Skip to content

[v22.x] deps: update sqlite to 3.53.4 - #66246

Merged
aduh95 merged 6 commits into
nodejs:v22.x-stagingfrom
RafaelGSS:fix/v22-sqlite-3.53.4
Oct 18, 2026
Merged

[v22.x] deps: update sqlite to 3.53.4#66246
aduh95 merged 6 commits into
nodejs:v22.x-stagingfrom
RafaelGSS:fix/v22-sqlite-3.53.4

Conversation

@RafaelGSS

@RafaelGSS RafaelGSS commented Sep 23, 2026

Copy link
Copy Markdown
Member

Update the SQLite amalgamation from 3.51.3 to 3.53.4, matching the version already used on main. This includes the upstream FTS5 bounds checks for CVE-2026-11822 and CVE-2026-11824.

@RafaelGSS RafaelGSS added the v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch. label Sep 23, 2026
@nodejs-github-bot

nodejs-github-bot commented Sep 23, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/security-wg
  • @nodejs/sqlite

@nodejs-github-bot nodejs-github-bot added dependencies PRs that add, update, or configure Node.js dependencies. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. labels Sep 23, 2026
@richardlau

richardlau commented Sep 23, 2026

Copy link
Copy Markdown
Member

@RafaelGSS Were we not able to cherry-pick the individual update sqlite commits from main/later staging branches?

@RafaelGSS

RafaelGSS commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Yes, the six commits cherry-pick cleanly onto v22.x. I'll rework this PR to preserve the original commits.

@RafaelGSS
RafaelGSS force-pushed the fix/v22-sqlite-3.53.4 branch from 1797741 to 077d788 Compare September 23, 2026 17:16
@RafaelGSS

RafaelGSS commented Sep 23, 2026

Copy link
Copy Markdown
Member Author

I'm just opening it manually instead of relying on branch-diff + cherry-pick so we can tag it on nodejs-dep-vuln-assessment.

This was referenced Sep 23, 2026
Open
Open
@trivikr trivikr added the author ready PRs with CI started, the required approvals, and no outstanding review comments. label Sep 25, 2026
araujogui
araujogui approved these changes Oct 2, 2026
View reviewed changes

@araujogui araujogui left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread test/parallel/test-sqlite-session.js
@aduh95 aduh95 added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Oct 16, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Oct 16, 2026
@nodejs-github-bot

nodejs-github-bot commented Oct 16, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/78446/

gurgunday
gurgunday approved these changes Oct 16, 2026
View reviewed changes

@gurgunday gurgunday left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

nodejs-github-bot and others added 6 commits October 18, 2026 19:37
@nodejs-github-bot @aduh95
deps: update sqlite to 3.53.0
e708247 
PR-URL: nodejs#62699
Backport-PR-URL: nodejs#66246
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@nodejs-github-bot @aduh95
deps: update sqlite to 3.53.1
512a9b6 
PR-URL: nodejs#63217
Backport-PR-URL: nodejs#66246
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@junius-sec @aduh95
deps: cherry-pick e807d4e379 from SQLite
e9e295b 
Backport the SQLite session extension fix for corrupt changesets that
omit old values for primary-key columns. This avoids passing NULL to
sessionBindValue() while applying UPDATE changesets.

Refs: https://sqlite.org/src/info/e807d4e3798efd53
Signed-off-by: junius-sec <sksch323@naver.com>
PR-URL: nodejs#63525
Backport-PR-URL: nodejs#66246
Refs: https://hackerone.com/reports/3736889
Refs: sqlite/sqlite@b869ed6
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@nodejs-github-bot @aduh95
deps: update sqlite to 3.53.2
a8349b6 
PR-URL: nodejs#63774
Backport-PR-URL: nodejs#66246
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@nodejs-github-bot @aduh95
deps: update sqlite to 3.53.3
98258b8 
PR-URL: nodejs#64180
Backport-PR-URL: nodejs#66246
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@nodejs-github-bot @aduh95
deps: update sqlite to 3.53.4
47333fe 
PR-URL: nodejs#64745
Backport-PR-URL: nodejs#66246
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Guilherme Araújo <arauujogui@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
@aduh95
aduh95 force-pushed the fix/v22-sqlite-3.53.4 branch from 077d788 to 47333fe Compare October 18, 2026 17:38
@aduh95
aduh95 changed the base branch from v22.x to v22.x-staging October 18, 2026 17:39
@aduh95

aduh95 commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Landed in 857be5a...47333fe

@aduh95
aduh95 merged commit 47333fe into nodejs:v22.x-staging Oct 18, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aduh95 aduh95 aduh95 left review comments
@UlisesGascon UlisesGascon UlisesGascon approved these changes
@richardlau richardlau richardlau approved these changes
@meixg meixg meixg approved these changes
@trivikr trivikr trivikr approved these changes
@araujogui araujogui araujogui approved these changes
@gurgunday gurgunday gurgunday approved these changes

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. dependencies PRs that add, update, or configure Node.js dependencies. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. v22.x Issues that can be reproduced on v22.x or PRs targeting the v22.x-staging branch.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@RafaelGSS @nodejs-github-bot @richardlau @aduh95 @UlisesGascon @meixg @trivikr @araujogui @gurgunday @junius-sec