Log message:
databases/ruby-sqlite3: update to 2.10.2

2.10.0 (2026-10-13)

Dependencies

* Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @flavorjones
* Notable changes in this version include:
    - ALTER TABLE now raises an error when adding, renaming, or dropping a
      column named ROWID, _ROWID_, or OID.
    - The authorizer callback is now invoked for SQL functions in the
      DEFAULT clauses of CREATE TABLE statements.
    - SQLite no longer supports Windows XP or earlier.  On Windows, the
      precompiled gem and any installation that compiles the vendored sqlite
      now require Windows Vista or later.

Added

* ResultSet#each and #each_hash return an Enumerator when called without a
  block. Previously they raised LocalJumpError. #656 @kch
* Introduce Database#serialize, which returns a database as a binary string,
  and Database#deserialize, which replaces a database with the contents of
  such a string.  These wrap sqlite3_serialize() and sqlite3_deserialize().
  Both methods are defined only when SQLite was compiled without
  SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the
  loaded SQLite is v3.54.0 or later.  An image of a database in WAL mode
  cannot be queried after deserializing; see the Database#deserialize
  documentation.  #685 @Maaarcocr

Fixed

* Fix Database#statement_timeout= interrupting statements almost immediately
  instead of after the timeout elapsed, including re-executed prepared
  statements and calls to Database#execute_batch2.  #737 @palkan
  @flavorjones

Improved

* On CRuby, Statement#types allocates fewer strings.  Each declared type is
  downcased and interned in C, instead of allocating two strings per column.
  #743 @jhawthorn

Changed

* ResultSet#each and #each_hash return the result set when called with a
  block.  As a consequence, Database#execute and #execute2 called with a
  block return the closed ResultSet instead of nil.  #656 @kch
* Statement#columns and Statement#types return frozen arrays, and the
  strings in Statement#types are frozen.  Code that mutates them now raises
  FrozenError.  #743 @jhawthorn
* Statement#column_decltype and Statement#types return UTF-8 strings.
  Previously they returned ASCII-8BIT strings.  #743 @jhawthorn

2.10.1 (2026-10-19)

Dependencies

* Vendored sqlite is updated to v3.54.1 (from v3.54.0).  This release
  contains a fix for a possible heap buffer overflow on 32-bit builds,
  including the precompiled x86-linux-gnu and x86-linux-musl gems.  #756
  @flavorjones

Improved

* Database#define_aggregator no longer creates an anonymous class for each
  aggregate function it defines.  Each invocation of the function still runs
  on a clone of the template object.  #752 @jhawthorn

2.10.2 (2026-10-26)

Security / Stability

* Raise RangeError when a SQL string, a bound String or Blob value, or a
  String or Blob returned from a custom function or aggregate is longer than
  INT_MAX bytes.  Previously the length was truncated to 32 bits, so SQLite
  could read only part of the string and drop trailing clauses from a query.
  See GHSA-4fqr-96q8-xrfx for more information.  #762 @flavorjones
* Fix a crash when a custom aggregate's finalize returns a value that can't
  be converted to a SQLite result.  The exception is now raised from the
  query and the connection remains usable.  #762 @flavorjones
* Fix a use-after-free when the hash returned by Database#collations is
  cleared, modified or frozen.  GC could free a comparator that SQLite still
  called.  When that hash is frozen, Database#collation still raises
  FrozenError, but the new comparator stays registered and in use.  #764
  @flavorjones

* Fix a deadlock when a collation comparator, trace block, busy_handler
  block or authorizer raises, or when an interrupt such as Thread#raise
  arrives while an aggregate's handler is being created.  Another thread
  that used the connection blocked forever.  The exception is now raised
  from the query and the connection remains usable.  See "Changed" \ 
below for
  what SQLite does before the exception is raised.  #764 @flavorjones
* Fix a crash when a custom function or aggregate uses throw.  The throw now
  unwinds to its catch.  #764 @flavorjones

Changed

* When a callback raises or throws, SQLite now finishes its current call
  before the exception is raised, instead of being unwound in the middle of
  it.  #764 @flavorjones
    - When a trace block raises, SQLite runs the statement up to its first
      row, or to completion, before the exception is raised.  Previously the
      statement stopped where the block raised.  For example, an INSERT
      whose trace block raises now inserts its row.
    - The other callbacks in that SQLite call skip their Ruby code:
      collation comparators return 0, functions and aggregates report an
      error to SQLite, the busy handler stops retrying and the authorizer
      denies.
    - Database#execute_batch2 now raises the exception from a custom
      function, instead of SQLite3::SQLException "Ruby Exception occurred".
    - An exception from a callback that SQLite runs during Statement#reset!
      or Database#close is discarded.

* The extension keeps per-fiber state in
  Thread.current[:__sqlite3_callback_frames__].  A query raises FrozenError
  on a Thread that was frozen before its first query.  #764 @flavorjones
* When SQLite can't allocate an aggregate's context, the query raises
  SQLite3::MemoryException instead of aborting the process.  #764
  @flavorjones

Improved

* Statement#step no longer allocates and discards an array when the
  statement has no more rows.  This saves one object per statement
  execution.  #758 @thomasklemm
* ObjectSpace.dump and heap profilers now report SQLite3::Database and
  SQLite3::Statement objects under their own type names, instead of
  SQLite3::Backup.  #764 @flavorjones

Documentation

* Document that parameters bound by Statement#execute, #execute!,
  #bind_param and #bind_params stay bound across executions, and that
  Statement#clear_bindings! clears them.  #751 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.6

2.9.6 (2026-08-11)

Security / Stability

* Fix a garbage collection bug where the argument array passed to a custom
  aggregate function's step was not visible to the GC, so arguments could be
  collected mid-conversion when the aggregate takes two or more arguments,
  corrupting the values passed to step or crashing the process.  See
  GHSA-mwm8-39rw-8826 for more information.  #733 @jeremy

Fixed

* Fix a leak where custom aggregate handler instances were never released,
  so a connection accumulated one instance per GROUP BY group per query for
  its lifetime.  #722 @djmb

* Fix GC compaction issues with custom functions, aggregates, collations,
  #trace and #authorizer=.  These callbacks were registered with sqlite by
  passing a raw Ruby object pointer as user data; keeping the object
  reachable prevented collection but not relocation, after which sqlite held
  a stale address and the next call could raise NoMethodError, return a
  wrong result, or segfault.  Affects applications that call GC.compact or
  run with GC.auto_compact = true.  The equivalent issue in #busy_handler
  was fixed in #466.  #723 @djmb

* Fix the private methods Database#open_v2 and #open16 silently replacing a
  live connection and leaking the previous connection handle when invoked
  via send on an open database.  They now raise SQLite3::Exception.  #729
  @flavorjones

* Fix TEXT values containing an embedded NUL byte being truncated at the
  first NUL when passed as arguments to functions created with
  Database#define_function.  #730 @flavorjones

* Fix an exception raised inside a Database#define_function block leaving
  the connection's sqlite mutex held, which deadlocked any other thread that
  later used the connection.  The exception now propagates to the caller and
  the connection remains usable.  #731 @flavorjones

* Database.new now raises ArgumentError when the filename or VFS name
  contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16
  filename), instead of silently opening a path truncated at the NUL.  #732
  @flavorjones

Improved

* When Database.new fails to open the database file, the underlying sqlite3
  connection handle is now closed immediately instead of waiting for the
  garbage collector to clean it up.  #719 @katafrakt

Log message:
databases/ruby-sqlite3: update to 2.9.5

2.9.5 (2026-06-07)

Dependencies

* Vendored sqlite is updated to v3.53.2 (from v3.53.1). #709 @flavorjones

Security / Stability

* Fix use-after-free issue with custom functions, when the same function
  name is used with multiple arities.  See GHSA-28hh-pr2h-2w89 for more
  information.  #710 @flavorjones

* Fix use-after-free issue with aggregate functions, if a statement is used
  after a soft database close.  See GHSA-j7fr-3v8c-3qc3 for more
  information.  #711 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.4

2.9.4 (2026-05-05)

* Vendored sqlite is updated to v3.53.1 (from v3.53.0).  #704 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.3

2.9.3 (2026-04-15)

* Vendored sqlite is updated to v3.53.0 (from v3.51.3). #696 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.2

2.9.2 (2026-03-15)

* Vendored sqlite is updated to v3.51.3 (from v3.51.2). #688 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.1

2.9.1 (2026-02-28)

* Vendored sqlite is updated to v3.51.2 (from v3.51.1). #683 @flavorjones

Log message:
databases/ruby-sqlite3: update to 2.9.0

2.9.0 (2025-12-27)

Ruby

* Introduce native gem packages for Ruby 4.0. @flavorjones
* Drop support for Ruby 3.1. @flavorjones

Added

* Introduce Statement#named_params to introspect on a parameterized SQL
  statement. #627 #642 @captn3m0

Improved

* Small improvements to docstrings and comments. @flavorjones @houyuanjie

New Contributors

* @captn3m0 made their first contribution in #642
* @houyuanjie made their first contribution in #671