chore: update dependency sqlite3 to v5.1.5 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
sqlite3	5.1.4 -> 5.1.5

GitHub Vulnerability Alerts

CVE-2022-43441

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

• Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

• Commit: TryGhost/node-sqlite3@edb1934

For more information

If you have any questions or comments about this advisory:

• Email us at security@ghost.org

Credits: Dave McDaniel of Cisco Talos

---

Release Notes

TryGhost/node-sqlite3 (sqlite3)

v5.1.5

Compare Source

What's Changed

• 🔒 Fixed code execution vulnerability due to Object coercion by @​daniellockyer
• Updated bundled SQLite to v3.41.1 by @​daniellockyer
• Fixed rpath linker option when using a custom sqlite by @​jeromew in https://github.com/TryGhost/node-sqlite3/pull/1654

Full Changelog: TryGhost/node-sqlite3@v5.1.4...v5.1.5

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[shubhamp-sf]

Merging this would lead to breaking tests as reported here: TryGhost/node-sqlite3#1694

Waiting for explanation from node-sqlite3 maintainers about this, I'll make necessary modification in the tests after that.