Skip to content

build(deps): bump rusqlite from 0.31.0 to 0.41.0 - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rusqlite-0.40.2
Open

build(deps): bump rusqlite from 0.31.0 to 0.41.0#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rusqlite-0.40.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps rusqlite from 0.31.0 to 0.41.0.

Release notes

Sourced from rusqlite's releases.

0.41.0

What's Changed

  • Check PRAGMA is valid with the help of pragma_list #1857
  • Fix UtcDateTime #1859
  • Bump sqlite3-parser version #1864
  • Edition 2024 #1863
  • Use u64 for zeroblob #1867
  • Fix virtual table set_result #1868
  • Bump bundled SQLCipher to version 4.17.0 #1870
  • Refactor bind_parameter and set_result #1871
  • Update prettyplease requirement from 0.2.20 to 0.3.0 #1872
  • Update syn requirement from 2.0.89 to 3.0.1 #1873
  • Fix Connection::serialize #1874 (#1875)
  • Make Statement::column_names,columns,columns_with_metadata return Iterator #1877
  • Introduce DEFAULT_NAME #1883
  • Expose sqlite3_file_control #1881 (#1882)
  • Replace assert!(matches! with assert_matches! #1851
  • Lower MSRV to 1.88.0 #1885
  • Fix clippy warnings #1888
  • Apply and check MSRV #1890
  • Bump minimal SQLite version to 3.45.3 #1894
  • sqlite3_set_clientdata / sqlite3_get_clientdata #977, #1708 (#1791)
  • Fix discrepancy between backup and restore #1893
  • Don't enable SQLITE_ENABLE_MEMORY_MANAGEMENT in the bundled build #1900
  • create_aggregate_function / create_window_function are missing a Send bound #1898
  • use-after-free from safe code in trace_v2 / busy_handler / ... #1899
  • feat: add Values::get_subtype to read SQLite value subtype in vtab callbacks #1879
  • Bump bindgen version to 0.73 #1903
  • Bump sqlite-wasm-rs to 0.6.1 #1904
  • Relax sqlite-wasm-rs version #1906
  • Rerun bundled-sqlcipher build when OPENSSL_* env changes #1910
  • Bump bundled SQLite version to 3.54.0 #1913
  • Fix possible memory leak on error in deserialize_read_exact #1909
  • Move sqlite3_wal_checkpoint_v2 binding #1667 (#1915)
  • Bump uuid version to 1.28 #1916

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.41.0

0.40.2

What's Changed

  • Lower MSRV to 1.88.0

Full Changelog: rusqlite/rusqlite@v0.40.1...v0.40.2

0.40.1

What's Changed

  • Fix clippy warnings #1852
  • Bump bundled SQLite version to 3.53.2 #1853
  • Bump hashlink version #1855
  • Fix SQL injection when SAVEPOINT name is tainted #1854

... (truncated)

Commits
  • a60e76b Merge pull request #1919 from gwenn/0.41.0
  • f652850 Prepare release
  • 661107f Merge pull request #1917 from LucaCappelletti94/feat/sqlcipher-src
  • dd770f6 Fix the SQLCipher license link and match upstream style
  • 2daf10a Select the SQLCipher source with cfg_select
  • bb40153 Merge pull request #1916 from gwenn/uuid
  • 92a7d49 Bump uuid version to 1.28
  • fb3418c Build bundled-sqlcipher from the sqlcipher-src crate
  • ff59564 Merge pull request #1915 from gwenn/wal_checkpoint
  • e6b7145 Move sqlite3_wal_checkpoint_v2 binding
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 21, 2026
zylvex-tech pushed a commit that referenced this pull request Oct 22, 2026
zylcode-verify
docs(governance): correct the Dependabot count and cite the reviewer'…
935ee91 
…s re-verification

Corrections found by re-checking rather than by trusting the earlier
revision:

- Open Dependabot PRs are fifteen, not nine. Five are failing their
  checks (#7, #8, #12, #14, #17). The table now lists each PR with its
  own check status, and says explicitly that green CI is not proof of
  behavioural equivalence for the six green major-version bumps.
- `LruCache::pop()` is at cache.rs:61, not :62.
- Branch count is 22, not 21.

Adds 11.4 recording the independent review's five unverified items and
their fresh results, including that PR #23's head ca05218 has all four
checks green when queried per-SHA.
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rusqlite-0.40.2 branch from af82b4f to 67f9910 Compare October 22, 2026 11:20
zylvex-tech added a commit that referenced this pull request Oct 22, 2026
@zylvex-tech
docs(governance): replace the carried-forward Dependabot count with a…
33b1ad3 
… verified one

The P3 backlog item claimed "5 are failing and 6 are green major-version
bumps". The "5 failing" figure was carried forward from an earlier session and
happened to be right, but the "6 green major-version bumps" figure was not
re-derived and did not match the current state.

Re-queried every open Dependabot PR head SHA individually:

  failing (5): #7, #8 (mixed), #12, #14, #17
  green  (10): #9, #10, #11, #13, #15, #16, #18, #19, #20, #21

Of the 10 green, 8 cross a major version or a semver-0.x minor (which is
breaking under 0.x rules): #9 tauri-action 0->1, #10 tree-sitter-rust
0.23.3->0.24.2, #11 opentelemetry-otlp 0.28.0->0.33.1, #13 actions/checkout
4->7, #15 axum 0.7.9->0.8.9, #16 tracing-opentelemetry 0.28.0->0.34.0, #18
react, #19 framer-motion 11.18.2->14.3.0.

The item now states the verified split with PR numbers and version deltas
instead of an unsourced ratio. The limitations section is narrowed to match:
check status was verified per SHA, PR contents were not reviewed.
zylvex-tech added a commit that referenced this pull request Oct 22, 2026
@zylvex-tech
docs(governance): record the branch-protection remediation applied to…
0abf602 
… main

Section 5 of the audit found main unprotected and recommended a
configuration. That recommendation has now been applied under explicit owner
authorization, and the report is updated so it does not read as a live gap.

Applied 2026-10-22 14:19 UTC, verified by readback: PR required with 1
approval; four required status checks (ubuntu-22.04, windows-latest,
macos-latest, coverage); strict up-to-date branches; conversation resolution
required; enforce_admins on; force pushes and deletions off; linear history
off, because this repo merges with merge commits.

The reviewer cautioned against making macOS required before establishing
suite stability. That was settled with data rather than assumption: the macOS
job conclusion was pulled for the last 16 CI runs. 12 successes, 2 failures.
One failure is 184e178, the flaky egress guard that predates PR #23. The other
is 67f9910 (PR #14, rusqlite 0.31 to 0.40), which is a deterministic compile
error -- error[E0277]: the trait bound u64: FromSql is not satisfied -- not
flakiness at all, and exactly what a required check should catch. Since PR #23
landed there have been five consecutive macOS successes.

Dependabot was deliberately left out of the required set: it is reported on
4e24e2a but not on 3bd5059, so requiring it would block merges waiting for a
status that never arrives.

The residual risk is stated plainly in the new section rather than smoothed
over: five green runs is good evidence, not a formal stability baseline. The
executive summary row and the P0 item are updated to point at 5.2 so a reader
does not stop at "No" and conclude main is still unguarded.
@zylvex-tech zylvex-tech mentioned this pull request Oct 22, 2026
Merged
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rusqlite-0.40.2 branch 2 times, most recently from f0bd5b0 to 78c91a4 Compare October 25, 2026 07:32
@dependabot
dependabot Bot requested a review from Gar-gar22 as a code owner October 25, 2026 07:32
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rusqlite-0.40.2 branch from 78c91a4 to 47b4ef2 Compare October 27, 2026 07:19
@dependabot
build(deps): bump rusqlite from 0.31.0 to 0.41.0
05d86b5 
Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.31.0 to 0.41.0.
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](rusqlite/rusqlite@v0.31.0...v0.41.0)

---
updated-dependencies:
- dependency-name: rusqlite
  dependency-version: 0.40.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump rusqlite from 0.31.0 to 0.40.2 build(deps): bump rusqlite from 0.31.0 to 0.41.0 Oct 29, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rusqlite-0.40.2 branch from 47b4ef2 to 05d86b5 Compare October 29, 2026 12:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Gar-gar22 Gar-gar22 Gar-gar22 approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Gar-gar22