sqlite3 2.9.4 → 2.9.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8d8d7877b1eded0d31ae508e3f8fe14f1298b60c062f6a68258d564a62d898b7
-  data.tar.gz: e4f52286f1282d53ec2a0f17bab574edb175ef97a9c00edce61972d50e57cd5e
+  metadata.gz: d07346cdcb69a6187d144247aefa90dbf7b2966513f94643e20baa18dd38fbbf
+  data.tar.gz: e1c7385c0d16942a8b3b9fc4976b486e1b1fed18524975e0d53a608d542a2943
 SHA512:
-  metadata.gz: c88e6c7e05b8e4ed99f57f6f86425f55cd2cc2f66d47c9f2276faaf7c2bcd6140203d94c69e0d93100b8d4cecce2600be75fabba0426b080e3d710608ea2356a
-  data.tar.gz: 77b56dde40aeeb6b60c5c06b91dce64c58f6939ac86178721801ae5e5a9f40040fa7f6412175338ec4ed6c9f04284f5d6ba29794adf74b98c1083952bc035576
+  metadata.gz: 0e95401b70a9780e5e5a1903e3b9cf3d0aa588e75c89db0211642918d83305132b06ab169ee519633d507fc27a1d6674e344162acae905c8fe14478850a3b3cf
+  data.tar.gz: ab4fb4b3a3b7dba95cbb0e7cbb893c9223de6f5ca82469ac68f35f6b89293bc2ba8292cd5d561cfb245e038769880b60edb6a4896a4b9072305661dda2f9e999

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # sqlite3-ruby Changelog
 
+## 2.9.5 / 2026-06-07
+
+### Dependencies
+
+- Vendored sqlite is updated to [v3.53.2](https://www.sqlite.org/releaselog/3_53_3.html) (from v3.53.1). #709 @flavorjones
+
+### Security / Stability
+
+- Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89 for more information. #710 @flavorjones
+- Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3 for more information. #711 @flavorjones
+
+
 ## 2.9.4 / 2026-05-05
 
 - Vendored sqlite is updated to [v3.53.1](https://www.sqlite.org/releaselog/3_53_1.html) (from v3.53.0). #704 @flavorjones

data/dependencies.yml

@@ -1,13 +1,13 @@
 sqlite3:
   # checksum verified by first checking the published sha3(256) checksum against https://sqlite.org/download.html:
-  # 36ca143645cf76997d07b66e9244c636b8ccdec64a1d50558259c4e415e6558b
+  # 025328da165109f48abccc6e7478508060804412bed2bd81d47e98ba1b72983b
   #
-  # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3530100.tar.gz
-  # 36ca143645cf76997d07b66e9244c636b8ccdec64a1d50558259c4e415e6558b  ports/archives/sqlite-autoconf-3530100.tar.gz
+  # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3530200.tar.gz
+  # 025328da165109f48abccc6e7478508060804412bed2bd81d47e98ba1b72983b  ports/archives/sqlite-autoconf-3530200.tar.gz
   #
-  # $ sha256sum ports/archives/sqlite-autoconf-3530100.tar.gz
-  # 83e6b2020a034e9a7ad4a72feea59e1ad52f162e09cbd26735a3ffb98359fc4f  ports/archives/sqlite-autoconf-3530100.tar.gz
-  version: "3.53.1"
+  # $ sha256sum ports/archives/sqlite-autoconf-3530200.tar.gz
+  # 588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316  ports/archives/sqlite-autoconf-3530200.tar.gz
+  version: "3.53.2"
   files:
-    - url: "https://sqlite.org/2026/sqlite-autoconf-3530100.tar.gz"
-      sha256: "83e6b2020a034e9a7ad4a72feea59e1ad52f162e09cbd26735a3ffb98359fc4f"
+    - url: "https://sqlite.org/2026/sqlite-autoconf-3530200.tar.gz"
+      sha256: "588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316"

data/ext/sqlite3/database.c

@@ -198,8 +198,6 @@ sqlite3_rb_close(VALUE self)
 
     close_or_discard_db(ctx);
 
-    rb_iv_set(self, "-aggregators", Qnil);
-
     return self;
 }
 
@@ -212,8 +210,6 @@ sqlite3_rb_discard(VALUE self)
 
     discard_db(ctx);
 
-    rb_iv_set(self, "-aggregators", Qnil);
-
     return self;
 }
 
@@ -528,7 +524,7 @@ define_function_with_flags(VALUE self, VALUE name, VALUE flags)
 
     CHECK(ctx->db, status);
 
-    rb_hash_aset(rb_iv_get(self, "@functions"), name, block);
+    rb_ary_push(rb_iv_get(self, "@functions"), block);
 
     return self;
 }

data/ext/sqlite3/extconf.rb

@@ -105,10 +105,10 @@ module Sqlite3
       def configure_extension
         append_cflags("-fvisibility=hidden") # see https://github.com/rake-compiler/rake-compiler-dock/issues/87
 
-        if find_header("sqlite3.h")
-          # noop
-        elsif sqlcipher? && find_header("sqlcipher/sqlite3.h")
+        if sqlcipher? && find_header("sqlcipher/sqlite3.h")
           append_cppflags("-DUSING_SQLCIPHER_INC_SUBDIR")
+        elsif find_header("sqlite3.h")
+          # noop
         else
           abort_could_not_find("sqlite3.h")
         end

data/lib/sqlite3/database.rb

@@ -175,7 +175,7 @@ module SQLite3
       @authorizer = nil
       @progress_handler = nil
       @collations = {}
-      @functions = {}
+      @functions = []
       @results_as_hash = options[:results_as_hash]
       @readonly = mode & Constants::Open::READONLY != 0
       @default_transaction_mode = options[:default_transaction_mode] || :deferred
@@ -398,6 +398,8 @@ module SQLite3
     # the FunctionProxy#result= method on the +func+ parameter and
     # indicate the return value that way.
     #
+    # A reference to the block will be kept for the lifetime of the database object.
+    #
     # Example:
     #
     #   db.create_function( "maim", 1 ) do |func, value|
@@ -437,6 +439,8 @@ module SQLite3
     # function invocation. It should invoke FunctionProxy#result= to
     # store the result of the function.
     #
+    # A reference to the block will be kept for the lifetime of the database object.
+    #
     # Example:
     #
     #   db.create_aggregate( "lengths", 1 ) do

data/lib/sqlite3/version.rb

@@ -1,4 +1,4 @@
 module SQLite3
   # (String) the version of the sqlite3 gem, e.g. "2.1.1"
-  VERSION = "2.9.4"
+  VERSION = "2.9.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqlite3
 version: !ruby/object:Gem::Version
-  version: 2.9.4
+  version: 2.9.5
 platform: ruby
 authors:
 - Jamis Buck
@@ -75,7 +75,7 @@ files:
 - lib/sqlite3/value.rb
 - lib/sqlite3/version.rb
 - lib/sqlite3/version_info.rb
-- ports/archives/sqlite-autoconf-3530100.tar.gz
+- ports/archives/sqlite-autoconf-3530200.tar.gz
 homepage: https://github.com/sparklemotion/sqlite3-ruby
 licenses:
 - BSD-3-Clause
@@ -103,7 +103,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Ruby library to interface with the SQLite3 database engine (http://www.sqlite.org).
 test_files: []