Security update for sqlite3
This update for sqlite3 fixes the following issues:
- Update to release 3.49.1:
- Improve portability of makefiles and configure scripts.
- CVE-2025-29087, bsc#1241020: Fix a bug in the concat_ws()
function, introduced in version 3.44.0, that could lead to a
memory error if the separator string is very large (hundreds
of megabytes).
- CVE-2025-29088, bsc#1241078: Enhanced the
SQLITE_DBCONFIG_LOOKASIDE interface to make it more robust
against misuse.
- Update to release 3.49.0:
- Enhancements to the query planner:
- Improve the query-time index optimization so that it works on
WITHOUT ROWID tables.
- Better query plans for large star-query joins. This fixes
three different performance regressions that were reported
on the SQLite Forum.
- When two or more queries have the same estimated cost, use
the one with the fewer bytes per row.
- Enhance the iif() SQL function so that it can accept any number
of arguments greater than or equal to two.
- Enhance the session extension so that it works on databases
that make use of generated columns.
- Omit the SQLITE_USE_STDIO_FOR_CONSOLE compile-time option which
was not implemented correctly and never worked right. In its place
add the SQLITE_USE_W32_FOR_CONSOLE_IO compile-time option. This
option applies to command-line tools like the CLI only, not to the
SQLite core. It causes Win32 APIs to be used for console I/O
instead of stdio. This option affects Windows builds only.
- Three new options to sqlite3_db_config(). All default "on".
SQLITE_DBCONFIG_ENABLE_ATTACH_CREATE
SQLITE_DBCONFIG_ENABLE_ATTACH_WRITE
SQLITE_DBCONFIG_ENABLE_COMMENTS
- Re-enable SONAME which got disabled by default in 3.48.0.
- https://www.sqlite.org/src/forumpost/5a3b44f510df8ded
- https://sqlite.org/forum/forumpost/ab8f15697a
- Update to release 3.48.0:
- Improved EXPLAIN QUERY PLAN output for covering indexes.
- Allow a two-argument version of the iif() SQL function.
- Also allow if() as an alternative spelling for iif().
- Add the ".dbtotxt" command to the CLI.
- Add the SQLITE_IOCAP_SUBPAGE_READ property to the
xDeviceCharacteristics method of the sqlite3_io_methods object.
- Add the SQLITE_PREPARE_DONT_LOG option to sqlite3_prepare_v3()
that prevents warning messages being sent to the error log if
the SQL is ill-formed. This allows sqlite3_prepare_v3() to be
used to do test compiles of SQL to check for validity without
polluting the error log with false messages.
- Increase the minimum allowed value of SQLITE_LIMIT_LENGTH from
1 to 30.
- Added the SQLITE_FCNTL_NULL_IO file control.
- Extend the FTS5 auxiliary API xInstToken() to work with prefix
queries via the insttoken configuration option and the
fts5_insttoken() SQL function.
- Increase the maximum number of arguments to an SQL function
from 127 to 1000.
- Update to release 3.47.2:
- Fix a problem in text-to-floating-point conversion that affects
text values where the first 16 significant digits are
'1844674407370955'. This issue was introduced in 3.47.0 and
only arises on x64 and i386 hardware.
- Other minor bug fixes.
- Enable the session extension, because NodeJS 22 needs it.
- Update to release 3.47.1:
- Fix the makefiles so that they once again honored DESTDIR for
the "install" target.
- Add the SQLITE_IOCAP_SUBPAGE_READ capability to the VFS, to
work around issues on some non-standard VFSes caused by making
SQLITE_DIRECT_OVERFLOW_READ the default in version 3.45.0.
- Fix incorrect answers to certain obscure IN queries caused by
new query optimizations added in the 3.47.0 release.
- Other minor bug fixes.
- Update to release 3.47.0:
- Allow arbitrary expressions in the second argument to the RAISE
function.
- If the RHS of the ->> operator is negative, then access array
elements counting from the right.
- Fix a problem with rolling back hot journal files in the
seldom-used unix-dotfile VFS.
- FTS5 tables can now be dropped even if they use a non-standard
tokenizer that has not been registered.
- Fix the group_concat() aggregate function so that it returns an
empty string, not a NULL, if it receives a single input value
which is an empty string.
- Enhance the generate_series() table-valued function so that it
is able to recognize and use constraints on its output value.
Preupdate hooks now recognize when a column added by ALTER
TABLE ADD COLUMN has a non-null default value.
- Improved reuse of subqueries associated with the IN operator,
especially when the IN operator has been duplicated due to
predicate push-down.
- Use a Bloom filter on subqueries on the right-hand side of the
IN operator, in cases where that seems likely to improve
performance.
- Ensure that queries like "SELECT func(a) FROM tab GROUP BY 1"
