What the developer wrote
Authored by fanquake
depends: sqlite 3.50.4
Migrate to the new Autosetup build system (introduced in 3.48.0).
See https://msteveb.github.io/autosetup/.
Also: https://sqlite.org/releaselog/3_50_0.html.
What changed, and why it matters
This commit updates the SQLite library used by Bitcoin Core's build system from version 3.46.1 to 3.50.4, and switches to SQLite's newer 'Autosetup' build system. It also tightens some compile-time options, such as disabling dynamic extensions and adding a debug flag in debug builds. There is no direct evidence in the commit that this fixes a specific security vulnerability, but routine dependency updates can include upstream security fixes.
Treat as a routine maintenance/dependency update. Review upstream SQLite 3.50.4 release notes for any security advisories relevant to Bitcoin Core's usage (wallet descriptors, descriptor SQLite usage). No immediate action required unless upstream discloses a relevant vulnerability.
Security signals we found
Dependency version bump (SQLite 3.46.1 -> 3.50.4)
Build system migration to Autosetup
Compile-time hardening: SQLITE_OMIT_LOAD_EXTENSION added
Debug builds now pass --debug to Autosetup
No CVE, advisory, or security-relevance statement in commit or supplied references
Evidence from the diff
The change modifies depends/packages/sqlite.mk to bump SQLite from 3460100 to 3500400, update the download path to 2025, refresh the SHA-256 hash, and migrate from the legacy autotools-style build to SQLite’s Autosetup build system. Notable option changes: removal of –disable-dynamic-extensions from config_opts (replaced by -DSQLITE_OMIT_LOAD_EXTENSION in cppflags), removal of –enable-option-checking, addition of –debug for debug builds, and build/install commands adapted to produce libsqlite3.a instead of libsqlite3.la. The commit does not cite a CVE or security advisory.
Changed components
depends/packages/sqlite.mkSQLite dependency build configurationInspect captured patch +15 / −21
diff --git a/depends/packages/sqlite.mk b/depends/packages/sqlite.mk
index 67b7719e..7bb39b26 100644
--- a/depends/packages/sqlite.mk
+++ b/depends/packages/sqlite.mk
@@ -1,35 +1,29 @@
package=sqlite
-$(package)_version=3460100
-$(package)_download_path=https://sqlite.org/2024/
+$(package)_version=3500400
+$(package)_download_path=https://sqlite.org/2025/
$(package)_file_name=sqlite-autoconf-$($(package)_version).tar.gz
-$(package)_sha256_hash=67d3fe6d268e6eaddcae3727fce58fcc8e9c53869bdd07a0c61e38ddf2965071
+$(package)_sha256_hash=a3db587a1b92ee5ddac2f66b3edb41b26f9c867275782d46c3a088977d6a5b18
define $(package)_set_vars
-$(package)_config_opts=--disable-shared --disable-readline --disable-dynamic-extensions --enable-option-checking
-$(package)_config_opts+= --disable-rtree --disable-fts4 --disable-fts5
-# We avoid using `--enable-debug` because it overrides CFLAGS, a behavior we want to prevent.
-$(package)_cppflags_debug += -DSQLITE_DEBUG
-$(package)_cppflags+=-DSQLITE_DQS=0 -DSQLITE_DEFAULT_MEMSTATUS=0 -DSQLITE_OMIT_DEPRECATED
-$(package)_cppflags+=-DSQLITE_OMIT_SHARED_CACHE -DSQLITE_OMIT_JSON -DSQLITE_LIKE_DOESNT_MATCH_BLOBS
-$(package)_cppflags+=-DSQLITE_OMIT_DECLTYPE -DSQLITE_OMIT_PROGRESS_CALLBACK -DSQLITE_OMIT_AUTOINIT
-endef
-
-define $(package)_preprocess_cmds
- cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub .
+$(package)_config_opts = --disable-shared --disable-readline --disable-rtree
+$(package)_config_opts += --disable-fts4 --disable-fts5
+$(package)_config_opts_debug += --debug
+$(package)_cppflags += -DSQLITE_DQS=0 -DSQLITE_DEFAULT_MEMSTATUS=0 -DSQLITE_OMIT_DEPRECATED
+$(package)_cppflags += -DSQLITE_OMIT_SHARED_CACHE -DSQLITE_OMIT_JSON -DSQLITE_LIKE_DOESNT_MATCH_BLOBS
+$(package)_cppflags += -DSQLITE_OMIT_DECLTYPE -DSQLITE_OMIT_PROGRESS_CALLBACK -DSQLITE_OMIT_AUTOINIT
+$(package)_cppflags += -DSQLITE_OMIT_LOAD_EXTENSION
endef
+# Remove --with-pic, which is applied globally to configure
+# invocations but is incompatible with Autosetup
define $(package)_config_cmds
- $($(package)_autoconf)
+ $$(filter-out --with-pic,$($(package)_autoconf))
endef
define $(package)_build_cmds
- $(MAKE) libsqlite3.la
+ $(MAKE) libsqlite3.a
endef
define $(package)_stage_cmds
- $(MAKE) DESTDIR=$($(package)_staging_dir) install-libLTLIBRARIES install-includeHEADERS
-endef
-
-define $(package)_postprocess_cmds
- rm lib/*.la
+ $(MAKE) DESTDIR=$($(package)_staging_dir) install-headers install-lib
endef
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.