Fix bundled SQLite CVEs (rusqlite 0.34) and LMDB EINVAL failures on macOS - #2103
Open
erubboli wants to merge 4 commits into
Open
Fix bundled SQLite CVEs (rusqlite 0.34) and LMDB EINVAL failures on macOS#2103erubboli wants to merge 4 commits into
erubboli wants to merge 4 commits into
Conversation
libsqlite3-sys 0.32.0 bundles SQLite 3.49.1, which fixes upstream CVE-2025-29030/-29031 present in the previously bundled 3.48.0. Relevant only to builds using the 'bundled' feature (storage/sqlite); not remotely exploitable (requires local crafted SQL/DB file).
Darwin's default System V semaphore backend fails with EINVAL once a process holds locks on more than kern.sysv.semume (=10) semaphore sets concurrently, breaking workloads that open multiple DB environments in one process (e.g. the storage-lmdb test suite). Compile lmdb with MDB_USE_POSIX_MUTEX=1 on Apple targets via target- scoped CFLAGS in .cargo/config.toml; MDB_USE_ROBUST must be disabled because Darwin does not implement robust mutexes. Linux builds keep upstream defaults.
erubboli
force-pushed
the
fix_bundled_sqlite_cves_and_macos_lmdb
branch
from
August 22, 2026 21:34
9918ca3 to
668ef88
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency and platform fixes surfaced during routine dependency auditing.
1. Bump
rusqlite0.33.0 → 0.34.0 (libsqlite3-sys→ 0.32.0)libsqlite3-sys 0.32.0bundles SQLite 3.49.1 (verified viaSQLITE_VERSIONin compiled build output); 0.31.0 bundled an older release.
bundledfeature (storage/sqlite).a maliciously crafted database file. Node operators should still update at
their convenience.
audits.tomlchange needed.2. Fix LMDB failures on macOS (
Invalid argument (os error 22))(
kern.sysv.semume) causesemop(2)to fail once several DB environmentsare open concurrently in one process.
-DMDB_USE_POSIX_MUTEX=1 -DMDB_USE_ROBUST=0via target-scoped
CFLAGS_*-apple-darwinin.cargo/config.toml.Linux/CI builds are untouched.
crash while holding an env lock, other processes may deadlock on that environment.
Testing
cargo test --workspace --no-fail-fast: 202 suites, 3,014 passed, 0 failed