Update sqlite3 2.9.5 → 2.9.6 (patch)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ sqlite3 (2.9.5 → 2.9.6) · Repo · Changelog

Release Notes

2.9.6

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @katafrakt

sha256 checksums

d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

• version bump to v2.9.6
• Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39rw-8826) (#733)
• Reject database filenames and VFS names containing NUL (#732)
• Raise when open_v2 or open16 is called on an open database (#729)
• Stop a raise inside a UDF block from deadlocking other threads (#731)
• Pass TEXT values containing embedded NULs to UDFs intact (#730)
• doc: update CHANGELOG.md
• Release aggregate instances when sqlite finishes with them (#722)
• Stop sqlite calling into moved Ruby objects (#723)
• build(deps-dev): update rubocop-minitest requirement (#727)
• Merge pull request #728 from sparklemotion/dependabot/github_actions/actions-332b23de0e
• build(deps): bump vmactions/freebsd-vm in the actions group
• Merge pull request #725 from sparklemotion/memory-stress
• dep(style): bump standard, fix style offenses (#726)
• ping to queue CI
• test: introduce helpers for compaction
• Add a development docker image that contains valgrind
• Add SQLITE3_TEST_GC_LEVEL to the test suite
• build(deps): bump the actions group with 3 updates (#721)
• build(deps): bump the actions group with 2 updates (#720)
• Merge pull request #719 from katafrakt/close-after-failed-open
• test: Make sure the close-db-on-failure branch has coverage
• Close connection after fialed open
• build(deps): bump the actions group with 2 updates (#718)
• build(deps): bump the actions group with 3 updates (#717)
• build(deps-dev): update rdoc requirement from 7.2.0 to 8.0.0 (#716)
• build(deps): bump the actions group with 2 updates (#715)
• build(deps): bump the actions group with 2 updates (#712)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)