zeebo · Oct 16, 2026
@@ -16,8 +16,6 @@ archive_override(
         "//:patches/sqlite/0002-macOS-missing-PATH-fix.patch",
         "//:patches/sqlite/0003-sqlite-complete-early-exit.patch",
         "//:patches/sqlite/0004-authorizer-rename-to-destination-name.patch",
-        "//:patches/sqlite/0005-restrict-internal-functions-to-nested-parse.patch",
-        "//:patches/sqlite/0006-call-authorizer-in-default-column-expressions.patch",
     ],
     remote_file_integrity = {
         "MODULE.bazel": "sha256-y8b6x7BNbvOuFQxzh1vbyJ/1F/RP67Ho3gJUJU3wZeE=",
@@ -26,9 +24,9 @@ archive_override(
     remote_file_urls = {
         "MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/sqlite3/3.53.3/MODULE.bazel"],
     },
-    sha256 = "d18fa15aec74d8c17e1463f861095adc01b5ad190256acb4f91d22f0368d232b",
-    strip_prefix = "sqlite-src-3530400",
-    url = "https://sqlite.org/2026/sqlite-src-3530400.zip",
+    sha256 = "387e7f6cad4797b17848c07d453dc6606917bb356a6cfe5a3abafd38c240c71b",
+    strip_prefix = "sqlite-src-3540100",
+    url = "https://sqlite.org/2026/sqlite-src-3540100.zip",
 )
 
 # rules_android/rules_go are not used by ourselves, but protobuf pulls in outdated versions that are

@@ -1,7 +1,7 @@
 diff -u5 -r sqlite-src-pristine/src/shell.c.in sqlite-src-modified/src/shell.c.in
 --- sqlite-src-pristine/src/shell.c.in	2026-08-19 19:37:52
 +++ sqlite-src-modified/src/shell.c.in	2026-08-19 21:03:33
-@@ -2942,10 +2942,15 @@
+@@ -3573,10 +3573,15 @@
      cli_printf(out,
             "Number of times run:                 %d\n", iCur);
      iCur = sqlite3_stmt_status(pArg->pStmt, SQLITE_STMTSTATUS_MEMUSED, bReset);
@@ -15,8 +15,8 @@ diff -u5 -r sqlite-src-pristine/src/shell.c.in sqlite-src-modified/src/shell.c.i
    }
 
  #ifdef __linux__
-   displayLinuxIoStats(pArg->out);
- #endif
+   if( (pArg->mStats & CLISTAT_IO)!=0 ){
+     displayLinuxIoStats(pArg->out);
 diff -u5 -r sqlite-src-pristine/src/sqlite.h.in sqlite-src-modified/src/sqlite.h.in
 --- sqlite-src-pristine/src/sqlite.h.in	2026-08-19 19:37:52
 +++ sqlite-src-modified/src/sqlite.h.in	2026-08-19 21:02:27

@@ -1,19 +1,33 @@
---- sqlite-src-pristine/src/complete.c	2023-11-01 22:31:37
-+++ sqlite-src-modified/src/complete.c	2024-03-14 12:51:32
-@@ -99,14 +99,21 @@
+--- sqlite-src-pristine/src/complete.c
++++ sqlite-src-modified/src/complete.c
+@@ -54,10 +54,13 @@
+ ** if the entire string ends with ";" and possibly with ";END;" if the
+ ** string is a CREATE TRIGGER statement.  A non-zero return indicates
+ ** that the string is empty or incomplete.  Bits of the return value
+ ** indicate what is missing and is needed to close out the statement.
+ **
++** If firstOnly is true, stop after the first complete statement.
++** If pLength is not NULL, store the number of bytes consumed in it.
++**
+ ** Special handling is require for CREATE TRIGGER statements.
+ ** Whenever the CREATE TRIGGER keywords are seen, the statement
+ ** must end with ";END;".
+ **
+ ** Let the return code be a value R.  R is split up into various
+@@ -139,16 +142,21 @@
  **
  ** If we compile with SQLITE_OMIT_TRIGGER, all of the computation needed
  ** to recognize the end of a trigger can be omitted.  All we have to do
  ** is look for a semicolon that is not part of an string or comment.
  */
--int sqlite3_complete(const char *zSql){
-+int sqlite3_complete(const char *zSql) {
-+    return sqlite3_complete_length(zSql, 0) != 0;
-+}
-+
-+int sqlite3_complete_length(const char *zSql, int firstOnly){
+-sqlite3_int64 sqlite3_incomplete(const char *zSql){
++static sqlite3_int64 sqlite3Incomplete(
++  const char *zSql, int firstOnly, int *pLength
++){
    u8 state = 0;   /* Current state, using numbers defined in header comment */
    u8 token;       /* Value of the next token */
+   u8 pending = 0; /* unmatched structure character */
+   int nParen = 0; /* Nested parentheses */
 
 +  /* Store the original pointer for later index calculations */
 +  const char *initialZSql = zSql;
@@ -23,32 +37,49 @@
    ** statement.  This is the normal case.
    */
    static const u8 trans[8][8] = {
-@@ -254,12 +261,16 @@
+@@ -328,22 +336,35 @@
          break;
        }
      }
      state = trans[state][token];
      zSql++;
 +
-+    // Once we have found a single complete statement, return its length
-+    if (firstOnly && state==1) return zSql - initialZSql;
++    // Once we have found a single complete statement, stop scanning
++    if( firstOnly && state==1 ) break;
    }
--  return state==1;
-+  // Otherwise only return the length if the entire input is valid
-+  return state==1 ? zSql - initialZSql : 0;
+ incomplete_finish:
++  if( pLength ) *pLength = zSql - initialZSql;
+   if( state==0 && pending==0 ) return SQLITE_EMPTY;
+   if( state==1 ) nParen = 0;
+   return (i64)((((u64)nParen)<<32) |
+                ((u64)pending<<16) |
+                ((u64)statemap[state]<<8) |
+                (state>1 || pending!=0));
  }
++sqlite3_int64 sqlite3_incomplete(const char *zSql){
++  return sqlite3Incomplete(zSql, 0, 0);
++}
+ int sqlite3_complete(const char *zSql){
+   return sqlite3_incomplete(zSql)==0;
+ }
++int sqlite3_complete_length(const char *zSql, int firstOnly){
++  int length = 0;
++  sqlite3_int64 incomplete = sqlite3Incomplete(zSql, firstOnly, &length);
++  // Only return the length if the requested input is complete
++  return incomplete==0 ? length : 0;
++}
 
  #ifndef SQLITE_OMIT_UTF16
  /*
  ** This routine is the same as the sqlite3_complete() routine described
-diff -u5 -r sqlite-src-pristine/src/sqlite.h.in sqlite-src-modified/src/sqlite.h.in
---- sqlite-src-pristine/src/sqlite.h.in	2023-11-01 22:31:37
-+++ sqlite-src-modified/src/sqlite.h.in	2024-03-12 12:48:37
-@@ -2775,10 +2775,14 @@
- ** UTF-16 string in native byte order.
+ ** above, except that the parameter is required to be UTF-16 encoded, not
+--- sqlite-src-pristine/src/sqlite.h.in
++++ sqlite-src-modified/src/sqlite.h.in
+@@ -3004,10 +3004,14 @@
  */
  int sqlite3_complete(const char *sql);
  int sqlite3_complete16(const void *sql);
+ sqlite3_int64 sqlite3_incomplete(const char *sql);
 
 +// workerd addition: measure the length of the first (or all) complete
 +// statements in the input.