sqlite3-ruby CVE-2026-54620

The flaw is a use-after-free (CWE-416) inside the sqlite3-ruby native C extension (ext/sqlite3/database.c and lib/sqlite3/database.rb). Aggregate functions are registered through Database#create_aggregate, #create_aggregate_handler, or #define_aggregator, and their Ruby handler blocks/objects are retained on the Database object (the "-aggregators" instance variable). When the database is explicitly closed via #close or #discard, the extension released those references and set them to nil, and after a subsequent garbage-collection cycle the underlying aggregator callbacks were freed. A prepared statement that was already open and calls that aggregate still holds pointers to the SQLite aggregate context and callback, so a later Statement#step dereferences the freed aggregator, triggering an invalid memory read and segfault. The fix (PR #711, commit b24e1e6076528b7f95f99acf7a81c70d0004c726) removes the nil-ing of the aggregator reference on close/discard so the Ruby blocks are kept alive for the lifetime of the database object, and adds a regression test (test_step_on_statement_whose_database_was_closed_does_not_use_freed_aggregator). Affected packages per CPE data are pkg:rubygems/sqlite3-ruby and pkg:rubygems/sqlite3; this is a purely in-process Ruby/SQLite integration issue with no SQL injection, protocol, or network component.