Update sqlite3 to 2.9.6

[anthonyoconnorclio]

Why

The gemspec pinned sqlite3 to ~> 1.4, which Overlord flags with two open CVE alerts. 2.9.6 is the first release that fixes both.

Advisory	Severity	Vulnerable	Fixed in	Overlord due date
GHSA-mwm8-39rw-8826: use-after-free in aggregate arguments	Moderate	>= 1.4.0, <= 2.9.5	2.9.6	2026-10-24
CVE-2026-54619 / GHSA-28hh-pr2h-2w89: use-after-free when redefining functions with different arity	Low	<= 2.9.4	2.9.5	2026-09-24 (overdue)

Both can cause a segfault or pass an incorrect value to custom SQLite functions/aggregates. Neither is known to be exploited. sqlite3 is a development dependency only, so it is not shipped with the gem.

Notes for reviewers

Active Record 7.0's SQLite adapter refuses to load sqlite3 2.x (it declares gem "sqlite3", "~> 1.4"), so the activerecord-7.0 appraisal fails with can't activate sqlite3 (~> 1.4), already activated sqlite3-2.9.6.

To handle this, the sqlite3 requirement moves from the gemspec to the Gemfile. A gemspec dependency can't be overridden per appraisal, but a Gemfile entry can. The activerecord-7.0 appraisal now pins sqlite3 ~> 1.4, and everything else uses ~> 2.9, >= 2.9.6.

That means the AR 7.0 test run still uses sqlite3 1.7.x, which is affected by both advisories above. There is no patched 1.x release. This only affects that CI test job. Active Record 7.0 is end-of-life, so dropping that appraisal would remove the last vulnerable sqlite3 usage.

Testing

bundle install
bundle exec appraisal install
bundle exec appraisal rspec

Both appraisals should pass: AR 7.0 resolves sqlite3 1.7.x and AR 7.1 resolves 2.9.6.