DeadBolt 2.0.2 — bundled SQLite security update

Security update

DeadBolt 2.0.2 updates bundled SQLite to 3.54.1 via rusqlite 0.41.1 / libsqlite3-sys 0.39.1, addressing RUSTSEC-2026-0459 / CVE-2026-119375. Opening a crafted database/WAL pair could disclose uninitialized memory. File permissions reduce who can supply state; they do not replace this library fix. No audit ignore was added.

Source revision: 7d130e882d03b9ba82556fb072f646d4191bbe8a. All 30 main-branch checks passed, including four native targets, upgrade acceptance, Hermes and provenance. Rust source builds now require 1.89+. No persisted-schema or authorization behavior change is intended. Keep normal stopped-writer backup/recovery procedures; do not discard WAL files to work around the issue.

Downloads and verification

Select the native ZIP matching your platform. The two Mac ZIPs are Developer ID signed and Apple notarized; strict signatures, notarization log hashes/CDHashes, version, drill and eleven-case evaluation passed on this Mac for both architectures. Linux and Windows ZIPs are CI builds with verified GitHub provenance. SHA256SUMS and per-archive checksums accompany the exact final bytes.

Mac notarization submissions: ARM64 5e1c6d5f-f986-4f7b-833a-969e6875659a; Intel 3851d179-0dfd-45a3-a90d-4d89a7f2ef78. Both Accepted with no issues. See SIGNING-NOTARIZATION.json and the Apple logs.

The *-CI-PROVENANCE.json and attestation files authenticate the original unsigned CI ZIPs. Signing changes Mac ZIP bytes, so those CI receipts do not attest the final signed Mac ZIPs. Developer ID, Apple logs and final checksums cover those final Mac downloads. Origin evidence is not a security certification.

Extract, verify checksum, then run deadbolt --version (2.0.2) and deadbolt drill. Scope remains admission at integrated dispatch points, not an OS sandbox. The separate TCP listener-authentication concern is not addressed by this SQLite update.

Separate distribution status

This release provides native downloads and matching Python wheel/sdist assets. Python assets contain no engine; the sidecar must be upgraded separately. Cargo/PyPI registry publication, MCP bundle/registry, Claude/Cursor copies, Docker source pin and Homebrew updates are separate delivery steps and are not claimed complete here. Existing installed copies do not update automatically. Earlier releases retain their original immutable bytes.