Changelog for sqlite3-devel-3.44.0-3.25.29.x86_64.rpm :

* Mon Nov 20 2023 Reinhard Max - Sync version 3.44.0 from Factory
* Fixes bsc#1210660, CVE-2023-2137: Heap buffer overflow
* sqlite3-rtree-i686.patch: temporary build fix for 32-bit x86.
* Obsoletes sqlite-CVE-2022-46908.patch
* Obsoletes sqlite-src-3390000-func7-pg-181.patch
* Tue Dec 13 2022 Reinhard Max - bsc#1206337, CVE-2022-46908, sqlite-CVE-2022-46908.patch: relying on --safe for execution of an untrusted CLI script
* Mon Sep 05 2022 Reinhard Max - update to 3.39.3:
* Use a statement journal on DML statement affecting two or more database rows if the statement makes use of a SQL functions that might abort.
* Use a mutex to protect the PRAGMA temp_store_directory and PRAGMA data_store_directory statements, even though they are decremented and documented as not being threadsafe.
* Thu Jul 21 2022 Reinhard Max - update to 3.39.2:
* Fix a performance regression in the query planner associated with rearranging the order of FROM clause terms in the presences of a LEFT JOIN.
* Apply fixes for CVE-2022-35737, Chromium bugs 1343348 and 1345947, forum post 3607259d3c, and other minor problems discovered by internal testing. [boo#1201783]
* Fri Jul 15 2022 Andreas Stieger - update to 3.39.1:
* Fix an incorrect result from a query that uses a view that contains a compound SELECT in which only one arm contains a RIGHT JOIN and where the view is not the first FROM clause term of the query that contains the view
* Fix a long-standing problem with ALTER TABLE RENAME that can only arise if the sqlite3_limit(SQLITE_LIMIT_SQL_LENGTH) is set to a very small value.
* Fix a long-standing problem in FTS3 that can only arise when compiled with the SQLITE_ENABLE_FTS3_PARENTHESIS compile-time option.
* Fix the initial-prefix optimization for the REGEXP extension so that it works correctly even if the prefix contains characters that require a 3-byte UTF8 encoding.
* Enhance the sqlite_stmt virtual table so that it buffers all of its output.
* Fri Jul 01 2022 Andreas Stieger - update to 3.39.0:
* Add (long overdue) support for RIGHT and FULL OUTER JOIN
* Add new binary comparison operators IS NOT DISTINCT FROM and IS DISTINCT FROM that are equivalent to IS and IS NOT, respective, for compatibility with PostgreSQL and SQL standards
* Add a new return code (value \"3\") from the sqlite3_vtab_distinct() interface that indicates a query that has both DISTINCT and ORDER BY clauses
* Added the sqlite3_db_name() interface
* The unix os interface resolves all symbolic links in database filenames to create a canonical name for the database before the file is opened
* Defer materializing views until the materialization is actually needed, thus avoiding unnecessary work if the materialization turns out to never be used
* The HAVING clause of a SELECT statement is now allowed on any aggregate query, even queries that do not have a GROUP BY clause
* Many microoptimizations collectively reduce CPU cycles by about 2.3%.- drop sqlite-src-3380100-atof1.patch, included upstream- add sqlite-src-3390000-func7-pg-181.patch to skip float precision related test failures on 32 bit
* Sun May 08 2022 Andreas Stieger - update to 3.38.5:
* Fix a blunder in the CLI of the 3.38.4 release- includes changes from 3.38.4:
* fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key
* Thu Apr 28 2022 Paolo Stivanin - update to 3.38.3:
* Fix a case of the query planner be overly aggressive with optimizing automatic-index and Bloom-filter construction, using inappropriate ON clause terms to restrict the size of the automatic-index or Bloom filter, and resulting in missing rows in the output.
* Other minor patches. See the timeline for details.
* Tue Mar 29 2022 Reinhard Max - update to 3.38.2:
* Fix a problem with the Bloom filter optimization that might cause an incorrect answer when doing a LEFT JOIN with a WHERE clause constraint that says that one of the columns on the right table of the LEFT JOIN is NULL.
* Other minor patches.
* Wed Mar 16 2022 Reinhard Max - Remove obsolete configure flags- Package the Tcl bindings here again so that we only ship one copy of SQLite (bsc#1195773).
* Sun Mar 13 2022 Andreas Stieger - update to 3.38.1:
* Fix problems with the new Bloom filter optimization that might cause some obscure queries to get an incorrect answer.
* Fix the localtime modifier of the date and time functions so that it preserves fractional seconds.
* Fix the sqlite_offset SQL function so that it works correctly even in corner cases such as when the argument is a virtual column or the column of a view.
* Fix row value IN operator constraints on virtual tables so that they work correctly even if the virtual table implementation relies on bytecode to filter rows that do not satisfy the constraint.
* Other minor fixes to assert() statements, test cases, and documentation. See the source code timeline for details.- add upstream patch to run atof1 tests only on x86_64 sqlite-src-3380100-atof1.patch
* Sat Feb 26 2022 Andreas Stieger - update to 3.38.0
* Add the -> and ->> operators for easier processing of JSON
* The JSON functions are now built-ins
* Enhancements to date and time functions
* Rename the printf() SQL function to format() for better compatibility, with alias for backwards compatibility.
* Add the sqlite3_error_offset() interface for helping localize an SQL error to a specific character in the input SQL text
* Enhance the interface to virtual tables
* CLI columnar output modes are enhanced to correctly handle tabs and newlines embedded in text, and add options like \"--wrap N\", \"--wordwrap on\", and \"--quote\" to the columnar output modes.
* Query planner enhancements using a Bloom filter to speed up large analytic queries, and a balanced merge tree to evaluate UNION or UNION ALL compound SELECT statements that have an ORDER BY clause.
* The ALTER TABLE statement is changed to silently ignores entries in the sqlite_schema table that do not parse when PRAGMA writable_schema=ON
* Wed Jan 12 2022 Andreas Stieger - update to 3.37.2:
* Fix a bug introduced in version 3.35.0 (2021-03-12) that can cause database corruption if a SAVEPOINT is rolled back while in PRAGMA temp_store=MEMORY mode, and other changes are made, and then the outer transaction commits
* Fix a long-standing problem with ON DELETE CASCADE and ON UPDATE CASCADE in which a cache of the bytecode used to implement the cascading change was not being reset following a local DDL change
* Sun Jan 02 2022 Andreas Stieger - update to 3.37.1:
* Fix a bug introduced by the UPSERT enhancements of version 3.35.0 that can cause incorrect byte-code to be generated for some obscure but valid SQL, possibly resulting in a NULL- pointer dereference.
* Fix an OOB read that can occur in FTS5 when reading corrupt database files.
* Improved robustness of the --safe option in the CLI.
* Other minor fixes to assert() statements and test cases.
* Tue Nov 30 2021 Reinhard Max - SQLite3 3.37.0:
* STRICT tables provide a prescriptive style of data type management, for developers who prefer that kind of thing.
* When adding columns that contain a CHECK constraint or a generated column containing a NOT NULL constraint, the ALTER TABLE ADD COLUMN now checks new constraints against preexisting rows in the database and will only proceed if no constraints are violated.
* Added the PRAGMA table_list statement.
* Add the .connection command, allowing the CLI to keep multiple database connections open at the same time.
* Add the --safe command-line option that disables dot-commands and SQL statements that might cause side-effects that extend beyond the single database file named on the command-line.
* CLI: Performance improvements when reading SQL statements that span many lines.
* Added the sqlite3_autovacuum_pages() interface.
* The sqlite3_deserialize() does not and has never worked for the TEMP database. That limitation is now noted in the documentation.
* The query planner now omits ORDER BY clauses on subqueries and views if removing those clauses does not change the semantics of the query.
* The generate_series table-valued function extension is modified so that the first parameter (\"START\") is now required. This is done as a way to demonstrate how to write table-valued functions with required parameters. The legacy behavior is available using the -DZERO_ARGUMENT_GENERATE_SERIES compile-time option.
* Added new sqlite3_changes64() and sqlite3_total_changes64() interfaces.
* Added the SQLITE_OPEN_EXRESCODE flag option to sqlite3_open_v2().
* Use less memory to hold the database schema.
* bsc#1189802, CVE-2021-36690: Fix an issue with the SQLite Expert extension when a column has no collating sequence.
* Wed Jun 30 2021 Reinhard Max - Sync version 3.36.0 from Factory to implement jsc#SLE-16032.- Obsoletes sqlite3-CVE-2019-16168.patch.- The following CVEs have been fixed in upstream releases up to this point, but were not mentioned in the change log so far:
* bsc#1173641, CVE-2020-15358: heap-based buffer overflow in multiSelectOrderBy due to mishandling of query-flattener optimization
* bsc#1164719, CVE-2020-9327: NULL pointer dereference and segmentation fault because of generated column optimizations in isAuxiliaryVtabOperator
* bsc#1160439, CVE-2019-20218: selectExpander in select.c proceeds with WITH stack unwinding even after a parsing error
* bsc#1160438, CVE-2019-19959: memory-management error via ext/misc/zipfile.c involving embedded \'\\0\' input
* bsc#1160309, CVE-2019-19923: improper handling of certain uses of SELECT DISTINCT in flattenSubquery may lead to null pointer dereference
* bsc#1159850, CVE-2019-19924: improper error handling in sqlite3WindowRewrite()
* bsc#1159847, CVE-2019-19925: improper handling of NULL pathname during an update of a ZIP archive
* bsc#1159715, CVE-2019-19926: improper handling of certain errors during parsing multiSelect in select.c
* bsc#1159491, CVE-2019-19880: exprListAppendList in window.c allows attackers to trigger an invalid pointer dereference
* bsc#1158960, CVE-2019-19603: during handling of CREATE TABLE and CREATE VIEW statements, does not consider confusion with a shadow table name
* bsc#1158959, CVE-2019-19646: pragma.c mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns
* bsc#1158958, CVE-2019-19645: alter.c allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements
* bsc#1158812, CVE-2019-19317: lookupName in resolve.c omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service
* bsc#1157818, CVE-2019-19244: sqlite3,sqlite2,sqlite: The function sqlite3Select in select.c allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage
* bsc#928701, CVE-2015-3415: sqlite3VdbeExec comparison operator vulnerability
* bsc#928700, CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names
* CVE-2020-13434 boo#1172115: integer overflow in sqlite3_str_vappendf
* CVE-2020-13630 boo#1172234: use-after-free in fts3EvalNextRow
* CVE-2020-13631 boo#1172236: virtual table allowed to be renamed to one of its shadow tables
* CVE-2020-13632 boo#1172240: NULL pointer dereference via crafted matchinfo() query
* CVE-2020-13435: Malicious SQL statements could have crashed the process that is running SQLite (boo#1172091)