Windows and macOS installers require SQLite, but they require different versions! Windows uses 3.21 or 3.14, but macOS uses 3.22.

I'm talking about the following line in PCbuild\get_externals.bat:

   set libraries=%libraries% sqlite-3.21.0.0


* 3.6, 3.7 and master branches:

SQLite[Windows]: 3.21.0.0
SQLite[macOS]: 3.22.0

* 2.7 branch:

SQLite[Windows]: 3.14.2.0
SQLite[macOS]: 3.22.0


Note: I wrote a script to get external dependencies:

https://github.com/vstinner/misc/blob/master/cpython/external_versions.py

First the sqlite branch should be updated in:
https://github.com/python/cpython-source-deps

Then a new tag should be created in this repository.

I tried to update cpython-source-deps, but "git push" never completed. I will retry next week ;-)

With the discovery of the SQLite "Magellan" bug, could the version be  upgraded to 3.26 for all Python versions? As far as I know, the security case is restricted to where the user is allowing aribitrary SQL execution without arbitrary Python execution, but in that case I do believe remote code execution is possible.

https://blade.tencent.com/magellan/index_en.html

SQLite updates and changes for us almost always get stuck on someone being willing to verify that nothing has broken (and stand by their analysis).

Without an active expert (I just nosied ghaering in case they are around), I'm not confident to make this change in any version prior to 3.8.

We should look at doing this for the next set of maintenance updates.  This doesn't appear to be critical enough to delay current releases unless someone can show how this exploit could be used in a typical Python application.

sqlite-3.28.0 now available, with extended window functio support: EXCLUDE clause, GROUPS frame types, window chaining, and support for "<expr> PRECEDING" and "<expr> FOLLOWING" boundaries in RANGE frames.

any hope to have a SQLite refresh in Python-3.8.0b1 for Windows/Mac ?

 It's generally the ideal / less annoying moment to do so.

@Mariatta Wijaya, would you update SQLite?

I want to do it myself, by following your patch in issue28791.
But I find I have to commit SQLite's source code to https://github.com/python/cpython-source-deps, so I think this should be done by a core developer.

any hope for beta2 ?

Has anyone tried building with the newer SQLite and confirmed that the tests and any scenarios they use still work?

We don't currently have a SQLite expert to do these kinds of things.

on my test cases, sqlite_bro and baresql, db.py , it works without problems.

I just pushed sources with tag sqlite-3.28.0.0, so now anybody should be able to submit a CPython PR for it.

PR 14179 is for Windows build
PR 14180 is for Mac OS X build

Both update to Sqlite 3.28.0

2.7 branch:

PR 14182 is for Windows build
PR 14183 is for Mac OS X build

New changeset d8f336fdc10decdd82d3bc81a63aea8be149c0c8 by Ned Deily (animalize) in branch 'master':
bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
https://github.com/python/cpython/commit/d8f336fdc10decdd82d3bc81a63aea8be149c0c8

New changeset 373dace8d7ee5107cb38cd2e4fa5fd67dcad42dd by Ned Deily (animalize) in branch '2.7':
[2.7] bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14183)
https://github.com/python/cpython/commit/373dace8d7ee5107cb38cd2e4fa5fd67dcad42dd

New changeset a7072ff56e216683f949b353255cce099f5cdb24 by Miss Islington (bot) in branch '3.8':
bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
https://github.com/python/cpython/commit/a7072ff56e216683f949b353255cce099f5cdb24

New changeset 624c9a27b10df4355eb2caf04654c730dfa412dd by Miss Islington (bot) in branch '3.7':
bpo-35360: Update macOS installer to use SQLite 3.28.0 (GH-14180)
https://github.com/python/cpython/commit/624c9a27b10df4355eb2caf04654c730dfa412dd

New changeset 7fd2ba354ec2304743ffd9ba620e07d113532264 by Steve Dower (animalize) in branch 'master':
bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
https://github.com/python/cpython/commit/7fd2ba354ec2304743ffd9ba620e07d113532264

New changeset 0fc14b373398767b4323a7bc2c2310b6218c5b74 by Steve Dower (animalize) in branch '2.7':
bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14182)
https://github.com/python/cpython/commit/0fc14b373398767b4323a7bc2c2310b6218c5b74

New changeset dad8f79cfd83b824decb15eac4c0d5723edd4bf1 by Miss Islington (bot) in branch '3.8':
bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
https://github.com/python/cpython/commit/dad8f79cfd83b824decb15eac4c0d5723edd4bf1

New changeset 14c179f97dbb7047cb30e4a610b5d5b531a4f6f7 by Miss Islington (bot) in branch '3.7':
bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
https://github.com/python/cpython/commit/14c179f97dbb7047cb30e4a610b5d5b531a4f6f7

New changeset c58fc3af75b54203b26008b6942709bb07d00fc6 by Ned Deily (Miss Islington (bot)) in branch '3.7':
bpo-35360: Update Windows builds to use SQLite 3.28.0 (GH-14179)
https://github.com/python/cpython/commit/c58fc3af75b54203b26008b6942709bb07d00fc6

there will be a security fix in sqlite-3.30 around October 10th.

https://nvd.nist.gov/vuln/detail/CVE-2019-16168#VulnChangeHistorySection

https://www.sqlite.org/draft/releaselog/3_30_0.html

Please file a new issue