Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade macOS and Windows installers to use SQLite 3.37.2 #90083

Closed
erlend-aasland opened this issue Nov 29, 2021 · 15 comments
Closed

Upgrade macOS and Windows installers to use SQLite 3.37.2 #90083

erlend-aasland opened this issue Nov 29, 2021 · 15 comments
Labels
3.9 only security fixes 3.10 only security fixes 3.11 only security fixes OS-mac OS-windows

Comments

@erlend-aasland
Copy link
Contributor

BPO 45925
Nosy @pfmoore, @ronaldoussoren, @tjguk, @ned-deily, @zware, @zooba, @miss-islington, @erlend-aasland, @kumaraditya303
PRs
  • bpo-45925: Update Windows installer to SQLite 3.37.2 #30485
  • bpo-45925: Update macOS installer to SQLite 3.37.2 #30921
  • [3.10] bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485) #30991
  • [3.9] bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485) #30994
  • [3.10] bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) #31057
  • [3.9] bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) (GH-31057) #31059
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2022-02-01.17:13:42.427>
created_at = <Date 2021-11-29.11:57:19.546>
labels = ['OS-mac', '3.10', '3.9', 'OS-windows', '3.11']
title = 'Upgrade macOS and Windows installers to use SQLite 3.37.2'
updated_at = <Date 2022-02-01.17:13:42.426>
user = 'https://github.com/erlend-aasland'

    bugs.python.org fields:

    activity = <Date 2022-02-01.17:13:42.426>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2022-02-01.17:13:42.427>
closer = 'ned.deily'
components = ['macOS', 'Windows']
creation = <Date 2021-11-29.11:57:19.546>
creator = 'erlendaasland'
dependencies = []
files = []
hgrepos = []
issue_num = 45925
keywords = ['patch']
message_count = 15.0
messages = ['407266', '409493', '409919', '409920', '409931', '409932', '409934', '409936', '410018', '412004', '412018', '412019', '412284', '412287', '412295']
nosy_count = 9.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'tim.golden', 'ned.deily', 'zach.ware', 'steve.dower', 'miss-islington', 'erlendaasland', 'kumaraditya']
pr_nums = ['30485', '30921', '30991', '30994', '31057', '31059']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = None
url = 'https://bugs.python.org/issue45925'
versions = ['Python 3.9', 'Python 3.10', 'Python 3.11']
    @erlend-aasland
    Copy link
    Contributor Author

    SQLite 3.37.0 was released a couple of days ago: https://sqlite.org/releaselog/3_37_0.html

    Given that 3.11 feature freeze is approx. May 2022, and that it took approx. 5 months between SQLite 3.36.0 and 3.37.0, I'd say we aim for a field tested SQLite 3.37.0 instead of a possibly fresh-out-of-the-box 3.38.0 in 3.11.

    Let's wait a couple of weeks before changing the macOS/Windows installers.

    @erlend-aasland
    Copy link
    Contributor Author

    SQLite 3.37.1 appeared the day before New Years Eve. So let us wait until the end of January before upgrading the installers.

    https://www.sqlite.org/releaselog/3_37_1.html

    @erlend-aasland erlend-aasland changed the title Upgrade macOS and Windows installers to use SQLite 3.37.0 Upgrade macOS and Windows installers to use SQLite 3.37.1 Jan 2, 2022
    @erlend-aasland erlend-aasland changed the title Upgrade macOS and Windows installers to use SQLite 3.37.0 Upgrade macOS and Windows installers to use SQLite 3.37.1 Jan 2, 2022
    @erlend-aasland
    Copy link
    Contributor Author

    SQLite 3.37.2 is fresh out now. Copying the release statement from the SQLite forum:

    Patch release 3.37.2 fixes a potential database corruption bug.
Upgrading is recommended for all users.

The database corruption bug is obscure and you are unlikely to hit it.
But you should probably still upgrade.  For more information about
the bug see:

 *  https://sqlite.org/forum/forumpost/ac381d64d8

    Link to the release page: https://www.sqlite.org/releaselog/3_37_2.html

    We should consider backporting to 3.10 and 3.9 due to the severity of the bug.

    @erlend-aasland erlend-aasland changed the title Upgrade macOS and Windows installers to use SQLite 3.37.1 Upgrade macOS and Windows installers to use SQLite 3.37.2 Jan 6, 2022
    @erlend-aasland erlend-aasland changed the title Upgrade macOS and Windows installers to use SQLite 3.37.1 Upgrade macOS and Windows installers to use SQLite 3.37.2 Jan 6, 2022
    @erlend-aasland
    Copy link
    Contributor Author

    Quoting the SQLite forum post, regarding backporting:

    There is a bug in versions 3.35.0 (2021-03-12) through 3.37.1 (2021-12-30)
which could potentially cause database corruption. Upgrading to version
3.37.2 (2022-01-06) or later is recommended.

    The Python 3.10 Windows and macOS installers ship with SQLite 3.36.0, so they are vulnerable to this bug. Ditto for the Python 3.9 Windows and macOS installers which ship with SQLite 3.35.5.

    @erlend-aasland erlend-aasland added 3.10 only security fixes 3.9 only security fixes labels Jan 6, 2022
    @zooba
    Copy link
    Member

    zooba commented Jan 6, 2022

    Are we enabling the build option they mention on the release page? Or is
    this only going to affect users who use the pragma?

    We should obviously do the upgrade, but that will determine how
    aggressively we ought to be messaging the issue.

    @erlend-aasland
    Copy link
    Contributor Author

    As I understand the forum post, you're vulnerable if you use that specific build option (we don't), _or_ if you use the pragma (anyone may do that). So AFAICS, we should upgrade.

    @zooba
    Copy link
    Member

    zooba commented Jan 6, 2022

    We should definitely upgrade, but we probably don't have to trigger a
    fresh release of all branches for it, or make a big fuss about it being
    a special fix. That's all I was trying to establish.

    @erlend-aasland
    Copy link
    Contributor Author

    No, I don’t think we need to rush a new release. The scheduled 3.10 and 3.9 releases should do fine.

    Can you update the sources repo in the mean time?

    @zooba
    Copy link
    Member

    zooba commented Jan 7, 2022

    Can you update the sources repo in the mean time?

    Done

    @zooba
    Copy link
    Member

    zooba commented Jan 28, 2022

    New changeset db77bcd by Kumar Aditya in branch 'main':
    bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
    db77bcd

    @zooba
    Copy link
    Member

    zooba commented Jan 28, 2022

    New changeset 4d191fc by Steve Dower in branch '3.10':
    bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
    4d191fc

    @miss-islington
    Copy link
    Contributor

    New changeset ad9cf2f by Miss Islington (bot) in branch '3.9':
    bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
    ad9cf2f

    @ned-deily
    Copy link
    Member

    New changeset 0e4bef7 by Kumar Aditya in branch 'main':
    bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921)
    0e4bef7

    @ned-deily
    Copy link
    Member

    New changeset 519eb6a by Ned Deily in branch '3.10':
    bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) (GH-31057)
    519eb6a

    @ned-deily
    Copy link
    Member

    New changeset a22dd00 by Miss Islington (bot) in branch '3.9':
    bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) (GH-31057) (GH-31059)
    a22dd00

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    @sm-Fifteen sm-Fifteen mentioned this issue Jul 20, 2022
    Closed
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.9 only security fixes 3.10 only security fixes 3.11 only security fixes OS-mac OS-windows
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    4 participants
    @zooba @ned-deily @erlend-aasland @miss-islington