Repository navigation
Bump the upper bound on libsqlite3-sys to allow 0.39.x - #4502
Merged
Merged
Conversation
3 tasks done
This was referenced Nov 9, 2026
This was referenced Nov 9, 2026
ShixiangWang
added a commit
to Traitome/oxo-flow
that referenced
this pull request
Nov 9, 2026
…se (#1073) libsqlite3-sys 0.30.1 (via sqlx 0.9.0, sqlite feature) bundles SQLite < 3.54.0, which can return uninitialized page-cache memory when a DB whose sibling -wal file has a different page size is opened (CVE-2026-119375, CVSS 6.8, LOCAL attack vector). oxo-flow only opens the sqlite database file it creates itself. The patched libsqlite3-sys 0.39.x is outside sqlx-sqlite 0.9.0's declared range (<0.38.0); the upstream bound raise (transact-rs/sqlx#4502) merged 2026-11-08 but has no release yet. Ignored in both gates (.cargo/audit.toml + deny.toml) with written justification; remove as soon as a sqlx release carries the fix — dependabot's monthly cargo group will surface it.
fieldmouseworks-steward Bot
pushed a commit
to FieldmouseWorks/consolebook
that referenced
this pull request
Nov 9, 2026
The bundled SQLite before 3.54 can return uninitialized memory for a crafted database and -wal pair, and restores open files from backup-copy directories. sqlx 0.9.0 caps libsqlite3-sys below 0.38, so the sqlx crates come from the upstream commit that lifts the cap (transact-rs/sqlx#4502) until a release has it, and libsqlite3-sys is locked at 0.39.1 (SQLite 3.54.1). Refs #196 Co-authored-by: Peter Permenter <41281403+TusanHomichi@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
remiminnebo
added a commit
to theflock-labs/flock-code
that referenced
this pull request
Nov 9, 2026
RUSTSEC-2026-0459 (CVE-2026-119375) was published while 0.8.1's CI ran: SQLite before 3.54 can return uninitialized page-cache memory for a crafted database and -wal pair. The fix is libsqlite3-sys 0.39, which the released sqlx-sqlite 0.9.0 caps at <0.38; upstream merged the relaxed bound on 2026-11-08 (transact-rs/sqlx#4502) but has not released it. The release gate does not waive vulnerabilities in the shipped graph, so sqlx-sqlite 0.9.0 is vendored, byte-identical except that bound, and patched in until a sqlx release allows 0.39 (FLOCK_PATCH.md says how to remove it). cargo test --workspace --locked and scripts/audit-dependencies.py pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
philbert440
added a commit
to Rivethub/rivethub-runtime
that referenced
this pull request
Nov 9, 2026
sqlx 0.9.0 requires libsqlite3-sys <0.39, which blocks the rusqlite 0.41 upgrade that RUSTSEC-2026-0459 needs. Upstream commit 10462fa441 raises the cap to <0.40 but is not released yet. Patch every sqlx crate to that commit and allow the sqlx git source in cargo-deny. Remove the patch and the allow-git entry on the first sqlx 0.9.x release that contains #4502.
alinejun
added a commit
to Actrium/actrium
that referenced
this pull request
Nov 9, 2026
Dependency Audit is blocked by [RUSTSEC-2026-0459](https://github.com/RustSec/advisory-db/blob/main/crates/libsqlite3-sys/RUSTSEC-2026-0459.md) in bundled SQLite. The workspace and four downstream lockfiles now resolve one `libsqlite3-sys 0.39.1`, bundling SQLite **3.54.1**. ## Changes - Upgrade rusqlite to **0.41.1** and consolidate CLI/sync dependencies on the workspace declaration, preserving statement caching and checked unsigned integer conversions. - Use SQLx **0.9.0** pinned to official upstream commit `10462fa4414c6c7f1ed1d39bb31678e3b726878c` ([SQLx #4502](transact-rs/sqlx#4502)). The published release excludes the patched SQLite version; replace this pin once a release includes the fix. - Adapt SQLx query-safety APIs with static SQL, bound fixture values, and integer-only PRAGMA builders. Update Tokio/Rustls feature declarations and all five affected lockfiles. Related CI blockers: #404, #406. ## Validation - `cargo audit --json`: **0 vulnerabilities** under the existing repository policy; four existing warnings remain and the audit exceptions are unchanged. - `cargo fmt`, `cargo fmt --all --check`, language policy, and `git diff --check`: passed. - `cargo clippy --fix --lib --bins --all-targets --allow-dirty --locked` for loran-signer, loran-platform, loran-issuer, loran-publisher-registry, and loran-server: passed. - Signer Clippy with `--all-features`: passed, including PostgreSQL backend compilation. - Locked Cargo metadata resolves for all five workspaces. | Executed tests | Passed | | --- | ---: | | Mailbox, sync, admin, issuer, platform, publisher registry, signer library suites | 327 | | Native platform | 14 | | Hyper storage, including reopen persistence | 8 | | Issuer Realm Profile integration | 16 | | Fullstack registration/discovery and unregister durability across restart | 2 | | **Total** | **367** | One existing admin library test remains ignored.
huweiATgithub
added a commit
to huweiATgithub/codex-proxy-rs
that referenced
this pull request
Nov 9, 2026
Purpose and non-goals - Unblock v3.44.0 publication without suppressing RUSTSEC-2026-0459. Cargo audit checks the whole lockfile, including the optional SQLite driver; libsqlite3-sys 0.37.0 is affected and the advisory requires >=0.39.0. The gateway continues using PostgreSQL with SQLite features disabled. - Update only the SQLx source pin and its lockfile entries plus libsqlite3-sys 0.39.1. Keep application behavior, migrations, schema, release metadata and the existing five patch topics unchanged. Ownership and contracts - SQLx owns driver, pool, transaction and migration behavior. The pinned revision 10462fa4414c6c7f1ed1d39bb31678e3b726878c permits libsqlite3-sys 0.39.x and descends from f1e94ec34dd5f11ad6488a3a8ac7988439a3f757, preserving the BEGIN cancellation/rollback fix from transact-rs/sqlx#4394. - Preserve cancellation cleanup, query-budget resource lifetimes, saved observations and frozen migration ledgers on fresh and existing fork databases. No migration checksums or audit exceptions may be rewritten. Contracts: docs/architecture.md (observations/background tasks), backend/migrations/README.md and cpr-fork-patch/references/sql.md. Provenance and replay - Use the same focused dependency repair as upstream application commit 092789f, without merging main's unrelated unreleased changes. SQLx compatibility change: transact-rs/sqlx#4502. - On upgrade, keep upstream's safe dependency versions when they already retain the transaction fix and resolve this advisory; then retire this topic. Never downgrade its SQLx pin or restore the vulnerable lock entry. A new driver pin also requires real database lifecycle validation. Verification - Strict workspace Clippy passed with all targets/features and -D warnings. - Real PostgreSQL tests cover transaction BEGIN cancellation, query-budget rollback/cleanup, saved account insights and usage observation projections. - Fresh and v3.42.1 fork databases preserve ledgers and saved records across target initialization/restart, including independent client/upstream status values and missing values. Migrations and upstream release metadata have no diff. The package set is unchanged apart from libsqlite3-sys's version. - Branch Security and the Release quality gates must pass before publication; no audit rule or workflow gate is disabled by this change. Co-authored-by: Codex <noreply@openai.com>
8 of 10 tasks
4 tasks
jmagar
added a commit
to dinglebear-ai/labby
that referenced
this pull request
Nov 11, 2026
cargo-deny fails the advisories gate on main because libsqlite3-sys 0.37.0 bundles SQLite 3.53.2 or earlier, which CVE-2026-119375 reports. The `bundled` feature is enabled on our own workspace rusqlite dependency, so the vulnerable SQLite really is compiled into the binary. libsqlite3-sys ships patched SQLite from 0.39.0, reachable through rusqlite 0.41. A lockfile-only update cannot get there: rusqlite 0.39 pins libsqlite3-sys ^0.37.0, and once rusqlite is bumped, sqlx-sqlite 0.9.0 caps libsqlite3-sys below 0.38.0 while libsqlite3-sys declares links = "sqlite3", so the two versions cannot coexist in one graph. transact-rs/sqlx#4502 raises that ceiling to allow 0.39.x but is unreleased, and sqlx main still carries workspace version 0.9.0, so its internal `=0.9.0` pins stay satisfiable under a patch. Pin the sqlx crates to that exact commit and bump rusqlite to 0.41 so libsqlite3-sys resolves to 0.39.1 (SQLite 3.54.1). deny.toml gains the matching exact-source allowance, following the existing rev-pinned-source convention. Remove the patch, the allow-git entry, and this exception as soon as sqlx publishes a release carrying #4502. Verified: `cargo deny --all-features check advisories sources bans` goes from `advisories FAILED` to `advisories ok, bans ok, sources ok`, and `cargo check -p labby --all-features --locked` succeeds. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
greatheart1000
added a commit
to greatheart1000/ckb
that referenced
this pull request
Nov 11, 2026
sqlx 0.9.0 constrains libsqlite3-sys to < 0.38.0, so the patched libsqlite3-sys 0.39.x cannot be adopted yet. The upstream fix is merged (transact-rs/sqlx#4502) and will be released in sqlx 0.9.1 (transact-rs/sqlx#4517). CKB only opens the local rich-indexer SQLite database that the node creates itself; it never opens a database/WAL pair supplied by an untrusted party, so the advisory's attack path is not reachable. Add matching ignores to deny.toml (cargo-deny) and .cargo/audit.toml (the scheduled cargo-audit workflow). Remove both once sqlx >= 0.9.1 is adopted. Co-Authored-By: Claude Code <noreply@anthropic.com>
12 of 13 tasks
nizovtsevnv
added a commit
to termide/termide
that referenced
this pull request
Nov 11, 2026
RUSTSEC-2026-0459 (SQLite before 3.54) reaches the database panel through sqlx-sqlite's libsqlite3-sys 0.30. The patched 0.39 is allowed by no sqlx release yet; transact-rs/sqlx#4502 lifts the cap on main. The entry says what is exposed and goes with that release.
7 tasks done
thewoolleyman
added a commit
to thewoolleyman/fabro
that referenced
this pull request
Nov 12, 2026
…TSEC-2026-0459 (bd-ib-tcdmkr) Bundled SQLite before 3.54.0 can return uninitialized page-cache memory when a database is opened with a -wal file of a mismatched page size (RUSTSEC-2026-0459, CVE-2026-119375). libsqlite3-sys 0.39.0 is the first release that bundles the fixed SQLite. The workspace reaches libsqlite3-sys only through sqlx 0.9 with the sqlite-bundled feature. sqlx-sqlite 0.9.0 bounds libsqlite3-sys below 0.38. transact-rs/sqlx#4502 lifts that bound to <0.40. It merged on 2026-11-08 as 10462fa4414c6c7f1ed1d39bb31678e3b726878c, but no sqlx release carries it yet: crates.io's newest is 0.9.0, and the PR sits 49 commits past tag v0.9.0. So [patch.crates-io] points the seven sqlx crates at that sqlx main commit, which still versions itself 0.9.0. Replace the git patch with the first crates.io sqlx release that contains #4502. Lock effect: libsqlite3-sys 0.37.0 -> 0.39.1, the seven sqlx crates move from crates.io to the git rev, objc2-system-configuration 0.3.2 is added, and whoami 2.1.2 -> 2.1.1. No petri-* entry changes. `cargo deny check advisories` no longer reports RUSTSEC-2026-0459, and no ignore entry exists for it. Coordinator ruling (2026-11-09; route confirmed and approved 2026-11-12): bundle this into the next carrier roll with no advisory ignore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Nov 12, 2026
3 of 6 tasks
11 tasks done
This was referenced Nov 14, 2026
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This allows building sqlx and current rusqlite together.
Is this a breaking change?
No; sqlx policy allows bumping the libsqlite3-sys upper bound.