Uh oh!
There was an error while loading. Please reload this page.
Sync upstream v6.0.1 - #17
Closed
fflorent wants to merge 68 commits into
Closed
Conversation
It seems that an old refactoring (~8 years) made a mistake on the way conditions are expressed in gyp. the "conditions" key cannot be set 2 times and the conditions should be all set in the "conditions" array. The impact of this bug is that when sqlite3 is compiled against a custom sqlite3 source tree, the sqlite3 runtime keeps linking with the system sqlite3 instead of linking to the custom compiled sqlite3 library. In my case that lead to a SIGSEGV upon loading an extension.
refs https://www.sqlite.org/releaselog/3_41_1.html - sha3-256sum: `38ecb6b086c5c1ee1e52b57556745055328ac912929ccade9deaefdd71033ddb`
refs GHSA-jqv5-7xpx-qj74fixeshttps://github.com/TryGhost/Toolbox/issues/491 - when you call `ToString()` on `Napi::Value`, it calls `napi_coerce_to_string` underneath, which has the ability to run arbitrary JS code if the passed in value is a crafted object - both remote code execution or denial-of-service are possible via this vulnerability - `toString()` on an Object returns `[object Object]` so instead of calling the function, we're going to hardcode it to prevent this issue Credits: Dave McDaniel of Cisco Talos
…h methods callback rows (TryGhost#1686) * Change sqlite3.d.ts to add generic type definition support for Statement methods -For get method callback's row -For all method callback's rows -For each method callback's row * Change sqlite3.d.ts to add generic type definition support for Database methods -For get method callback's row -For all method callback's rows -For each method callback's row
- added myself as a contributor 😀
fixesTryGhost#1690 - the minimum glibc version was inadvertently bumped in the latest release because `log2` was linked to a higher version - this adds the downgrade to the gcc preinclude file to resolve this - in an upcoming commit, we will add a test to prevent these issues from occurring again
- without this, the syntax is not recognised because we use `sh`
refs https://www.sqlite.org/releaselog/3_42_0.html - sha3-256sum: `643898e9fcc8f6069bcd47b0e6057221c1ed17bbee57da20d2752c79d91274e8`
…dability - Implemented RAII to ensure resource safety and exception safety - Leveraged range-based for loops for cleaner and more efficient iteration - Addressed and resolved all project-related warnings for enhanced code quality
This reverts commit 7552aa0.
refs https://www.sqlite.org/releaselog/3_44_2.html - sha3-256sum: `6c427f0547e2f7babe636b748dd5d5a1f2f31601adadef7e2805e7d1f7171861`
- this doesn't do anything because we just rethrow the error
- Python 3.12 no longer ships with this and GHA CI has updated to 3.12, which breaks our build scripts - this should fix that until we can update node-gyp
- merged pretest and test - removed `pack` as it is not needed
- right now our way to check semver compatibility is to run the tests on every version - this is really inefficient as it results in a lot of CI jobs that we don't need - this should run a CI job that ensures the minimum version we accept is Node 10.12.0
- bumped building on Node 16 to Node 18 - removed all matrix executions apart from Node 18
…stall` fixesTryGhost#1641fixesTryGhost#1721fixesTryGhost#1714fixesTryGhost#1713fixesTryGhost#1700fixesTryGhost#1704 - `@mapbox/node-pre-gyp` is effectively unmaintained [1] as has a few bugs which our users keep running into - it seems the prebuilt binary world has moved in favor of prebuild + it's various other forms - one option would be to use prebuildify to bundle all binaries into the package, but that's a step too far removed from the current situation for now - instead, we can use prebuild-install to download the binaries, and `prebuild` to build + upload the binaries - this means we can remove node-pre-gyp and fix a bunch of issues! - eventually, we could start providing electron prebuilt binaries too [1]: mapbox/node-pre-gyp#657
- switched to just providing a list of platform + arch instead of the full formatted string
Added unmaintained notice and status.
FixesTryGhost#1824 — prebuild-install failing on Node 22.14.0 due to N-API version string comparison bug in napi-build-utils < 2.0.0. Dependencies: - prebuild-install: ^7.1.1 -> ^7.1.3 (fixes N-API version detection) - prebuild: 12.1.0 -> 13.0.1 - tar: ^6.1.11 -> ^7.5.10 (fixes 6 HIGH CVEs) - node-addon-api: ^7.0.0 -> ^8.0.0 - node-gyp: 8.x -> 12.x (peer + optional) - Added engines field: node >=20.17.0 - Added yarn.lock CI: - Test matrix: Node 20, 22, 24 (all current LTS lines) - ubuntu-20.04 -> ubuntu-24.04, alpine3.15 -> alpine3.20 - Replaced macos-m1 self-hosted with macos-latest (now ARM64) - Dropped win32-ia32 (Node 24 no longer ships 32-bit Windows) - Excluded macos x64 + Node 20 (Rosetta 2 async hooks bug) - Removed pip install setuptools workaround - Updated actions (checkout v6, setup-node v6, upload-artifact v7, setup-qemu-action v4, setup-buildx-action v4) - Sanitised artifact names to avoid slashes from platform targets - Dockerfile: Node 18 -> 24, bullseye -> bookworm
Two years of upstream improvements including bug fixes, performance enhancements, and security hardening. The extract script now removes the VERSION file that SQLite >= 3.49 ships, which conflicts with the C++20 <version> header on case-insensitive filesystems (macOS/Windows).
- gcc-preinclude.h: include <unistd.h> with _GNU_SOURCE active to provide syscall() on musl (fixes GCC 13 atomic_wait.h bug); use __GLIBC__ instead of __USE_GNU to guard glibc symbol versioning - CI: linux-arm64 glibc builds now use native ubuntu-24.04-arm runners instead of QEMU emulation (much faster) - CI: QEMU/Docker retained only for Alpine/musl builds (renamed to build-musl)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sync with TryGhost/node-sqlite3 v6.0.1, preserving all Grist-specific
patches (allMarshal feature, marshal serializer/parser test hooks,
glibc fmod symver hack).
Notable upstream changes pulled in:
- Bundled SQLite bumped from 3.40.0 to 3.52.0
- Code-execution fix from v5.1.5 (Object coercion in bindings)
- Build system migrated from @mapbox/node-pre-gyp to prebuild +
prebuild-install
- node-addon-api bumped to ^8.0.0, node-gyp to 12.x
- Node.js >=20.17.0 required (drops Node 10-18 support)
- Modernised CI matrix (Node 20/22/24 on ubuntu-24.04, native ARM
runners, dropped QEMU)
- Refactored statement/database C++ code to use std::unique_ptr,
CREATE_WORK macro
Grist customisations preserved:
- @gristlabs/sqlite3 package name, version bumped to 6.0.1-grist.0
- gristlabs/node-sqlite3 repo/homepage URLs
- src/marshal.{h,cc} + Statement::AllMarshal + MarshalBaton
- Database#allMarshal in lib/sqlite3.js
- Serialize/Parse/TestOppositeEndianness hooks in node_sqlite3.cc
- gcc-preinclude.h fmod@GLIBC symver
- build:assert / test:memory scripts
- CI triggers for grist-main and grist-main-dev branches
Co-authored-by: Claude Codefflorent
commented
Jun 2, 2026
| "name": "@gristlabs/sqlite3", | ||
| "description": "Asynchronous, non-blocking SQLite3 bindings", | ||
| "version": "5.1.4-grist.12", | ||
| "version": "6.0.1-grist.0", |
Author
There was a problem hiding this comment.
Suggested change
| "version": "6.0.1-grist.0", | |
| "version": "6.0.1-grist.1", |
Draft
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
node-sqlite3 is out of date. Newer version brings fixes and dependencies upgrade.
The solution
PR made with the assistance of Claude Code (probably overkill, sounds like mostly a merge commit from upstream).
Merge upstream master (v6.0.1) into grist-main
Sync with TryGhost/node-sqlite3 v6.0.1, preserving all Grist-specific
patches (allMarshal feature, marshal serializer/parser test hooks,
glibc fmod symver hack).
Notable upstream changes pulled in:
Grist customisations preserved: