sqlite3 1.5.0-x64-mingw32 → 1.5.2-x64-mingw32

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a412bb2312ca7c18735253221062a5cce19d7bcb6b3c08cb9dcf22a5226c9fb
-  data.tar.gz: 16d77bef7e82a8d7548d5d43cbfa4b7c7a91904d843c7975c4ece4318dfd219d
+  metadata.gz: '08eb36359440da4fad8ec7678c1aa1e143f4ff55fd4b469fadecfa2ebd09e681'
+  data.tar.gz: f2d95cea00d013c8f788bc46ab0dd2de7adb43c5d2a3a33eb05abdb700af103c
 SHA512:
-  metadata.gz: d84948be1bcf8d5b34dd09d19221a0329457ec663e813ed65e35040f71bd3d3450ca6927aa7269e30d5c0a066ef68c913814b35bb21ef65bfc9ab6d31ebcc3eb
-  data.tar.gz: 717577671db74c4c801be85dec2b8d1c5a6deff949d912c5654c49e9a711c2c8f074557e717b410d64cf1cf9e887e218cbe2f088e66d6bdab60dd7bc7ffa0460
+  metadata.gz: e59cbee9cd004d787aef98a4d0ac3e60b044a6217d33016f3fe51b57007021b9f7821c030d78dbd21d0c684d425ca7a76e3ec0d619c980d682326a608ae2fe4e
+  data.tar.gz: f2f92e5754374692c83f938cec949d848e466a2ec9aa5e43575eb7b0d23370e262abcdd114e4abd43175a66a91c4989a7b1749ab3bdee711e89acd7a04142093

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # sqlite3-ruby Changelog
 
+## 1.5.2 / 2022-10-01
+
+### Packaging
+
+This version correctly vendors the tarball for sqlite v3.39.4 in the vanilla "ruby" platform gem package, so that users will not require network access at installation.
+
+v1.5.0 and v1.5.1 mistakenly packaged the tarball for sqlite v3.38.5 in the vanilla "ruby" platform gem, resulting in downloading the intended tarball over the network at installation time (or, if the network was not available, failure to install). Note that the precompiled native gems were not affected by this issue. [#352]
+
+
+## 1.5.1 / 2022-09-29
+
+### Dependencies
+
+* Vendored sqlite is updated to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).
+
+### Security
+
+The vendored version of sqlite, v3.39.4, should be considered to be a security release. From the release notes:
+
+> Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the
+> prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so
+> this should be considered a security update.
+>
+> In order to exploit the vulnerability, an attacker must have full SQL access and must be able to
+> construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit
+> signed integer overflow.
+
+For more information please see [GHSA-mgvv-5mxp-xq67](https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mgvv-5mxp-xq67).
+
+
 ## 1.5.0 / 2022-09-08
 
 ### Packaging

data/CONTRIBUTING.md

@@ -20,5 +20,5 @@ A quick checklist:
 - [ ] update `CHANGELOG.md` and `lib/sqlite3/version.rb` including `VersionProxy::{MINOR,TINY}`
 - [ ] create a git tag using a format that matches the pattern `v\d+\.\d+\.\d+`, e.g. `v1.3.13`
 - [ ] run `bin/build-gems` and make sure it completes and all the tests pass
-- [ ] `for g in gems/*.gem ; do gem push $g ; done`
+- [ ] `for g in gems/*.gem ; do gem push $g ; done`s
 - [ ] create a release at https://github.com/sparklemotion/sqlite3-ruby/releases and include sha2 checksums

data/README.md

@@ -107,7 +107,8 @@ If you're on a platform that supports a native gem but you want to avoid using i
 
 - If you're not using Bundler, then run `gem install sqlite3 --platform=ruby`
 - If you are using Bundler
-  - version 2.1 or later, then you'll need to run `bundle config set force_ruby_platform true`,
+  - version 2.3.18 or later, you can specify [`gem "sqlite3", force_ruby_platform: true`](https://bundler.io/v2.3/man/gemfile.5.html#FORCE_RUBY_PLATFORM)
+  - version 2.1 or later, then you'll need to run `bundle config set force_ruby_platform true`
   - version 2.0 or earlier, then you'll need to run `bundle config force_ruby_platform true`
 
 
@@ -143,6 +144,7 @@ If you would prefer to build the sqlite3-ruby gem against your system libsqlite3
 
 PLEASE NOTE:
 
+- you must avoid installing a precompiled native gem (see [previous section](#avoiding-the-precompiled-native-gem))
 - only versions of libsqlite3 `>= 3.5.0` are supported,
 - and some library features may depend on how your libsqlite3 was compiled.
 

data/dependencies.yml

@@ -0,0 +1,14 @@
+# TODO: stop using symbols here once we no longer support Ruby 2.7 and can rely on symbolize_names
+:sqlite3:
+  # checksum verified by first checking the published sha3(256) checksum against https://sqlite.org/download.html:
+  #
+  # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3390400.tar.gz
+  # 431328e30d12c551da9ba7ef2122b269076058512014afa799caaf62ca567090  ports/archives/sqlite-autoconf-3390400.tar.gz
+  #
+  # $ sha256sum ports/archives/sqlite-autoconf-3390400.tar.gz
+  # f31d445b48e67e284cf206717cc170ab63cbe4fd7f79a82793b772285e78fdbb  ports/archives/sqlite-autoconf-3390400.tar.gz
+  #
+  :version: "3.39.4"
+  :files:
+    - :url: "https://sqlite.org/2022/sqlite-autoconf-3390400.tar.gz"
+      :sha256: "f31d445b48e67e284cf206717cc170ab63cbe4fd7f79a82793b772285e78fdbb"

data/ext/sqlite3/extconf.rb

@@ -1,5 +1,6 @@
 require "mkmf"
 require "mini_portile2"
+require "yaml"
 
 module Sqlite3
   module ExtConf
@@ -131,23 +132,8 @@ module Sqlite3
       end
 
       def mini_portile_config
-        {
-          sqlite3: {
-            # checksum verified by first checking the published sha3(256) checksum against https://sqlite.org/download.html:
-            #
-            # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3390300.tar.gz
-            # dfa055c70724cd63f0b7da6e9f53530d8da51fe021e3f864d58c7c847d590e1d  ports/archives/sqlite-autoconf-3390300.tar.gz
-            #
-            # $ sha256sum ports/archives/sqlite-autoconf-3390300.tar.gz
-            # 7868fb3082be3f2cf4491c6fba6de2bddcbc293a35fefb0624ee3c13f01422b9  ports/archives/sqlite-autoconf-3390300.tar.gz
-            #
-            version: "3.39.3",
-            files: [{
-                      url: "https://www.sqlite.org/2022/sqlite-autoconf-3390300.tar.gz",
-                      sha256: "7868fb3082be3f2cf4491c6fba6de2bddcbc293a35fefb0624ee3c13f01422b9",
-                    }],
-          }
-        }
+        # TODO: once Ruby 2.7 is no longer supported, use symbolize_names: true
+        YAML.load_file(File.join(package_root_dir, "dependencies.yml"))
       end
 
       def abort_could_not_find(missing)

data/lib/sqlite3/version.rb

@@ -1,11 +1,11 @@
 module SQLite3
 
-  VERSION = "1.5.0"
+  VERSION = "1.5.2"
 
   module VersionProxy
     MAJOR = 1
     MINOR = 5
-    TINY  = 0
+    TINY  = 2
     BUILD = nil
 
     STRING = [ MAJOR, MINOR, TINY, BUILD ].compact.join( "." )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqlite3
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.5.2
 platform: x64-mingw32
 authors:
 - Jamis Buck
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-09-08 00:00:00.000000000 Z
+date: 2022-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -103,6 +103,7 @@ files:
 - LICENSE
 - LICENSE-DEPENDENCIES
 - README.md
+- dependencies.yml
 - ext/sqlite3/aggregator.c
 - ext/sqlite3/aggregator.h
 - ext/sqlite3/backup.c