master
Were we to choose to integrate the carray() table-valued function into the amalgamation, that integration might look something like this.
Fix a single byte buffer overrun in the approximate_match extension.
Add the anycollseq.c loadable extension in etc/misc
Enforce the 1GiB size limit on appendvfs files. [bugs:/info/2026-07-29T06:29:52Z|Bug 2026-07-29T06:29:52Z]
Always use sqlite3_malloc64() in extensions, where possible.
Fix compilation issue seen with MSVC.
Fix an infinite loop that can occur in the unused, untested, and unsupported ext/misc/btreeinfo.c extension if it is presented with a corrupt database file. [bugs:/forumpost/b43c44cc1c|Bug 2026-05-28T05:41:01Z].
Turn redundant registrations of the cksumvfs extension from a stack overflow into a harmless no-op. [gugs:/info/2026-07-29T06:28:31Z|Bug 2026-07-29T06:28:31Z]
Enhance the (unsupported) closure extension to support 64-bit "depth" values. [bugs:/info/2026-08-02T13:11:13Z|Bug 2026-08-02T13:11:13Z].
Make the (unused, untested, and unsupported) ext/misc/compress.c routines responsive to OOM conditions. [bugs:/info/2026-06-03T08:28:36Z|Bug 2026-06-03T08:28:36Z].
Do not allow ridiculous "columns=N" values in the (unused) csv virtual table in the extensions folder. [bugs:/info/2026-06-14T15:22:47Z|Bug 2026-06-14T15:22:47Z]
Convert the ShellText object in the CLI to use sqlite3_malloc64() rather than plain malloc(). Avoid unnecessary quoting of table names in .dump output and similar. Improved detection of OOM in set_table_name().
Fix unbounded whitespace skip in the decimal extension. [bugs:/info/2026-06-26T10:06:54Z|Bugs 2026-06-26T10:06:54Z]
Take care to avoid trying to compute 0.0/0.0 in the diskused extension. If such a value needs to be displayed, show the result as 0.0. [bugs:/info/2026-08-02T12:48:58Z|Bug 2026-08-02T12:48:58Z]
Block deep recursion in test extension functions test_eval() and eval(). Does not affect deliverable code. [bugs:/info/2026-07-29T06:29:11Z|Bug 2026-07-29T06:29:11Z]
Fix a NULL pointer dereference that can occur when misusing a extension virtual table that was created for testing purposes. [bugs:/info/2026-06-23T05:32:49Z|Bug 2026-06-23T05:32:49Z]
Properly handle errors from the readlink() system call in the fileio.c extension. [bugs:/info/2026-07-05T12:06:32Z|Bug 2026-07-05T12:06:32Z]
Reduce divergence between ext/misc/fossildelta.c, the delta code in ext/rbu/sqlite3rbu.c, and Fossil itself.
In the amatch.c and fuzzer.c extensions (both of which are experimental, for testing purposes only, and are not part of any deliverable) treat NULL inputs as empty strings. [bugs:/info/2026-06-27T19:32:29Z|Bug 2026-06-27T19:32:29Z].
Add new functions ieee754_to_int() and ieee754_from_int() to the ieee754 extension. No changes to the core SQLite.
Fix a harmless compiler warning in the memtrace.c extension.
Fix harmless compiler warnings.
Fix an OOB read in the next_char() function of the "spellfix" extension. The spellfix extension is not a deliverable. [bugs:/info/2026-06-23T05:41:00Z|Bug 2026-06-23T05:41:00Z]
Improved comments clarifying operation of the ext/misc/noop.c testing extension. [bugs:/info/2026-07-29T06:31:22Z|Bug 2026-07-29T06:31:22Z].
Avoid a (harmless) 1-byte OOB read due to malformed inputs in the normalize.c extension. [bugs:/info/2026-07-06T13:02:37Z|Bug 2026-07-06T13:02:37Z]
Add the --pcachetrace option to the CLI.
Use tail recursion on the larger of the two partitions when doing a quicksort as part of the implementation of the median() function, to avoid excess stack usage on pathological inputs. [bugs:/info/2026-06-03T07:26:42Z|Bug 2026-06-03T07:26:42Z].
The prefix_length() function should stop at the first NUL terminator. [bugs:/info/2026-06-03T07:42:00Z|Bug 2026-06-03T07:42:00Z].
Fix negative array index in "testing and debugging uses only" extension qpvtab.c. [bugs:/info/2026-06-03T07:26:26Z|Bug 2026-06-03T07:26:26Z].
Fix harmless compiler warning in the randomjson.c extension.
Improved detection of OOM in the regexp_bytecode() SQLite function (available in debug builds only). [forum:/forumpost/a3a10e1c7b5dd1d2|Forum post a3a10e1c7b5dd1d2].
Comment changes clarifying details of the pointer-type parameter. No changes to code.
Fix the rot13.c extension to be deterministic. Add the noop.c extension.
Make sure local functions in the series.c extension have only file scope. [forum:/info/2026-06-27T20:38:26Z|Forum 2026-06-27T20:38:26Z].
The use of sqlite3_set_clientdata() to limit recursion in [4687e04d948b787c] is incorrect. Fixed here.
Add the "showauth" extension in ext/misc.
Add reference counting to the EditDist3Config object in the spellfix extension. This should prevent possible UAF following OOM as described by [bugs:/info/2026-07-26T07:55:13Z|Bug 2026-07-26T07:55:13Z].
Move the ".output" command into a separate subroutine. Enhance .output so that it is able to capture output in a sqlite3_str object, then compare that captured output we patterns to accomplish tests.
Ensure that all fields of static sqlite3_module objects are explicitly initialized, in order to hush-up nuisance compiler warnings.
In the strdup.c expension, do not invoke memcpy() with a NULL pointer even if the count is zero.
Fix incorrect header comment in the templatevtab.c demo extension. [bugs:/info/2026-08-02T13:49:50Z|Bug 2026-08-02T13:49:50Z]
Minor fixes to tmstmpvfs.c.
Approximately 50 typo fixes, spanning the whole tree, contributed via [forum:006c8fa165083ac3|forum post 006c8fa165083ac3] and individually checked for correctness. Affects only code comments, docs, and a single line of debug output in a test app.
Approximately 100 typo corrections spanning the whole tree, submitted via [forum:0db9827f0464bc33|forum post 0db9827f0464bc33] and individually audited and verified. Affects only code comments, innocuous test strings, error message text in tool (not library) code, and configure-level help text.
Fix a NULL pointer dereference that could occur in the unionvtab virtual table if the configuration SQL returned an SQL NULL value in place of a table name. Bug [bugs:/info/2026-06-23T05:32:49Z | 2026-06-23T05:32:49Z].
Fix the urifuncs.c extension (used for testing and debugging only) so that the sqlite3_filename_database() SQL function and its siblings correctly handle an invalid schema name passed in as the argument.
Fix a possible NULL pointer derefence in the (experimental and untested) uuid.c extension. [bugs:/info/2026-06-04T09:50:59Z|Bug 2026-06-04T09:50:59Z].
Add NULL checks on all sqlite3_vfs_find(0) calls. This is not strictly necessary. There are no vulnerabilities here. However, adding these checks avoids unnecessary static analyzer complaints. [forum:/forumpost/ce1193be15|Forum post ce1193be15].
Turn redundant loads of the experimental vfsstat.c extension from a stack overflow into a harmless no-op. [bugs:/info/2026-07-29T06:28:47Z|Bug 2026-07-29T06:28:47Z].
Fix typo in column name generation logic of the (debugging use only) vtablog.c extension. [bugs:/info/2026-08-02T13:56:56Z|Bug 2026-08-02T13:56:56Z]
Clearly mark the ext/misc/wholenumber.c extension as "testing and debugging use only". Fix a potential integer overflow that can occur if the above warning is ignored. [bugs:/info/2026-06-04T09:40:28Z|Bug 2026-06-04T09:40:28Z].
Remove the clunky test_windirent.h and test_windirent.c files from src/ and replace them with a much cleaner and more compact ext/misc/windirent.h.
Update the header comment on the zipfile extension to state clearly that writes to the ZIP archive are non-transaction. No code changes. [bugs:/info/2026-08-02T14:03:49Z|Bug 2026-08-02T14:03:49Z].
Add bounds checking and error messages and improved comments to the (unused) zorder extension function. [forum:/forumpost/e3f1ede174|Forum post e3f1ede174]