Skip to content

fix(deps): bump sqlite3 3.3.0 → 3.3.1 (libsqlite3mc hash mismatch)#572

Closed
TaprootFreak wants to merge 1 commit into
developfrom
fix/sqlite3-upgrade-3-3-1
Closed

fix(deps): bump sqlite3 3.3.0 → 3.3.1 (libsqlite3mc hash mismatch)#572
TaprootFreak wants to merge 1 commit into
developfrom
fix/sqlite3-upgrade-3-3-1

Conversation

@TaprootFreak
Copy link
Copy Markdown
Contributor

Problem

The Release workflow's android-deploy job has been failing since develop@42f4cc2 (run 26394143332):

Bad state: Hash of downloaded file libsqlite3mc.arm.android.so is
ec426ba2…a4a708, expected 92ec0a14…ae9c7d1b.
Building assets for package:sqlite3 failed.
Target dart_build failed: Error: Building native assets failed.
Execution failed for task ':app:compileFlutterBuildRelease'.

The previous release on develop@eaac473 still passed with the same sqlite3 3.3.0 pin — the failure was triggered by an upstream binary update on the SQLite3 Multiple Ciphers CDN, not by anything in the #541 stack. The 3.3.0 package has a hardcoded SHA-256 for the downloaded libsqlite3mc.*.so artifacts; once the served binary changed, every fresh build aborts at the hash check.

Fix

sqlite3 3.3.1 (released 2026-04) bumps the bundled SQLite3 Multiple Ciphers binary to 2.3.3 and re-pins the matching hashes (changelog). Bumping the constraint + re-resolving pubspec.lock realigns our build with what the CDN now serves.

Diff

Exactly 2 files, 3 lines each:

  • pubspec.yaml: sqlite3: ^3.3.0^3.3.1
  • pubspec.lock: regenerated sqlite3 entry (version + sha256)

No other dependency moved (verified with flutter pub get on dfx01, no transitive churn).

Test plan

  • CI on this PR is green (incl. RealUnit Build which exercises flutter pub get and analyze)
  • After merge: next Release run on develop succeeds at android-deploy

The android-deploy step on develop (run 26394143332) failed during
`flutter build appbundle --release` with:

  Bad state: Hash of downloaded file libsqlite3mc.arm.android.so is
  ec426ba2…a4a708, expected 92ec0a14…ae9c7d1b.

sqlite3 3.3.1 bumps the bundled SQLite3 Multiple Ciphers binary to
2.3.3 and re-pins the matching hashes. The 3.3.0 hashes no longer
match what the upstream CDN serves, so every release build aborted
with the mismatch above.

Diff is exactly two lines: pubspec.yaml constraint + the resolved
sqlite3 entry in pubspec.lock.
@TaprootFreak TaprootFreak marked this pull request as ready for review May 25, 2026 10:39
@TaprootFreak
Copy link
Copy Markdown
Contributor Author

Obsolet: Der vermeintliche sqlite3-Hash-Mismatch war ein transienter Network-Glitch beim binary-download auf dem GH-Actions Ubuntu-Runner, kein echter Versionsfehler. Bewiesen durch erfolgreichen Re-run von run 26394143332 ohne jede Code-Änderung. sqlite3 3.3.0 bleibt korrekt — beide Hashes (3.3.0 und 3.3.1) matchen ihre GitHub-Release-Assets exakt; das fehlerhafte 'ec426ba2…' aus dem ersten Lauf war Truncation/Partial-Download (Dart's HttpClient prüft kein Content-Length gegen received bytes).

@TaprootFreak TaprootFreak deleted the fix/sqlite3-upgrade-3-3-1 branch May 25, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant