Raise the minimun version requirement for SQLite to 3.6.8

Are there any security releases in nine years? That would make this more than normal.

This issue is a normal task so we need to outline how it fits within the allowable Drupal 8 beta criteria. Can someone add Drupal 8 beta phase evaluation template to the issue summary.

+++ b/core/lib/Drupal/Core/Database/Driver/sqlite/Delete.php
@@ -10,24 +10,6 @@
 use Drupal\Core\Database\Query\Delete as QueryDelete;
 
 /**
- * SQLite specific implementation of DeleteQuery.
- *
- * When the WHERE is omitted from a DELETE statement and the table being deleted
- * has no triggers, SQLite uses an optimization to erase the entire table content
- * without having to visit each row of the table individually.
- *
- * Prior to SQLite 3.6.5, SQLite does not return the actual number of rows deleted
- * by that optimized "truncate" optimization.
+ * SQLite specific implementation of \Drupal\Core\Database\Query\Delete.
  */
-class Delete extends QueryDelete {
-  public function execute() {
-    if (!count($this->condition)) {
-      $total_rows = $this->connection->query('SELECT COUNT(*) FROM {' . $this->connection->escapeTable($this->table) . '}')->fetchField();
-      parent::execute();
-      return $total_rows;
-    }
-    else {
-      return parent::execute();
-    }
-  }
-}
+class Delete extends QueryDelete { }

Can't we just delete the entire class then?

Seems fine to me. Back to Alex.

Thinking about this I think we shouldn't be in the habit of requiring things we don't need - we had issues with PHPUnit requiring the latest version of PHP for no reason so we shouldn't do the same to other projects. Let's make the requirement 3.6.8 unless there is a compelling reason that we want 3.6.20 - and if there is we should document it. One valid reason to bump it to 3.7.9 might be because that's what DrupalCI will test it on - but that should be in another issue once we have sqlite testing.

Committed 561834c and pushed to 8.0.x. Thanks!

Thanks for adding the beta evaluation to the issue summary.

So, it turns out that there *are* security issues in sqllite, that were fixed in 3.8.9 but they just didn't publicize it *or* provide CVEs

See http://seclists.org/fulldisclosure/2015/Apr/31

So should we bump that far or are the issues identified not worth worrying about?

Hm. 3.8.9 isn't in any of the distros mentioned in the issue summary, so that seems like it'd make it significantly harder for users.

Yeah... so maybe that's back to fixed - just wanted to get @amateescu's opinion.

I think that our minimum dependency should relate to which features we need - not the security status of the release. We might want to recommend that users use 3.8.9 and above though.