SQLite 3.37.0 was released a couple of days ago: https://sqlite.org/releaselog/3_37_0.html

Given that 3.11 feature freeze is approx. May 2022, and that it took approx. 5 months between SQLite 3.36.0 and 3.37.0, I'd say we aim for a field tested SQLite 3.37.0 instead of a possibly fresh-out-of-the-box 3.38.0 in 3.11.

Let's wait a couple of weeks before changing the macOS/Windows installers.

SQLite 3.37.1 appeared the day before New Years Eve. So let us wait until the end of January before upgrading the installers.

https://www.sqlite.org/releaselog/3_37_1.html

SQLite 3.37.2 is fresh out now. Copying the release statement from the SQLite forum:

    Patch release 3.37.2 fixes a potential database corruption bug.
    Upgrading is recommended for all users.
    
    The database corruption bug is obscure and you are unlikely to hit it.
    But you should probably still upgrade.  For more information about
    the bug see:
    
     *  https://sqlite.org/forum/forumpost/ac381d64d8


Link to the release page: https://www.sqlite.org/releaselog/3_37_2.html


We should consider backporting to 3.10 and 3.9 due to the severity of the bug.

Quoting the SQLite forum post, regarding backporting:

    There is a bug in versions 3.35.0 (2021-03-12) through 3.37.1 (2021-12-30)
    which could potentially cause database corruption. Upgrading to version
    3.37.2 (2022-01-06) or later is recommended.


The Python 3.10 Windows and macOS installers ship with SQLite 3.36.0, so they are vulnerable to this bug. Ditto for the Python 3.9 Windows and macOS installers which ship with SQLite 3.35.5.

Are we enabling the build option they mention on the release page? Or is 
this only going to affect users who use the pragma?

We should obviously do the upgrade, but that will determine how 
aggressively we ought to be messaging the issue.

As I understand the forum post, you're vulnerable if you use that specific build option (we don't), _or_ if you use the pragma (anyone may do that). So AFAICS, we should upgrade.

We should definitely upgrade, but we probably don't have to trigger a 
fresh release of all branches for it, or make a big fuss about it being 
a special fix. That's all I was trying to establish.

No, I don’t think we need to rush a new release. The scheduled 3.10 and 3.9 releases should do fine.

Can you update the sources repo in the mean time?

> Can you update the sources repo in the mean time?

Done

New changeset db77bcd6092f3c174ae855522411ab83854d65a8 by Kumar Aditya in branch 'main':
bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
https://github.com/python/cpython/commit/db77bcd6092f3c174ae855522411ab83854d65a8

New changeset 4d191fcde426ca0643d961aa18e787103f05fce2 by Steve Dower in branch '3.10':
bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
https://github.com/python/cpython/commit/4d191fcde426ca0643d961aa18e787103f05fce2

New changeset ad9cf2fdd39968b07e04136c8b50f65a4596c087 by Miss Islington (bot) in branch '3.9':
bpo-45925: Update Windows installer to SQLite 3.37.2 (GH-30485)
https://github.com/python/cpython/commit/ad9cf2fdd39968b07e04136c8b50f65a4596c087

New changeset 0e4bef7a7f6f25a6f39755778c73e7026901611f by Kumar Aditya in branch 'main':
bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921)
https://github.com/python/cpython/commit/0e4bef7a7f6f25a6f39755778c73e7026901611f

New changeset 519eb6ad74f946a9aa7676e2d6579a3a765a8b50 by Ned Deily in branch '3.10':
bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) (GH-31057)
https://github.com/python/cpython/commit/519eb6ad74f946a9aa7676e2d6579a3a765a8b50

New changeset a22dd00f2da4f6ff96f58fd8d551f16bdb870c8d by Miss Islington (bot) in branch '3.9':
bpo-45925: Update macOS installer to SQLite 3.37.2 (GH-30921) (GH-31057) (GH-31059)
https://github.com/python/cpython/commit/a22dd00f2da4f6ff96f58fd8d551f16bdb870c8d