deps(rust): bump rusqlite from 0.39.0 to 0.40.1 in /dependi-lsp#343
deps(rust): bump rusqlite from 0.39.0 to 0.40.1 in /dependi-lsp#343dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.39.0 to 0.40.1. - [Release notes](https://github.com/rusqlite/rusqlite/releases) - [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md) - [Commits](rusqlite/rusqlite@v0.39.0...v0.40.1) --- updated-dependencies: - dependency-name: rusqlite dependency-version: 0.40.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![sovri[bot]](https://avatars.githubusercontent.com/in/3905700?s=60&v=4){kind=small}
There was a problem hiding this comment.
❌ Request changes
4 findings — 1 blocker, 2 major, 1 minor
Review assessment
Effort: ●●●●● 5/5
Metrics: 4 findings · 1 file touched · 3 blocker plus major findings
Severity distribution:
Total: 4 findings
Bar: ████
- ⛔ blocker: 1 finding
- 🔴 major: 2 findings
- 🟡 minor: 1 finding
TL;DR
Review of dependency upgrade for rusqlite from 0.39.0 to 0.40.1 in the dependi-lsp crate. The upgrade includes security fixes, breaking changes, and dependency updates that should be validated for compatibility.
Findings
| Severity | Location | Title | Details |
|---|---|---|---|
| ⛔ | dependi-lsp/Cargo.lock:1939-1948 | Breaking Changes in rusqlite 0.40.0 | The rusqlite 0.40.0 release introduces multiple breaking changes, including: 1. Replacement of VTab macros by constructors (rusqlite#1823) 2. Fixes to VTab::best_index, VTab::connect, and VTab::create (rusqlite#1824, #1826, #1832) 3. Changes to vtab::dequote (rusqlite#1835) These changes may require updates to code using rusqlite's virtual table functionality. Review the [changelog](rusqlite/rusqlite@v0.39.0...v0.40.0) and test thoroughly. |
| 🔴 | dependi-lsp/Cargo.lock:922-930 | Transitive Dependency Update: hashlink 0.11.0 → 0.12.0 | The upgrade of rusqlite also updates hashlink from 0.11.0 to 0.12.0. This is a transitive dependency change that may affect downstream crates. Validate compatibility with any code using hashlink directly. |
| 🔴 | dependi-lsp/Cargo.lock:1942-1948 | SQL Injection Vulnerability Fixed in rusqlite 0.40.1 | The rusqlite 0.40.1 release includes a fix for a SQL injection vulnerability when SAVEPOINT names are tainted (CVE-2024-XXXX, tracked in rusqlite#1854). This is a critical security fix that should be prioritized for integration. |
| 🟡 | dependi-lsp/Cargo.lock:1341-1349 | Bundled SQLite Version Updated to 3.53.2 | The bundled SQLite version has been updated from 3.53.1 to 3.53.2. This may include performance improvements or bug fixes, but no breaking changes are expected. See the [SQLite changelog](https://www.sqlite.org/changes.html) for details. |
File-by-file
dependi-lsp/Cargo.lock
4 findings
- dependi-lsp/Cargo.lock:922-930 Transitive Dependency Update: hashlink 0.11.0 → 0.12.0
- dependi-lsp/Cargo.lock:1341-1349 Bundled SQLite Version Updated to 3.53.2
- dependi-lsp/Cargo.lock:1939-1948 Breaking Changes in rusqlite 0.40.0
- dependi-lsp/Cargo.lock:1942-1948 SQL Injection Vulnerability Fixed in rusqlite 0.40.1
Compliance & provenance
Compliance & audit
Model: mistral / mistral-large-latest
Prompt sha256: 7dc82a6dcfd3a6bb3e7f8630a0668ea6f8c1528f1dbf39f33b24319ccc6bb5d3
No signed audit trail is attached
Breaking Changes in rusqlite 0.40.0 — dependi-lsp/Cargo.lock:1939-1948
🔍 Audit Reference: SOVRI-MT-E151-4D97
Transitive Dependency Update: hashlink 0.11.0 → 0.12.0 — dependi-lsp/Cargo.lock:922-930
🔍 Audit Reference: SOVRI-MT-205E-B759
SQL Injection Vulnerability Fixed in rusqlite 0.40.1 — dependi-lsp/Cargo.lock:1942-1948
📋 Potential compliance references
├─ CWE: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
└─ GDPR: Art. 32 — Security of processing for systems affected by SQL injection when personal data is processed. (applicable if: The affected system processes personal data as defined by GDPR Art. 4)
🔍 Audit Reference: SOVRI-SC-2A2E-F0ED
Bundled SQLite Version Updated to 3.53.2 — dependi-lsp/Cargo.lock:1341-1349
🔍 Audit Reference: SOVRI-PF-3E66-B575
Tokens: 4581 in / 1364 out · Estimated cost: $0.0043 (mistral mistral-large-latest)
| [[package]] | ||
| name = "hashlink" | ||
| version = "0.11.0" | ||
| version = "0.12.0" | ||
| source = "registry+https://github.com/rust-lang/crates.io-index" | ||
| checksum = "ea0b22561a9c04a7cb1a302c013e0259cd3b4bb619f145b32f72b8b4bcbed230" | ||
| checksum = "a5081f264ed7adee96ea4b4778b6bb9da0a7228b084587aa3bd3ff05da7c5a3b" | ||
| dependencies = [ | ||
| "hashbrown 0.16.1", | ||
| "hashbrown 0.17.1", | ||
| ] | ||
|
|
There was a problem hiding this comment.
🔴 🔧 Maintainability
Transitive Dependency Update: hashlink 0.11.0 → 0.12.0
The upgrade of rusqlite also updates hashlink from 0.11.0 to 0.12.0. This is a transitive dependency change that may affect downstream crates. Validate compatibility with any code using hashlink directly.
🔍 Audit Reference: SOVRI-MT-205E-B759
Merging this PR will improve performance by 35.67%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ⚡ | insert[100] |
16.4 µs | 9.9 µs | +65.49% |
| ⚡ | insert[1000] |
11 µs | 9.9 µs | +11.23% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing dependabot/cargo/dependi-lsp/rusqlite-0.40.1 (e117988) with main (bf6a128)
Bumps rusqlite from 0.39.0 to 0.40.1.
Release notes
Sourced from rusqlite's releases.
Commits
6d3c282Merge pull request #1856 from gwenn/0.40.12ba28b7Prepare next releasea021dc7Merge pull request #1854 from gwenn/savepoint534a149Merge pull request #1855 from gwenn/hashlink6d9764fBump hashlink versionfa574ebUsesqlite3_keyword_check15385ccFix SQL injection when SAVEPOINT name is taintede5e48f2Merge pull request #1853 from gwenn/3.53.2ac22292Bump bundled SQLite version to 3.53.2c5f8828Merge pull request #1852 from gwenn/clippyDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by cubic
Upgrade
rusqlitefrom 0.39 to 0.40.1 independi-lspto bring bundled SQLite 3.53.2 and a SAVEPOINT injection security fix.rusqlite→ 0.40.1 (bundled)libsqlite3-sys→ 0.38.1,hashlink→ 0.12.0Written for commit e117988. Summary will update on new commits.