How to fix the CVE from integrated upstream sqlite 3.30.1

[sjlombardo]

Hello @WenYuLuo - this thread includes one option for patching / updating, but please note the risks involved:

SQLCipher & SQLite update

Hello @GJRTimmer - In that case, one option would be to take a diff between the current upstream SQLite 3.20.1 source tree and the new SQLite 3.21.0 source tree. Then take the results of that diff and apply it to the SQLCipher 3.4.2 sources, resolve any merge failures, etc. You could then build and run the crypto.test locally to perform some basic validation and do your own testing as needed. For clarity, this is not the approach we use internally, but would probably yield similar results. Again…