Could you please provide the SQLite version used for the latest release?

[sudheersagar]

Hi, We are on OCI and I have older version of AppRefiner (AppRefiner-2025-10-08) and Oracle Security has asked me to either remove the SQLite or upgrade to SQLite 3.50.2 or later due to security concerns. I removed it, but want to check to see what is the SQLite version used on latest release (AppRefiner 1.1.0)? Thank you!!

Regards
Sudheer

[tim-slater-gt]

Hey Sudheer,

The SQLite used in AppRefiner is reporting SQLite version 3.46.1

Obtained by running this:

            var connection = new SqliteConnection("Data Source=:memory:");
            connection.Open();
            var command = connection.CreateCommand();
            command.CommandText = "SELECT SQLITE_VERSION()";
            var version = (string)command.ExecuteScalar();
            Console.WriteLine($"SQLite Version: {version}");

I just did an update to the library (we use Microsoft.Data.SQLite) and even on the most recent version of it the SQLite version is 3.49.1 (tested the same way).

While this isn't 3.50.2 or higher, taking a look at SQLite CVEs, 3.49.1 is enough to account for all of them except:

[CVE-2025-6965](https://nvd.nist.gov/vuln/detail/CVE-2025-6965) An attacker who can inject arbitrary SQL statements into an application might be able to cause an integer overflow resulting in a read off the end of an array.
Source

AppRefiner's usage of SQLite does not allow for user controlled SQL statements to be executed so I do not think this CVE is applicable.

I will go ahead and update to the latest which uses 3.49.1 and I will keep an eye out for newer updates to this library and update it when one is available.

[tim-slater-gt]

It looks like if I manually install the latest SourceGear.sqlite library, then we get to SQLite version 3.50.4! I'll go ahead with this for the next release (which I'm targeting for the end of this week). The AppRefiner will be using 3.50.4