chore(deps): Bump sqlite3 from 2.9.5 to 2.9.6

[dependabot]

Bumps sqlite3 from 2.9.5 to 2.9.6.

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)