Update dependency sqlite3 to v2.9.5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sqlite3	2.1.0 → 2.9.5

---

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

CVE-2026-54620 / GHSA-j7fr-3v8c-3qc3

More information

Details

Summary

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid using an aggregate function after closing the database.

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-j7fr-3v8c-3qc3
• https://github.com/sparklemotion/sqlite3-ruby/pull/711
• https://github.com/sparklemotion/sqlite3-ruby/commit/b24e1e6076528b7f95f99acf7a81c70d0004c726
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54620.yml
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
• https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54620
• https://github.com/advisories/GHSA-j7fr-3v8c-3qc3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

CVE-2026-54619 / GHSA-28hh-pr2h-2w89

More information

Details

Summary

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Mitigation

Upgrade to sqlite3 gem v2.9.5 or later.

As a workaround, avoid defining multiple custom functions with the same name (varying numbers of arguments or encoding).

Severity

The sqlite3-ruby maintainers assess this as Low severity. It is reliably triggered after GC when code is structured in a particular way. There is no known general exploit that could be used as a denial of service attack.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89
• https://github.com/sparklemotion/sqlite3-ruby/pull/710
• https://github.com/sparklemotion/sqlite3-ruby/commit/2bd436d17f77cdd4c31b00fe9d50b0d21cbaf033
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sqlite3/CVE-2026-54619.yml
• https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
• https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619
• https://github.com/advisories/GHSA-28hh-pr2h-2w89

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.