build: (deps): bump sqlite3 from 2.9.4 to 3.3.3

[dependabot]

Bumps sqlite3 from 2.9.4 to 3.3.3.

Release notes

Sourced from sqlite3's releases.

sqlite3-3.3.3

• Restore support for SQLCipher (thanks to @​davidmartos96!).
• Fix crash when loading IndexedDB databases with blocks past the file length (#380).
• Don't uninstall update hooks when closing databases if no update hooks were installed by this package.

sqlite3-3.3.2

• Support package:native_toolchain_c versions 0.18.x and 0.19.x.
• Support hooks versions 2.x.
• Upgrade to SQLite version 3.53.1.
• Allow disabling BigInt support via -Dsqlite3.dartbigints=false, which can be used to reduce code size on the web if nothing else uses BigInt values.

sqlite3-3.3.1

• Avoid memory leaks when tempDirectory is set multiple times.
• Update to SQLite 3.53.0 and SQLite3 Multiple Ciphers version 2.3.3.

sqlite3-3.3.0

• Web: Add WasmModuleLoader API to customize how WebAssembly modules are loaded.
• Hook: Improve error message for failing downloads.

sqlite3-3.2.0

• Add package:sqlite3/unstable/ffi_bindings.dart providing low-level access to generated libsqlite3 bindings.
• Add PreparedStatement.leak to transfer ownership of a prepared statement into native code.
• Add Database.statementFromPointer, which can be used to access a statement prepared in native code from Dart.

sqlite3-3.1.7

• Update to sqlite version 3.52.0.

sqlite3-3.1.6

Note: These assets are for version 3.1.6 of the sqlite3 package. If you're on version 2, use these releases instead.

• Expose the address of sqlite3_close_v2 as static field on Sqlite3 class.
• Allow wrapping databases without closing them with the borrowed parameter on Sqlite3.fromPointer.
• Add Database.leak(), which extracts a sqlite3* pointer and disables finalizers.

sqlite3-3.1.5

Note: These assets are for version 3.1.4 of the sqlite3 package. If you're on version 2 (you are if you're using drift, use these releases instead).

• Build hook: Ensure we use consistent filenames to fix issues on Apple platforms.

sqlite3-3.1.4

Note: These assets are for version 3.1.4 of the sqlite3 package. If you're on version 2 (you are if you're using drift, use these releases instead).

• Build hook: Fix paths not resolving on Windows when building from source.

sqlite3-3.1.3

Note: These assets are for version 3.1.3 of the sqlite3 package. If you're on version 2 (you are if you're using drift, use these releases instead).

• Update to SQLite version 3.51.2.

sqlite3-3.1.2

... (truncated)

Commits

• aa46413 Prepare 3.3.3 release
• 97268a5 Don't remove hooks if not installed
• 4d492e0 Ignore IndexedDB blocks past the file length
• 891f51c Acquire navigator lock before feature detection
• 4e224c2 Update to SQLite 3.53.2
• b01302e Mention SQLCipher in upgrade notes
• 4ab8f21 Build SQLCipher libraries
• 225d45b Prepare sqlite3_web release 0.9.0
• 243a23f Allow closing WebSqlite instances
• 496ac57 Support package_config versions 3.x
• Additional commits viewable in compare view

[dependabot]

Assignees

The following users could not be added as assignees: famedly/frontend. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

Automated critical-bug review

I reviewed this PR and the recent commits on main for high-severity correctness regressions (data loss, crashes, security holes, user-facing breakage). I did not find a critical bug in the recently merged feature/fix commits (content scanner, skipScanner, SSSS key centralisation, TOFU cross-signing, isValidMatrixIdStrict, thumbnail/sendAgain, ownPowerLevel, VOIP delayed-event canceller) — they are consistent and well covered by tests.

However, this dependency bump itself is not compatible with the SDK as-is and should not be merged without a coordinated migration. sqlite3 3.x is a major release with breaking changes that this repo directly depends on:

1. Won't resolve on the declared SDK floor. sqlite3 3.x requires Dart >=3.10 (pub reports >=3.9.999), but pubspec.yaml declares sdk: ">=3.3.0 <4.0.0". dart pub get therefore fails on the repo's CI toolchain (Dart 3.9.2) and for any downstream consumer on Dart 3.3–3.9:

   Because matrix depends on sqlite3 >=3.0.0-beta.0 which requires SDK version >=3.9.999 <4.0.0, version solving failed.
   

2. Won't compile even on Dart ≥3.10. sqlite3 3.0 removed package:sqlite3/open.dart and open.overrideForAll(...), which lib/src/database/sqflite_encryption_helper/io.dart imports and calls in SQfLiteEncryptionHelper.ffiInit(). Library loading is now done exclusively via build hooks.
3. Breaks at-rest database encryption. sqlite3 3.0 drops the bundled SQLCipher support that SQfLiteEncryptionHelper relies on (it loads libsqlcipher and applies a PRAGMA key). Migrating requires switching to the v3 hooks API plus an alternative such as SQLite3MultipleCiphers.

Recommendation: hold/close this automated bump, or land it as part of a deliberate migration that (a) rewrites SQfLiteEncryptionHelper against the v3 hooks + a supported cipher, and (b) raises the environment: sdk lower bound to >=3.10 — a breaking change that warrants a major version bump. Pinning sqlite3: ^2.x keeps the SDK building across the supported Dart range.

Verified locally: dart pub get --no-example fails with the bumped constraint on Dart 3.9.2 and resolves cleanly when pinned to ^2.x.

  

_{Sent by Cursor Automation: Find critical bugs}

[cursor]

sqlite3 3.x is a breaking major bump that this SDK can't take as-is:

• It requires Dart >=3.10 (pub reports >=3.9.999), but this package declares sdk: ">=3.3.0 <4.0.0" (line 13), so dart pub get fails on CI's Dart 3.9.2 and for consumers on Dart 3.3–3.9.
• It removes package:sqlite3/open.dart / open.overrideForAll, used by lib/src/database/sqflite_encryption_helper/io.dart (SQfLiteEncryptionHelper.ffiInit), so it won't compile.
• It drops bundled SQLCipher, which SQfLiteEncryptionHelper relies on for at-rest DB encryption.

Recommend keeping sqlite3: ^2.x unless this lands with a full v3-hooks migration + an SDK-floor bump.

[dependabot]

Superseded by #2393.