Update dependency sqlite3 to v2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sqlite3	"~> 1.4" → "~> 2.9", ">= 2.9.5"

---

SQLite3 addresses vulnerability in packaged version of libsqlite

GHSA-mgvv-5mxp-xq67

More information

Details

Summary

The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to v3.39.4.

libsqlite v3.39.4 addresses a vulnerability described as follows in the release notification:

Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the
prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so
this should be considered a security update.

In order to exploit the vulnerability, an attacker must have full SQL access and must be able to
construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit
signed integer overflow.

This vulnerability has not been assigned a CVE and does not have a severity declared.

Please note that this advisory only applies to the sqlite3 gem v1.5.0, and only if the packaged libsqlite is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libsqlite release announcements.

Mitigation

Upgrade to the rubygem sqlite3 v1.5.1 or later.

Users who are unable to upgrade the sqlite3 gem may also choose a more complicated mitigation: compile and link sqlite3 against external libsqlite >= 3.39.4 which will also address these same issues.

References

• Upstream release notes: https://sqlite.org/releaselog/3_39_4.html
• Instructions for compiling against system libraries: https://github.com/sparklemotion/sqlite3-ruby

Severity

Low

References

• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mgvv-5mxp-xq67
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v1.5.1
• https://github.com/advisories/GHSA-mgvv-5mxp-xq67

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

CVE-2026-54619 / GHSA-28hh-pr2h-2w89

More information

Details

Summary

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89
• https://github.com/sparklemotion/sqlite3-ruby/pull/710
• https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54619.yml
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
• https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619
• https://github.com/advisories/GHSA-28hh-pr2h-2w89

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

Fetching gem metadata from https://rubygems.org/..........
Resolving dependencies......

Bundler found conflicting requirements for the Ruby� version:
  In Gemfile:
    Ruby� (~> 3.1.0.0)

    sqlite3 (~> 2.9, >= 2.9.5) was resolved to 2.9.6, which depends on
      Ruby� (>= 3.2)