[#100] Update SQLite to 3.53.3 to mitigate CVE-2025-6965 (#133)

Bump Microsoft.Data.Sqlite from 9.0.1 to 9.0.20 in Analyzer and
ReferenceFinder. 9.0.20 requires SQLitePCLRaw.bundle_e_sqlite3 2.1.12,
which bundles SQLite 3.53.3 -- past the 3.50.2 fix for CVE-2025-6965
(and the 3.53.2 fix for the FTS5 memory-corruption CVEs).

No explicit SQLitePCLRaw pin is needed. When this was first investigated
the newest native package carried SQLite 3.49.1, still affected; 2.1.12
shipped in July 2026 and Microsoft.Data.Sqlite 9.0.19+ depends on it.

The 2.1.12 native build is compiled with SQLITE_DQS=0, so double-quoted
string literals no longer fall back from a failed identifier lookup.
Production SQL was already clean, but four literals in
AddressablesBuildLayoutTests needed converting to single quotes.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: SkowronskiAndrew

Analyzer/Analyzer.csproj

@@ -14,7 +14,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.SQLite" Version="9.0.1" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="9.0.20" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.1" />
   </ItemGroup>
 

ReferenceFinder/ReferenceFinder.csproj

@@ -17,7 +17,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="9.0.1" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="9.0.20" />
   </ItemGroup>
 
 </Project>

UnityDataTool.Tests/AddressablesBuildLayoutTests.cs

@@ -50,17 +50,17 @@ public async Task Analyze_BuildLayout_ContainsExpectedSQLContent()
         // Sanity check some expected content in the output SQLite database
         SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds", 2,
             "Unexpected number of builds");
-        SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds WHERE name = \"buildlayout_2025.01.28.16.35.01.json\"", 1,
+        SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_builds WHERE name = 'buildlayout_2025.01.28.16.35.01.json'", 1,
             "Failed to find build matching reference filename");
         SQLTestHelper.AssertQueryString(db, "SELECT unity_version FROM addressables_builds WHERE id = 1", "6000.1.0b2",
             "Unexpected Unity Version");
         SQLTestHelper.AssertQueryString(db, "SELECT package_version FROM addressables_builds WHERE id = 1", "com.unity.addressables: 2.2.2",
             "Unexpected Addressables version");
-        SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_build_bundles WHERE build_id = 1 and name = \"samplepack1_assets_0.bundle\"", 1,
+        SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM addressables_build_bundles WHERE build_id = 1 and name = 'samplepack1_assets_0.bundle'", 1,
             "Expected to find specific AssetBundle by name");
-        SQLTestHelper.AssertQueryInt(db, "SELECT file_size FROM addressables_build_bundles WHERE build_id = 2 and name = \"samplepack1_assets_0.bundle\"", 33824,
+        SQLTestHelper.AssertQueryInt(db, "SELECT file_size FROM addressables_build_bundles WHERE build_id = 2 and name = 'samplepack1_assets_0.bundle'", 33824,
             "Unexpected size for specific AssetBundle in build 2");
-        SQLTestHelper.AssertQueryString(db, "SELECT packing_mode FROM addressables_build_groups WHERE build_id = 1 and name = \"SamplePack1\"", "PackSeparately",
+        SQLTestHelper.AssertQueryString(db, "SELECT packing_mode FROM addressables_build_groups WHERE build_id = 1 and name = 'SamplePack1'", "PackSeparately",
             "Unexpected packing_mode for group");
         SQLTestHelper.AssertQueryInt(db, "SELECT COUNT(*) FROM archives", 0,
             "Expected no AssetBundles found in reference folder");