because it upgrades SQLitePCLRaw from the 2.x version line to the newer 3.x version line. However, we cannot yet confirm that this is the correct fix for your application.

Since this is a major version upgrade, it may introduce compatibility issues with other SQLite-related packages or application code.

The fact that the application no longer reaches the login page after the update suggests there may be a separate issue that needs further investigation. At this stage, we can only confirm that the update appears to address the vulnerability warning, but we cannot confirm that it is fully compatible with your application.

Please let us know the results of your testing, and if the startup issue continues we can investigate that separately.

3 additional answers

Your answer

Sreenivasan, Sreejith 995 Reputation points

2026-07-08T12:37:45.78+00:00

@Varsha Dundigalla(INFOSYS LIMITED) I will check this and get back to you.
Sreenivasan, Sreejith 995 Reputation points

2026-07-09T08:51:20.3+00:00

@Varsha Dundigalla(INFOSYS LIMITED) I only saw below in my .csproj related to Sqlite package.

<ItemGroup> <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="2.1.11" /> </ItemGroup>
Varsha Dundigalla(INFOSYS LIMITED) 5,185 Reputation points Microsoft External Staff

2026-07-09T11:43:41.3666667+00:00

Thank you for sharing the package reference.

At this point, it is not clear whether the application startup failure is caused by the SQLite package upgrade or by another component that runs during application initialization. The exception shown in the output does not appear to point directly to a SQLite initialization issue. Instead, it occurs while the application is generating the access token and saving the push token during startup.

To identify the actual source of the failure, the complete exception details would be helpful, especially any InnerException that may be logged before or after the stack trace. Those details can provide more information about the component that is failing during startup and whether it is related to the SQLite package update.
Bruce (SqlWork.com) 84,671 Reputation points

2026-07-09T17:35:19.17+00:00

The error appears to be with a Xamarin.Forms.Clinical6 function that calls SQLite. as this library is out of support and not maintained (and has who knows how many security issues), I would not worry about the SQLite upgrade. Moving off this library is more important.

note: using a 6 year old unsupported library for authentication is high risk.
Sreenivasan, Sreejith 995 Reputation points

2026-07-13T10:05:08.2233333+00:00

@Varsha Dundigalla(INFOSYS LIMITED) Could you please confirm the approach I tried for fixing the vulnerability issue is correct or not? I mean the below one?

<ItemGroup> <PackageReference Include="sqlite-net-pcl" Version="1.11.272-beta" /> <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" /> </ItemGroup>
Varsha Dundigalla(INFOSYS LIMITED) 5,185 Reputation points Microsoft External Staff

2026-07-13T11:09:47.1866667+00:00

Thank you for the update.

Based on what you shared, updating the package references as shown below may remove the vulnerability warning because it upgrades SQLitePCLRaw from the 2.x version line to the newer 3.x version line. However, we cannot yet confirm that this is the correct fix for your application.

Since this is a major version upgrade, it may introduce compatibility issues with other SQLite-related packages or application code.

The fact that the application no longer reaches the login page after the update suggests there may be a separate issue that needs further investigation. At this stage, we can only confirm that the update appears to address the vulnerability warning, but we cannot confirm that it is fully compatible with your application.

Please let us know the results of your testing, and if the startup issue continues we can investigate that separately.

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 3

Bruce (SqlWork.com) 84,671

I would guess you failing routine is using SQLite encryption, which is no longer free and not included in the lastest SQLitePCLRaw package. See release notes

https://github.com/ericsink/SQLitePCL.raw/blob/main/v3.md

0 comments