🚨 [security] [ruby] Update sqlite3 2.7.4 → 2.9.5 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ sqlite3 (2.7.4 → 2.9.5) · Repo · Changelog

Security Advisories 🚨

🚨 sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Summary

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

🚨 sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Release Notes

2.9.5

2.9.5 / 2026-06-07

Dependencies

• Vendored sqlite is updated to v3.53.2 (from v3.53.1). #709 @flavorjones

Security / Stability

• Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See GHSA-28hh-pr2h-2w89 for more information. #710 @flavorjones
• Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See GHSA-j7fr-3v8c-3qc3 for more information. #711 @flavorjones

sha256 checksums

78075b6337d3d182c6d2b4691049ed45cd220826160c9ea18946bf6a1de200dc  gems/sqlite3-2.9.5-aarch64-linux-gnu.gem
18c801185deb4adc01ddb281e8f672a39e3d1729979ca91e39439cd3eac0402d  gems/sqlite3-2.9.5-aarch64-linux-musl.gem
1bdfca0c7d63998c60b0f4a8e3c8df2d33800ccc4abd2d612eddbbbc92a4c48b  gems/sqlite3-2.9.5-arm-linux-gnu.gem
bae1109d12b2e9f588455967729b008e1ff4feb7761749df695019c9079913c6  gems/sqlite3-2.9.5-arm-linux-musl.gem
d0cf444a70fc9395d513cfbcc1e6719e224aa645314e3824cb0474c721425aa2  gems/sqlite3-2.9.5-arm64-darwin.gem
b00d5697994ee8589b6096694a2130aa5567db64373baca55ea98c9bf958f46a  gems/sqlite3-2.9.5-x64-mingw-ucrt.gem
c94b96b16f17796be6fa099d15218b52e396f55690c4760faaaefa21ebab9dd5  gems/sqlite3-2.9.5-x86-linux-gnu.gem
063a8c13cbadfe7f29453b1706cbdf91fca4a78d244f816ff20bac4fb259f1e4  gems/sqlite3-2.9.5-x86-linux-musl.gem
8e9caae38bd7ebb29cbeee3e7ab1d12dc2327d9a1b92c7fcf0dda05589627a81  gems/sqlite3-2.9.5-x86_64-darwin.gem
233dbcb6714148dd23bc5aeb33e8efd6eac974969564ddd5794c23d5f52b231e  gems/sqlite3-2.9.5-x86_64-linux-gnu.gem
e7d3a7474e8af0f96150c21abc203fbab5437206bfcdf11deab7741c0ca516f2  gems/sqlite3-2.9.5-x86_64-linux-musl.gem
04572973a3f943ad50a8adfffc8dd752a5f06e4c3db2026f71838fed8a982606  gems/sqlite3-2.9.5.gem

2.9.4

2.9.4 / 2026-05-05

• Vendored sqlite is updated to v3.53.1 (from v3.53.0). #704 @flavorjones

sha256 checksums

ecabed721e6eaad54601d2685f09029d90025efc8d931040dc89cb3f8a2080ec  gems/sqlite3-2.9.4-aarch64-linux-gnu.gem
ffb4255947fb54c8c3eeca97460c9702b40de91ce390455ef7367ca6a3929a31  gems/sqlite3-2.9.4-aarch64-linux-musl.gem
9ee2008b9fbec984c3c165b0d7eedd2bd2a415100b761bfa3a4c6fbec9208bf6  gems/sqlite3-2.9.4-arm-linux-gnu.gem
8dc1fe4da6977992cd62decf4a93ccf6cc2e124a5e6a340160d52092f70e837a  gems/sqlite3-2.9.4-arm-linux-musl.gem
1d5aad413a815d236e96d43f05a1acc600b6cd086800770342a3f9c2877499ff  gems/sqlite3-2.9.4-arm64-darwin.gem
40997c549b19e2fdfcc5e271f6bdd4d502179742c0bfd678da23d0d09b929848  gems/sqlite3-2.9.4-x64-mingw-ucrt.gem
5cab40ea734796802853501bd23b6162eec391dc37f3bf04bc2ffbda9c8bf93d  gems/sqlite3-2.9.4-x86-linux-gnu.gem
936e2d4a428887fac15f55e26a18671fbb4e522bffaa43969fadf7b40ab25214  gems/sqlite3-2.9.4-x86-linux-musl.gem
f280c476e360b73e86165a5e59b72801385b4a6c3a47f8af5ecefb9d90bec17f  gems/sqlite3-2.9.4-x86_64-darwin.gem
537a3eda71b1df1336d0055cbebe55a7317c34870c192c7b6b9d8d0be6871847  gems/sqlite3-2.9.4-x86_64-linux-gnu.gem
3fc5e865b4be9a85d998203ef8d0c0fdcb92f20acf34a254346ff8a19088efec  gems/sqlite3-2.9.4-x86_64-linux-musl.gem
6161c5b9c17886b289558e6c8082b28a22a814736d2433c9a67f4c6bfcde5c97  gems/sqlite3-2.9.4.gem

2.9.3

2.9.3 / 2026-04-15

• Vendored sqlite is updated to v3.53.0 (from v3.51.3). #696 @flavorjones

SHA256 Checksums

ca6dd1cf6c037ccc8d3e5837190cc61ef15466092014951235641b5c4c8ab4ee  sqlite3-2.9.3-aarch64-linux-gnu.gem
ff017a36c463d02e9f0be7a6224521371128024e6a05ed16994afa5c037afbba  sqlite3-2.9.3-aarch64-linux-musl.gem
fd8b74337a66bdaf746b97d65e6c9a2faff803c8f72d6b107fb880972815d072  sqlite3-2.9.3-arm-linux-gnu.gem
792ae9a786bb37dbdc4c443c527bc91df423aac10e472f76d5cf5a9ac6d51980  sqlite3-2.9.3-arm-linux-musl.gem
76b265d3d57362d3e38338f24f50a0c9cd47a4599c9cfbb578fac125d2299906  sqlite3-2.9.3-arm64-darwin.gem
61edb2ce7a58e800478602e88b67e99f029b44747405c94c0cce7d165b0d0a96  sqlite3-2.9.3-x64-mingw-ucrt.gem
ceb2417f01563a2800836fbbc6d59aa0ca591882c99f6c50fdc0c8090da7a03b  sqlite3-2.9.3-x86-linux-gnu.gem
1688e37da36a4513a1a1d6e9abb643f68723599abbe564cb1a1bf496c9ae8dca  sqlite3-2.9.3-x86-linux-musl.gem
087e7cc4efc73d83e76354f028c4d1dc14552a05acc74f60e77a55f1bee6ef22  sqlite3-2.9.3-x86_64-darwin.gem
85200a10c6cf5c60085fcca411a3168c5fba8fda3e2b1b0109ec277d7c226d46  sqlite3-2.9.3-x86_64-linux-gnu.gem
b6d0437046d9180335dea1aa0592802e65c4f7b57409d63f14408211bf28536b  sqlite3-2.9.3-x86_64-linux-musl.gem
e5ca871c87241bfdaf0e4a90d5177f4e4fe7af5f6951f88b4644339cc76e47ae  sqlite3-2.9.3.gem

2.9.2

2.9.2 / 2026-03-15

• Vendored sqlite is updated to v3.51.3 (from v3.51.2). #688 @flavorjones

SHA256 Checksums

eeb86db55645b85327ba75129e3614658d974bf4da8fdc87018a0d42c59f6e42  sqlite3-2.9.2-aarch64-linux-gnu.gem
4feff91fb8c2b13688da34b5627c9d1ed9cedb3ee87a7114ec82209147f07a6d  sqlite3-2.9.2-aarch64-linux-musl.gem
1ee2eb06b5301aaf5ce343a6e88d99ac932d95202d7b350f0e7b6d8d588580d7  sqlite3-2.9.2-arm-linux-gnu.gem
8ca0de6aceede968de0394e22e95d549834c4d8e318f69a92a52f049878a0057  sqlite3-2.9.2-arm-linux-musl.gem
d15bd9609a05f9d54930babe039585efc8cadd57517c15b64ec7dfa75158a5e9  sqlite3-2.9.2-arm64-darwin.gem
b1b10d8c45a495b1e5b6338f7baa11297522bb9809b01e7e575090edd685953e  sqlite3-2.9.2-x64-mingw-ucrt.gem
066bc904522f8a7072236a81237c03a4a1dfe070a25107e392de03d1e4ad0e6d  sqlite3-2.9.2-x86-linux-gnu.gem
6503c76278f5e8629b12b6518ff43a9a4f6d9381de73f0b086c9fa1226db5ede  sqlite3-2.9.2-x86-linux-musl.gem
ed691b5021674d72582d03c5a38e89634b961902735fb6225273892805421d13  sqlite3-2.9.2-x86_64-darwin.gem
dce83ffcb7e72f9f7aeb6e5404f15d277a45332fe18ccce8a8b3ed51e8d23aee  sqlite3-2.9.2-x86_64-linux-gnu.gem
e8dd906a613f13b60f6d47ae9dda376384d9de1ab3f7e3f2fdf2fd18a871a2d7  sqlite3-2.9.2-x86_64-linux-musl.gem
86814150714b6b06a328d083f46408e7a4a83b5f0a9673ed934ee3a1cb7a73b1  sqlite3-2.9.2.gem

2.9.1

2.9.1 / 2026-02-28

• Vendored sqlite is updated to v3.51.2 (from v3.51.1). #683 @flavorjones

---

SHA256 checksums:

85535ddf1c37f116ebebe0330bbbffc2ccb55d09f69717a565f8cfb35142f136  sqlite3-2.9.1-aarch64-linux-gnu.gem
646a28a655fc0298ff4266de0af89b66477a2d9ad65cebb5abad190bb64ed092  sqlite3-2.9.1-aarch64-linux-musl.gem
ed25696b0fb4694ca4f47287eaaa9e0d46a0a0c92990c453743d6ab6b4f51fa0  sqlite3-2.9.1-arm-linux-gnu.gem
82ca90eefe50935c827ab0c8dffff5219f57b5da0c92039e3e27f7dbccc9e992  sqlite3-2.9.1-arm-linux-musl.gem
e0cc5521aa03361e2da56635f3745242510b0b98c4608a3824b7e31ab2e7ffb9  sqlite3-2.9.1-arm64-darwin.gem
ffae7b4c712f4e29cef2a95125bb2144624e4c675fb5c19175231a20f128dfd1  sqlite3-2.9.1-x64-mingw-ucrt.gem
c3517e6f0df1f3a99fb73c5b0e6f02fc93b3b6b2ca0de72cb6d3956153310603  sqlite3-2.9.1-x86-linux-gnu.gem
2216ab52dbff54bbc5ea87789e02c60f1c749f7ce052cef36da542ecc9aadc25  sqlite3-2.9.1-x86-linux-musl.gem
5ce2c05eed8dc7c6debd560e2c5960e36521652b9a43bc3e42bc431db600c36f  sqlite3-2.9.1-x86_64-darwin.gem
1cbb644204ed143e5c96f6d59b5c571ba6f18b18a9dc5aa11c101187ff227afd  sqlite3-2.9.1-x86_64-linux-gnu.gem
bbd50dd1caca78b6c069701d9009ef714461495985d4c374ea1a1def061ba67c  sqlite3-2.9.1-x86_64-linux-musl.gem
f6ddc2ec850434ac14498944da9d768fe154dbcd4163fc9e173a524d95e2f887  sqlite3-2.9.1.gem

2.9.0

2.9.0 / 2025-12-27

Ruby

• Introduce native gem packages for Ruby 4.0. @flavorjones
• Drop support for Ruby 3.1. @flavorjones

Added

• Introduce Statement#named_params to introspect on a parameterized SQL statement. #627 #642 @captn3m0

Improved

• Small improvements to docstrings and comments. @flavorjones @houyuanjie

sha256 checksums

cfe1e0216f46d7483839719bf827129151e6c680317b99d7b8fc1597a3e13473  sqlite3-2.9.0-aarch64-linux-gnu.gem
56a35cb2d70779afc2ac191baf2c2148242285ecfed72f9b021218c5c4917913  sqlite3-2.9.0-aarch64-linux-musl.gem
a19a21504b0d7c8c825fbbf37b358ae316b6bd0d0134c619874060b2eef05435  sqlite3-2.9.0-arm-linux-gnu.gem
fca5b26197c70e3363115d3faaea34d7b2ad9c7f5fa8d8312e31b64e7556ee07  sqlite3-2.9.0-arm-linux-musl.gem
a917bd9b84285766ff3300b7d79cd583f5a067594c8c1263e6441618c04a6ed3  sqlite3-2.9.0-arm64-darwin.gem
677333ebf8f496f7ffe89bf1e5f8c5331ffe83249228cb262cd896ce8d383da6  sqlite3-2.9.0-x64-mingw-ucrt.gem
47317ba230f6c2c361981aa5fc1bf9de1b99727317171393ba90abab092c5b5f  sqlite3-2.9.0-x86-linux-gnu.gem
b627f3a2ca59aaaa5e10b8666cdbd7122469b49afa4bd895133cecb7b5c1368d  sqlite3-2.9.0-x86-linux-musl.gem
59fe51baa3cb33c36d27ce78b4ed9360cd33ccca09498c2ae63850c97c0a6026  sqlite3-2.9.0-x86_64-darwin.gem
72fff9bd750070ba3af695511ba5f0e0a2d8a9206f84869640b3e99dfaf3d5a5  sqlite3-2.9.0-x86_64-linux-gnu.gem
ef716ba7a66d7deb1ccc402ac3a6d7343da17fac862793b7f0be3d2917253c90  sqlite3-2.9.0-x86_64-linux-musl.gem
ece9c00b32ec5f550d3a4a35c41ea8d738563589f090b9dfd0d510b7ae5f296c  sqlite3-2.9.0.gem

New Contributors

• @captn3m0 made their first contribution in #642
• @houyuanjie made their first contribution in #671

Full Changelog: v2.8.1...v2.9.0

2.8.1

2.8.1 / 2025-11-29

• Vendored sqlite is updated to v3.51.1 (from v3.51.0). #659 @flavorjones
• Precompiled native gems are built with rake-compiler-dock v1.10.0 (previously v1.9.1).

sha256 checksums

9bce166d3e3595a42fc92c28d986ea11d499b55be8bd1cd491be04af30029543  sqlite3-2.8.1-aarch64-linux-gnu.gem
34912f6acf3e9c43c7998c6f99ba3146708e654cf9716b2983e260315cdeed72  sqlite3-2.8.1-aarch64-linux-musl.gem
9118d6abb5ca7ea4f1b50a6c42c763e612670f5eb673bbdf12e8d3bd63339bde  sqlite3-2.8.1-arm-linux-gnu.gem
48a50815521f812713310190589a8ae196fa48b70b62b72f5766bafebae77e33  sqlite3-2.8.1-arm-linux-musl.gem
3cb617640577ec9c1b7c09744d1e368ad3d3851c2494540f5f007387da943477  sqlite3-2.8.1-arm64-darwin.gem
f3cd0f188c156f54787ced89b1875873537b3d4cf26e9af042dcba883799f53a  sqlite3-2.8.1-x64-mingw-ucrt.gem
698f51acbc6bafc53cd30502a66ade93d66331d211611bb94ea8ea08579c4be1  sqlite3-2.8.1-x86-linux-gnu.gem
e2dd968b2dbc4c2eeb65a5f26b5a4b2ed960c2624c2b8afc8fe3061d2f2115d7  sqlite3-2.8.1-x86-linux-musl.gem
0028f5dd0b7a1ee6f1dadf31fc632abf7d815cb0baa0606549634fa45578f92e  sqlite3-2.8.1-x86_64-darwin.gem
878f4a0c5c2c4d9d4345afe2a142a87805f388a24aa8a3c2dfe2f964d7686b7a  sqlite3-2.8.1-x86_64-linux-gnu.gem
0c191ddfd71437b439e107a0d148630bef29a1eebd7b28bcc931470c328f657d  sqlite3-2.8.1-x86_64-linux-musl.gem
acd0ac7912a4d92b2484b5befb6faa8d496497eb1e38bdbe8d7818fb8d05d726  sqlite3-2.8.1.gem

2.8.0

2.8.0 / 2025-11-05

• Vendored sqlite is updated to v3.51.0 (from v3.50.4). #652 @flavorjones

sha256 checksums

3e8b5ed47fed37518eeea54ea9a96542dff0d82ea247490d3bdc6a02d4402503  sqlite3-2.8.0-aarch64-linux-gnu.gem
9db4dfdc5c1582ab2b3d6f98017d39d3c597a50710a0438f4e2ebfba4989ab30  sqlite3-2.8.0-aarch64-linux-musl.gem
f604b44e5d4ca6b6632cad659b4bd4ebe55c38987ad411427993b42c70fd3dec  sqlite3-2.8.0-arm-linux-gnu.gem
80c4de4163fca155434a540c42fffba43bf71974f8c7645ad87d94fe1e8c15b0  sqlite3-2.8.0-arm-linux-musl.gem
841b4e37f7cb993d9bcb3dc58c8827b5df1e29d2030231155eba0ab89766efaf  sqlite3-2.8.0-arm64-darwin.gem
0fd021814689a91037d66cbd693bfcae162081b604c25266d0f18b063d2918c4  sqlite3-2.8.0-x64-mingw-ucrt.gem
8878e371e05d4570203b3c03891db441fef4095c3e30a2fe443c7defd1c5e409  sqlite3-2.8.0-x86-linux-gnu.gem
4846a6e0be10f33634f62315eed318e90952d09f975c9f73762d8ee9443f81be  sqlite3-2.8.0-x86-linux-musl.gem
ae26021cbfc7c9c819e2bad50789ab7732dc29c7c00c043ee4b6073a10b1baa2  sqlite3-2.8.0-x86_64-darwin.gem
b754409b06e447712198d59e37da0dab6fce326115657db034a94b77f67802a3  sqlite3-2.8.0-x86_64-linux-gnu.gem
9ea480326f09abfeb2001cf8d08077feaac2253baaf5ac06aa530377f4a87ddc  sqlite3-2.8.0-x86_64-linux-musl.gem
88b403fb0ec0992907ef00cfc5db8fae53d284b81f6123f20ca0f7ef85c222e1  sqlite3-2.8.0.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)