 Martin Vogel
|
1d30971ff0
|
Bump vendored deps: Mongoose 7.21, SQLite 3.51.3, mimalloc 3.2.8
Mongoose 7.20 → 7.21:
Fixes 3 CVEs disclosed 2026-04-02:
- CVE-2026-5244: preauth RCE via TLS heap buffer overflow
- CVE-2026-5245: mDNS stack overflow RCE (34-byte UDP packet)
- CVE-2026-5246: mTLS bypass with P-384 certificates
SQLite 3.49.1 → 3.51.3:
Fixes WAL-reset database corruption bug (we use WAL mode).
Also fixes nested EXISTS query errors, POSIX lock deadlock,
and FTS5 memory error.
mimalloc 2.1.9 → 3.2.8 (v2 → v3):
Eliminated thread-local segments for better cross-thread sharing,
lower fragmentation, faster TLS on Windows, improved calloc.
API change: mi_option_eager_commit → mi_option_arena_eager_commit.
Linux kernel benchmark: 1:42 (no regression). All 2718 tests pass.
|
2026-04-03 23:01:06 +02:00 |
|
|
Martin Vogel
|
a1d849aaaa
|
Fix all memory leaks, vendor sqlite3, add Docker test infrastructure
Leak fixes (13 sources, 1.4MB → 0 bytes):
- Cypher: free col_names after rb_set_columns, free rejected inline
prop nodes, store WITH aliases in qualified_name for auto-cleanup
- Store: add cbm_project_free_fields, fix find_node_ids_by_qns leak
- Graph buffer: free strdup'd hash keys during delete operations
- SQL scanner: free old start_tag before reassignment in deserialize
Platform independence:
- Vendor sqlite3 amalgamation (3.49.1) — eliminates system libsqlite3
dependency, enables full ASan/LeakSanitizer instrumentation
- Add -I for vendored tree-sitter unicode headers — eliminates hidden
dependency on system libicu-dev
- Add test-infrastructure/ with Docker Compose for local GCC+ASan
testing that mirrors CI exactly
|
2026-03-18 16:28:27 +01:00 |
|