sqlite3 2.9.4-x86_64-darwin → 2.9.5-x86_64-darwin

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e5fa4d2ca895b8d4027d57e8d7a29eba7a8452db3cbd648f7acbe4ba3f300920
-  data.tar.gz: 553408f8264d6421c3f56d0f11cac2650d6bb98605913b478dd8f7d0e5eb08c4
+  metadata.gz: 62489277966318962a9b48cc93fbefecdbfdbcc0a1fe2051bd063a66d690b0fe
+  data.tar.gz: b9b81e637110ed34321ca53f1864e7e87223733be80966dc6bde52ff5f82c305
 SHA512:
-  metadata.gz: 4bebd3c89f74d9f3a39caff853fde16a4d6b838707a01e75fa0d511f6d1f338ab7cfe64765401161e87bff951637a5624f2f5b78a4003b3727848b20cb4098be
-  data.tar.gz: 801551e78991307d47e8c0b4d80a783d95669251bd0a19f04bf0d6391b5a8060496de8335fd138fffaaf679197eac4dab17404f720551749ab57a05612dc3dc4
+  metadata.gz: e7c4cefaef4864ece5c700dc72d3f095f5741adf633e4fcaa0f41db649f6b56b892012cd2e9e991cfdb0342dc5f8f2fbef01bad4c30689db711f1cffe8d56e2e
+  data.tar.gz: 48d58189d0a34e696ad7d3f9eaeaf26373eba131b8f615f180926f3199fc04618e04aeec39dac47784faf8f3ee14db4d19b15b721ca641d298a10acafa94a15b

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # sqlite3-ruby Changelog
 
+## 2.9.5 / 2026-06-07
+
+### Dependencies
+
+- Vendored sqlite is updated to [v3.53.2](https://www.sqlite.org/releaselog/3_53_3.html) (from v3.53.1). #709 @flavorjones
+
+### Security / Stability
+
+- Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89 for more information. #710 @flavorjones
+- Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3 for more information. #711 @flavorjones
+
+
 ## 2.9.4 / 2026-05-05
 
 - Vendored sqlite is updated to [v3.53.1](https://www.sqlite.org/releaselog/3_53_1.html) (from v3.53.0). #704 @flavorjones

data/dependencies.yml

@@ -1,13 +1,13 @@
 sqlite3:
   # checksum verified by first checking the published sha3(256) checksum against https://sqlite.org/download.html:
-  # 36ca143645cf76997d07b66e9244c636b8ccdec64a1d50558259c4e415e6558b
+  # 025328da165109f48abccc6e7478508060804412bed2bd81d47e98ba1b72983b
   #
-  # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3530100.tar.gz
-  # 36ca143645cf76997d07b66e9244c636b8ccdec64a1d50558259c4e415e6558b  ports/archives/sqlite-autoconf-3530100.tar.gz
+  # $ sha3sum -a 256 ports/archives/sqlite-autoconf-3530200.tar.gz
+  # 025328da165109f48abccc6e7478508060804412bed2bd81d47e98ba1b72983b  ports/archives/sqlite-autoconf-3530200.tar.gz
   #
-  # $ sha256sum ports/archives/sqlite-autoconf-3530100.tar.gz
-  # 83e6b2020a034e9a7ad4a72feea59e1ad52f162e09cbd26735a3ffb98359fc4f  ports/archives/sqlite-autoconf-3530100.tar.gz
-  version: "3.53.1"
+  # $ sha256sum ports/archives/sqlite-autoconf-3530200.tar.gz
+  # 588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316  ports/archives/sqlite-autoconf-3530200.tar.gz
+  version: "3.53.2"
   files:
-    - url: "https://sqlite.org/2026/sqlite-autoconf-3530100.tar.gz"
-      sha256: "83e6b2020a034e9a7ad4a72feea59e1ad52f162e09cbd26735a3ffb98359fc4f"
+    - url: "https://sqlite.org/2026/sqlite-autoconf-3530200.tar.gz"
+      sha256: "588ad51949419a56ebe81fe56193d510c559eb94c9a57748387860b5d3069316"

data/ext/sqlite3/database.c

@@ -198,8 +198,6 @@ sqlite3_rb_close(VALUE self)
 
     close_or_discard_db(ctx);
 
-    rb_iv_set(self, "-aggregators", Qnil);
-
     return self;
 }
 
@@ -212,8 +210,6 @@ sqlite3_rb_discard(VALUE self)
 
     discard_db(ctx);
 
-    rb_iv_set(self, "-aggregators", Qnil);
-
     return self;
 }
 
@@ -528,7 +524,7 @@ define_function_with_flags(VALUE self, VALUE name, VALUE flags)
 
     CHECK(ctx->db, status);
 
-    rb_hash_aset(rb_iv_get(self, "@functions"), name, block);
+    rb_ary_push(rb_iv_get(self, "@functions"), block);
 
     return self;
 }

data/ext/sqlite3/extconf.rb

@@ -105,10 +105,10 @@ module Sqlite3
       def configure_extension
         append_cflags("-fvisibility=hidden") # see https://github.com/rake-compiler/rake-compiler-dock/issues/87
 
-        if find_header("sqlite3.h")
-          # noop
-        elsif sqlcipher? && find_header("sqlcipher/sqlite3.h")
+        if sqlcipher? && find_header("sqlcipher/sqlite3.h")
           append_cppflags("-DUSING_SQLCIPHER_INC_SUBDIR")
+        elsif find_header("sqlite3.h")
+          # noop
         else
           abort_could_not_find("sqlite3.h")
         end

data/lib/sqlite3/database.rb

@@ -175,7 +175,7 @@ module SQLite3
       @authorizer = nil
       @progress_handler = nil
       @collations = {}
-      @functions = {}
+      @functions = []
       @results_as_hash = options[:results_as_hash]
       @readonly = mode & Constants::Open::READONLY != 0
       @default_transaction_mode = options[:default_transaction_mode] || :deferred
@@ -398,6 +398,8 @@ module SQLite3
     # the FunctionProxy#result= method on the +func+ parameter and
     # indicate the return value that way.
     #
+    # A reference to the block will be kept for the lifetime of the database object.
+    #
     # Example:
     #
     #   db.create_function( "maim", 1 ) do |func, value|
@@ -437,6 +439,8 @@ module SQLite3
     # function invocation. It should invoke FunctionProxy#result= to
     # store the result of the function.
     #
+    # A reference to the block will be kept for the lifetime of the database object.
+    #
     # Example:
     #
     #   db.create_aggregate( "lengths", 1 ) do

data/lib/sqlite3/version.rb

@@ -1,4 +1,4 @@
 module SQLite3
   # (String) the version of the sqlite3 gem, e.g. "2.1.1"
-  VERSION = "2.9.4"
+  VERSION = "2.9.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqlite3
 version: !ruby/object:Gem::Version
-  version: 2.9.4
+  version: 2.9.5
 platform: x86_64-darwin
 authors:
 - Jamis Buck