sqlite3 1.5.0.rc2 → 1.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3870b929ee6789561b453bf1bf32e961987daac368e906b04497cf048e599c46
-  data.tar.gz: 489f456707e21c72e128044d0b7f2f627cdf4d77afb7cddc389a236901999ff1
+  metadata.gz: 14940fe0b1e0cb9f9d1ea85675d7c31c814418e1dbaa5503d20b7c6979817780
+  data.tar.gz: 270770317eb93285810b1b5cb9572467bdf8869a63bc1b4e78b0bfcc54e69a73
 SHA512:
-  metadata.gz: 6a896073ed2fd4d00ad59b955e200c20b6a18b7f4297d715a2aecabb583a89ef61a12936ceae906a2b179f45c54ba833411d8d04d9960e2983b9b1782079c0b0
-  data.tar.gz: d08207f1bc69ee6bbfa17082c47bff82d4b3c67260bdcd25a6f1ba4fd3116e6a0b9e7f3206a05080a5f9c2432137121e99238b10f7fc302fc7b0ba409dfbf4da
+  metadata.gz: d8fa16a98f024f558784bad14add322bd979c86a159ad51603633311fbcca7da8bbae559465dfef082d2a7867c8de6e56b7e7311cb23e18ab53976f71e89f96d
+  data.tar.gz: 82639bbe8d90f333d7f4bc2ca29beb0f235125b868418159d1f8c13d8f62735e3ff8a4edae9e38f963f2e252c8afea615227121f8fc71e5ebcb25968adc0ff7a

data/CHANGELOG.md

@@ -1,6 +1,27 @@
 # sqlite3-ruby Changelog
 
-## 1.5.0 / unreleased
+## 1.5.1 / 2022-09-29
+
+### Dependencies
+
+* Vendored sqlite is updated to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).
+
+### Security
+
+The vendored version of sqlite, v3.39.4, should be considered to be a security release. From the release notes:
+
+> Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the
+> prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so
+> this should be considered a security update.
+>
+> In order to exploit the vulnerability, an attacker must have full SQL access and must be able to
+> construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit
+> signed integer overflow.
+
+For more information please see [GHSA-mgvv-5mxp-xq67](https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mgvv-5mxp-xq67).
+
+
+## 1.5.0 / 2022-09-08
 
 ### Packaging
 
@@ -23,13 +44,13 @@ See [the README](https://github.com/sparklemotion/sqlite3-ruby#native-gems-recom
 
 #### More consistent developer experience
 
-Both the native (precompiled) gems and the vanilla "ruby platform" (source) gem include sqlite v3.39.2 by default.
+Both the native (precompiled) gems and the vanilla "ruby platform" (source) gem include sqlite v3.39.3 by default.
 
 Defaulting to a consistent version of sqlite across all systems means that your development environment behaves exactly like your production environment, and you have access to the latest and greatest features of sqlite.
 
 You can opt-out of the packaged version of sqlite (and use your system-installed library as in versions < 1.5.0). See [the README](https://github.com/sparklemotion/sqlite3-ruby#avoiding-the-precompiled-native-gem) for more information.
 
-[Release notes for this version of sqlite](https://sqlite.org/releaselog/3_39_0.html)
+[Release notes for this version of sqlite](https://sqlite.org/releaselog/3_39_3.html)
 
 
 ### Rubies and Platforms

data/README.md

@@ -107,7 +107,8 @@ If you're on a platform that supports a native gem but you want to avoid using i
 
 - If you're not using Bundler, then run `gem install sqlite3 --platform=ruby`
 - If you are using Bundler
-  - version 2.1 or later, then you'll need to run `bundle config set force_ruby_platform true`,
+  - version 2.3.18 or later, you can specify [`gem "sqlite3", force_ruby_platform: true`](https://bundler.io/v2.3/man/gemfile.5.html#FORCE_RUBY_PLATFORM)
+  - version 2.1 or later, then you'll need to run `bundle config set force_ruby_platform true`
   - version 2.0 or earlier, then you'll need to run `bundle config force_ruby_platform true`
 
 
@@ -118,7 +119,7 @@ If you are on a platform or version of Ruby that is not covered by the Native Ge
 
 #### Packaged libsqlite3
 
-By default, as of v1.5.0 of this library, libsqlite3 v3.38.5 is packaged with the gem and will be compiled and used automatically. This takes a bit longer than the native gem, but will provide a modern, well-supported version of libsqlite3.
+By default, as of v1.5.0 of this library, the latest available version of libsqlite3 is packaged with the gem and will be compiled and used automatically. This takes a bit longer than the native gem, but will provide a modern, well-supported version of libsqlite3.
 
 For example, on a linux system running Ruby 2.5:
 
@@ -143,6 +144,7 @@ If you would prefer to build the sqlite3-ruby gem against your system libsqlite3
 
 PLEASE NOTE:
 
+- you must avoid installing a precompiled native gem (see [previous section](#avoiding-the-precompiled-native-gem))
 - only versions of libsqlite3 `>= 3.5.0` are supported,
 - and some library features may depend on how your libsqlite3 was compiled.
 

data/ext/sqlite3/aggregator.c

@@ -265,9 +265,10 @@ rb_sqlite3_define_aggregator2(VALUE self, VALUE aggregator, VALUE ruby_name)
 void
 rb_sqlite3_aggregator_init(void)
 {
-  rb_gc_register_address(&cAggregatorWrapper);
-  rb_gc_register_address(&cAggregatorInstance);
   /* rb_class_new generatos class with undefined allocator in ruby 1.9 */
   cAggregatorWrapper = rb_funcall(rb_cClass, rb_intern("new"), 0);
+  rb_gc_register_mark_object(cAggregatorWrapper);
+
   cAggregatorInstance = rb_funcall(rb_cClass, rb_intern("new"), 0);
+  rb_gc_register_mark_object(cAggregatorInstance);
 }

data/ext/sqlite3/extconf.rb

@@ -133,18 +133,18 @@ module Sqlite3
       def mini_portile_config
         {
           sqlite3: {
-            # checksum verified by first checking the published sha3(256) checksum:
+            # checksum verified by first checking the published sha3(256) checksum against https://sqlite.org/download.html:
             #
-            # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3390200.tar.gz
-            # b195891eb32305481e61c6718b8cc3b090685b613c4824a076c63166a46c5bee  ports/archives/sqlite-autoconf-3390200.tar.gz
+            # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3390400.tar.gz
+            # 431328e30d12c551da9ba7ef2122b269076058512014afa799caaf62ca567090  ports/archives/sqlite-autoconf-3390400.tar.gz
             #
-            # $ sha256sum ports/archives/sqlite-autoconf-3390200.tar.gz
-            # 852be8a6183a17ba47cee0bbff7400b7aa5affd283bf3beefc34fcd088a239de  ports/archives/sqlite-autoconf-3390200.tar.gz
+            # $ sha256sum ports/archives/sqlite-autoconf-3390400.tar.gz
+            # f31d445b48e67e284cf206717cc170ab63cbe4fd7f79a82793b772285e78fdbb  ports/archives/sqlite-autoconf-3390400.tar.gz
             #
-            version: "3.39.2",
+            version: "3.39.4",
             files: [{
-                      url: "https://www.sqlite.org/2022/sqlite-autoconf-3390200.tar.gz",
-                      sha256: "852be8a6183a17ba47cee0bbff7400b7aa5affd283bf3beefc34fcd088a239de",
+                      url: "https://sqlite.org/2022/sqlite-autoconf-3390400.tar.gz",
+                      sha256: "f31d445b48e67e284cf206717cc170ab63cbe4fd7f79a82793b772285e78fdbb",
                     }],
           }
         }

data/lib/sqlite3/version.rb

@@ -1,16 +1,14 @@
 module SQLite3
 
-  VERSION = "1.5.0.rc2"
+  VERSION = "1.5.1"
 
   module VersionProxy
-
     MAJOR = 1
     MINOR = 5
-    TINY  = 0
-    BUILD = "rc2"
+    TINY  = 1
+    BUILD = nil
 
     STRING = [ MAJOR, MINOR, TINY, BUILD ].compact.join( "." )
-    #:beta-tag:
 
     VERSION = ::SQLite3::VERSION
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqlite3
 version: !ruby/object:Gem::Version
-  version: 1.5.0.rc2
+  version: 1.5.1
 platform: ruby
 authors:
 - Jamis Buck
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-08-30 00:00:00.000000000 Z
+date: 2022-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_portile2
@@ -188,9 +188,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.3.7
 signing_key: