Skip to content

fix(deps): update to libsqlite3-sys v0.25 #2176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from

Conversation

huitseeker
Copy link

@huitseeker huitseeker commented Oct 26, 2022

v0.25.1 the latest published version of libsqlite3-sys, and upgrades sqlite to 3.39.2:
https://github.com/rusqlite/rusqlite/blob/sys0.25.1/libsqlite3-sys/sqlite3/bindgen_bundled_version.rs#L3

Which contains the first SQLite version containing the fix to CVE-2022-35737.

More details on the vulnerability:
https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/

@thomcc
Copy link

thomcc commented Oct 26, 2022

(FWIW in the near future I hope to get libsqlite3-sys to a point where it no longer needs to make breaking changes. this should make this kind of thing less necessary. The initial version of this should be up this weekend, but you should still merge this in the meantime)

@abonander
Copy link
Collaborator

We merged this update to 0.7-dev several weeks ago. It would have been released by now but our priorities changed for a bit; my goal is to get it out by the end of November. This will be the third duplicate PR I've had to close.

Starting with that release, we're considering the linkage with libsqlite3-sys to be semver-exempt so we can upgrade it as necessary, exactly for situations like this. We've historically gotten yelled at for doing that in backwards-compatible releases, so I'm not sure there's anything I can currently do, unless this is enough of an emergency that it warrants releasing 0.7.0 just for this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants