Repository navigation

chore(deps): update dependency sqlite3 to v2 [security] - #67

Open

renovate[bot] wants to merge 1 commit into

renovate/rubygems-sqlite3-vulnerability

Open

chore(deps): update dependency sqlite3 to v2 [security]#67
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/rubygems-sqlite3-vulnerability

renovate Bot commented Jul 31, 2026 •

edited

Loading

Contributor

This PR contains the following updates:

Package	Change	Age	Confidence
sqlite3 (changelog)	`"~> 1.4"` → `"~> 2.0"`

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

CVE-2026-54619 / GHSA-28hh-pr2h-2w89

More information

Details

Summary

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Severity

CVSS Score: 2.0 / 10 (Low)
Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sparklemotion/sqlite3-ruby (sqlite3)

`v2.9.5`

Dependencies

Vendored sqlite is updated to v3.53.2 (from v3.53.1). #709 @flavorjones

Security / Stability

Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See GHSA-28hh-pr2h-2w89 for more information. #710 @flavorjones
Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See GHSA-j7fr-3v8c-3qc3 for more information. #711 @flavorjones

`v2.9.4`

Vendored sqlite is updated to v3.53.1 (from v3.53.0). #704 @flavorjones

`v2.9.3`

Vendored sqlite is updated to v3.53.0 (from v3.51.3). #696 @flavorjones

`v2.9.2`

Vendored sqlite is updated to v3.51.3 (from v3.51.2). #688 @flavorjones

`v2.9.1`

Vendored sqlite is updated to v3.51.2 (from v3.51.1). #683 @flavorjones

`v2.9.0`

Ruby

Introduce native gem packages for Ruby 4.0. @flavorjones
Drop support for Ruby 3.1. @flavorjones

Added

Introduce Statement#named_params to introspect on a parameterized SQL statement. #627 #642 @captn3m0

Improved

Small improvements to docstrings and comments. @flavorjones @houyuanjie

`v2.8.1`

Vendored sqlite is updated to v3.51.1 (from v3.51.0). #659 @flavorjones
Precompiled native gems are built with rake-compiler-dock v1.10.0 (previously v1.9.1).

`v2.8.0`

Vendored sqlite is updated to v3.51.0 (from v3.50.4). #652 @flavorjones

`v2.7.4`

Vendored sqlite is updated to v3.50.4 (from v3.50.3). #644 @flavorjones

`v2.7.3`

Vendored sqlite is updated to v3.50.3 (from v3.50.2). #638 @flavorjones

`v2.7.2`

Backport a fix to the vendored SQLite to support compilation on Rocky Linux. See the SQLite forum post for more details. #634, #635 @flavorjones

`v2.7.1`

Vendored sqlite is updated to v3.50.2 (from v3.50.1). #633 @flavorjones

`v2.7.0`

Vendored sqlite is updated to v3.50.1 (from v3.49.1). #630 @flavorjones

`v2.6.0`

Dependencies

Vendored sqlite is updated to v3.49.1 (from v3.47.2). #605 @flavorjones
Updated to rake-compiler-dock v1.9.1. #610 @flavorjones

Important note for Window users

Loading extensions is not available on Windows when using the precompiled native gems or compiling the vendored sqlite library from source, starting with sqlite3-ruby v2.6.0.

Sqlite 3.48.0 and later have dramatically changed the "autoconf amalgamation" that is vendored in this gem. Specifically, the configuration is no longer actually autoconf, but some scripts that emulate autoconf's interface and behavior.

Although this mostly "just worked", we're having a problem resolving the libraries necessary for loading extensions. As a result, starting with sqlite3-ruby v2.6.0, extensions cannot be loaded on Windows when using precompiled native gems or when compiling the vendored sqlite library.

If you are willing and able to help fix this, let us know at #618.

`v2.5.0`

Ruby

This release introduces native gem packages that include Ruby 3.4.

`v2.4.1`

Dependencies

Vendored sqlite is updated to v3.47.2 #593 @flavorjones

The description from the upstream maintainers is:

SQLite version 3.47.2, now available, fixes an important bug that first appeared in the 3.47.0
release. In SQLite versions 3.47.0 and 3.47.1, if you try to convert a string into a
floating-point value and the first 16 significant digits of the value are exactly
"1844674407370955", then the floating-point number generated might be incorrect. The problem
only affects x64 and i386 CPUs, so it does not affect you if you are running on ARM. And it only
affects releases 3.47.0 and 3.47.1. If you are running SQLite versions 3.47.0 or 3.47.1, then
upgrading is recommended.

Saving you a click, you should upgrade if you're running sqlite3-ruby v2.1.1 or later.

Fixed

Prevent unnecessary "Invalid Reference" warnings from the ForkSafety module when GC runs during the "after fork" hook. #592 @flavorjones

`v2.4.0`

Added

Database#load_extension now accepts any object that responds to #to_path, in addition to String filesystem paths. [#586] @flavorjones
Database.new now accepts an extensions: parameter, which is an array of SQLite extensions that will be loaded during initialization. The array may contain String filesystem paths and objects that respond to #to_path. [#586] @flavorjones

`v2.3.1`

Dependencies

Vendored sqlite is updated to v3.47.1 [#589] @flavorjones

`v2.3.0`

Added

The SQLITE_DBPAGE extension is now enabled by default, which implements an eponymous-only virtual table that provides direct access to the underlying database file by interacting with the pager. See https://www.sqlite.org/dbpage.html for more information. [#578] @flavorjones
The DBSTAT extension is now enabled by default, which implements a read-only eponymous virtual table that returns information about the amount of disk space used to store the content of an SQLite database. See https://sqlite.org/dbstat.html for more information. [#580] @pawurb @flavorjones
Database#optimize which wraps the pragma optimize; statement. Also added Constants::Optimize to allow advanced users to pass a bitmask of options. See https://www.sqlite.org/pragma.html#pragma_optimize. [#572] @alexcwatt @flavorjones
SQLite3::VERSION_INFO is contains a bag of metadata about the gem and the sqlite library used. SQLite3::SQLITE_PACKAGED_LIBRARIES and SQLite3::SQLITE_PRECOMPILED_LIBRARIES are indicate how the gem was built. [#581] @flavorjones

Fixed

Database#encoding= support for switching the database encoding to UTF-16BE, which has been broken since Database#encoding= was introduced in v1.3.12 in 2016. [#575] @miyucy
Omit mention of the pkg-config gem when failing to build from source, since it is not used. [#358] @flavorjones

`v2.2.0`

Added

URI filenames are now allowed. This allows the injection of some behavior via recognized query parameters. See https://www.sqlite.org/uri.html for more information. [#571] @flavorjones

Improved

SQL Syntax errors during Database#prepare will raise a verbose exception with a multiline message indicating with a "^" exactly where in the statement the error occurred. [#554] @fractaledmind @flavorjones

`v2.1.1`

Dependencies

Vendored sqlite is updated to v3.47.2 #593 @flavorjones

The description from the upstream maintainers is:

SQLite version 3.47.2, now available, fixes an important bug that first appeared in the 3.47.0
release. In SQLite versions 3.47.0 and 3.47.1, if you try to convert a string into a
floating-point value and the first 16 significant digits of the value are exactly
"1844674407370955", then the floating-point number generated might be incorrect. The problem
only affects x64 and i386 CPUs, so it does not affect you if you are running on ARM. And it only
affects releases 3.47.0 and 3.47.1. If you are running SQLite versions 3.47.0 or 3.47.1, then
upgrading is recommended.

Saving you a click, you should upgrade if you're running sqlite3-ruby v2.1.1 or later.

Fixed

Prevent unnecessary "Invalid Reference" warnings from the ForkSafety module when GC runs during the "after fork" hook. #592 @flavorjones

`v2.1.0`

Ruby

This release drops support for Ruby 3.0. [#563] @flavorjones

Fork safety improvements

Sqlite itself is not fork-safe. Specifically, writing in a child process to a database connection that was created in the parent process may corrupt the database file. To mitigate this risk, sqlite3-ruby has implemented the following changes:

All open writable database connections carried across a fork() will immediately be closed in the child process to mitigate the risk of corrupting the database file.
These connections will be incompletely closed ("discarded") which will result in a one-time memory leak in the child process.

If it's at all possible, we strongly recommend that you close writable database connections in the parent before forking. If absolutely necessary (and you know what you're doing), you may suppress the fork safety warnings by calling SQLite3::ForkSafety.suppress_warnings!.

See the README's "Fork Safety" section and adr/2024-09-fork-safety.md for more information. [#558, #565, #566] @flavorjones

Improved

Use sqlite3_close_v2 to close databases in a deferred manner if there are unclosed prepared statements. Previously closing a database while statements were open resulted in a BusyException. See https://www.sqlite.org/c3ref/close.html for more context. [#557] @flavorjones
When setting a Database busy_handler, fire the write barrier to prevent potential crashes during the GC mark phase. [#556] @jhawthorn

Documentation

The FAQ.md has been updated to fix some inaccuracies. [#562] @rickhull

`v2.0.4`

Dependencies

Vendored sqlite is updated to v3.46.1 @flavorjones

`v2.0.3`

Improved

Database#quote avoids allocating strings where reusing frozen strings is preferable. #548 @casperisfine

`v2.0.2`

Dependencies

Vendored sqlite is updated to v3.46.0 @flavorjones

`v2.0.1`

Fixed

Raise ArgumentError if Database#execute, #execute_batch, or #query are passed multiple bind parameters that are not in an Array. In v2.0.0 these methods would silently swallow additional arguments, and this change makes the failure explicit. See the CHANGELOG notes for v2.0.0 for examples on how to update your code. [#527] @flavorjones
Fixed a regression in v2.0.0 that caused Database#execute_batch to raise an encoding exception when passed some non-ascii strings. As a result of this fix, Database#prepare now ensures the "remainder" string will always be encoded as UTF-8. [#524] @flavorjones

`v2.0.0`

This is a major release which contains some breaking changes, primarily the removal of
long-deprecated functionality. Before upgrading, please make sure to address deprecation warnings
emitted from your application using sqlite3-ruby v1.7.x.

Ruby

This release drops support for Ruby 2.7. [#453] @flavorjones

Packaging

Native (precompiled) gems are now available for Linux Musl. [#442] @flavorjones

Here are the platforms for which native gems are shipped:

aarch64-linux-gnu (requires: glibc >= 2.29)
aarch64-linux-musl
arm-linux-gnu (requires: glibc >= 2.29)
arm-linux-musl
arm64-darwin
x64-mingw32 / x64-mingw-ucrt
x86-linux-gnu (requires: glibc >= 2.17)
x86-linux-musl
x86_64-darwin
x86_64-linux-gnu (requires: glibc >= 2.17)
x86_64-linux-musl

⚠ Ruby 3.0 linux users must use Rubygems >= 3.3.22 in order to use these gems.

⚠ Musl linux users should update to Bundler >= 2.5.6 to avoid rubygems/rubygems#7432

See the INSTALLATION doc for more information.

Dependencies

Vendored sqlite is updated to v3.45.3. @flavorjones

Added

Database#busy_handler_timeout= introduced as an alternative to #busy_timeout= that can be used when it's desired to release the GVL between retries. [#443, #456] @fractaledmind
Support the SUPER_JOURNAL flag which is an alias for MASTER_JOURNAL as of sqlite 3.33.0. [#467] @flavorjones
Statement#stat and Statement#memused introduced to report statistics. [#461] @fractaledmind
Statement#sql and Statement#expanded_sql introduced to retrieve the SQL statement associated with the Statement object. [#293, #498] @tenderlove
SQLite3.status introduced to return run-time status and reset high-water marks. See SQLite3::Constants::Status for details. [#520] @wjlroe

Improved

Avoid leaking memory for statements that are not closed properly. [#392] @haileys
Moved some C code into Ruby. [#451, #455] @tenderlove
Improve performance of ResultSet hashes. [#154, #484, #468] @tenderlove
Fix a GC compaction issue with busy_handler. [#466] @byroot
Remove unused ResultSet instance variable. [#469] @tenderlove
Fix encoding for values passed to custom functions. [#218, #488] @tenderlove

Changed

Consistently use SQLite3::Exception or subclasses. Previously some Pragmas methods raised Exception, and Database#execute_batch2 and Database#load_extension raised RuntimeError. [#467, #490] @flavorjones
Database#columns returns a list of internal frozen strings. [#155, #474, #486] @tenderlove
Freeze results that come from the database. [#480] @tenderlove
The encoding of a Database is no longer cached. [#485] @tenderlove
Database#transaction returns the result of the block when used with a block. [#508] @alexcwatt
Database#execute_batch returns the result of the last statement executed. [#512] @alexcwatt

Removed

Removed class SQLite3::Translator and all related type translation methods which have been deprecated since v1.3.2. [#470] @tenderlove

If you need to do type translation on values returned from the statement object, please wrap it
with a delegate object. Here is an example of using a delegate class to implement type
translation:

require "sqlite3"
require "delegate"

db = SQLite3::Database.new(":memory:")

return_value = db.execute_batch2 <<-EOSQL
        CREATE TABLE items (id integer PRIMARY KEY AUTOINCREMENT, name string);
        INSERT INTO items (name) VALUES ("foo");
        INSERT INTO items (name) VALUES ("bar");
EOSQL

class MyTranslator < DelegateClass(SQLite3::Statement)
  def step
    row = super
    return if done?

    row.map.with_index do |item, i|
      case types[i]
      when "integer" # turn all integers to floats
        item.to_f
      when "string" # add "hello" to all strings
        item + "hello"
      end
    end
  end
end

db.prepare("SELECT * FROM items") do |stmt|
  stmt = MyTranslator.new(stmt)
  while row = stmt.step
    p row
  end
end

Removed types and fields readers on row objects, which have been deprecated since
v1.3.6. [#471] @tenderlove

Deprecated code looks like this:
```
row = @db.execute("select * from foo")
assert_equal ["blob"], row.first.types
```
If you would like to access the "types" associated with a returned query,
use a prepared statement like this:
```
@db.prepare("select * from foo") do |v|
  assert_equal ["blob"], v.types
end
```
Removed support for non-Array bind parameters to methods Database#execute, #execute_batch, and #query, which has been deprecated since v1.3.0. [#511] @flavorjones

Deprecated code looks like this:
```
@db.query("select * from foo where a = ? and b = ? and c = ?", 1, 2, 3)
```
For these cases, pass the bind parameters as an array:
```
@db.query("select * from foo where a = ? and b = ? and c = ?", [1, 2, 3])
```
Removed class SQLite3::VersionProxy which has been deprecated since v1.3.2. [#453] @flavorjones
Removed methods SQLite3::Database::FunctionProxy#count and #set_error which have been broken since at least v1.3.13. [#164, #509, #510] @alexcwatt @flavorjones

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/rubygems-sqlite3-vulnerability branch from d2d4ff2 to e44c8c2 Compare

August 11, 2026 23:40

renovate Bot force-pushed the renovate/rubygems-sqlite3-vulnerability branch from e44c8c2 to 0d61a49 Compare

August 26, 2026 15:02


          chore(deps): update dependency sqlite3 to v2 [security]

5a5d95e

renovate Bot force-pushed the renovate/rubygems-sqlite3-vulnerability branch from 0d61a49 to 5a5d95e Compare

October 26, 2026 23:11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet