Update sqlcipher to 4.0.3

package.json

@@ -127,7 +127,7 @@
     "@signalapp/libsignal-client": "0.97.3",
     "@signalapp/mute-state-change": "workspace:*",
     "@signalapp/ringrtc": "2.70.0",
-    "@signalapp/sqlcipher": "3.3.9",
+    "@signalapp/sqlcipher": "4.0.3",
     "@signalapp/types": "workspace:*",
     "@signalapp/windows-ucv": "workspace:*",
     "google-libphonenumber": "3.2.44"

pnpm-lock.yaml

@@ -53,8 +53,8 @@ importers:
         specifier: 2.70.0
         version: 2.70.0
       '@signalapp/sqlcipher':
-        specifier: 3.3.9
-        version: 3.3.9
+        specifier: 4.0.3
+        version: 4.0.3
       '@signalapp/types':
         specifier: workspace:*
         version: link:packages/types
@@ -4487,8 +4487,8 @@ packages:
     resolution: {integrity: sha512-CrDVqvSLqwmkYZA6ZWuhULlr3/MpVcBxGN0rjMOsWOnK4jDkKeYR//7pIAxcXBU/K7w5uMhe1hiRz2WmbRydyA==, tarball: https://registry.npmjs.org/@signalapp/ringrtc/-/ringrtc-2.70.0.tgz}
     hasBin: true
 
-  '@signalapp/sqlcipher@3.3.9':
-    resolution: {integrity: sha512-51NAV0CqIEreGx3r0hq85vjHC8NXZhGr9efywaqHRsjpbEdvdYARmFxObmMI55rjyqE5eLQ/QsPJzigBoQ6thw==, tarball: https://registry.npmjs.org/@signalapp/sqlcipher/-/sqlcipher-3.3.9.tgz}
+  '@signalapp/sqlcipher@4.0.3':
+    resolution: {integrity: sha512-Xp8H+pcOjBacqBh+ohE44gJUJIa/95JqBYWC70A08xhOcqogbnbvweu3gUmyKqNGnVehs7ukeSsuGO6QxdVTVw==, tarball: https://registry.npmjs.org/@signalapp/sqlcipher/-/sqlcipher-4.0.3.tgz}
 
   '@sinclair/typebox@0.27.8':
     resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==, tarball: https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz}
@@ -15287,7 +15287,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@signalapp/sqlcipher@3.3.9':
+  '@signalapp/sqlcipher@4.0.3':
     dependencies:
       node-addon-api: 8.8.0
       node-gyp-build: 4.8.4

pnpm-workspace.yaml

@@ -87,7 +87,7 @@ allowBuilds:
   '@signalapp/libsignal-client@0.92.2': true # duplicate package
   '@signalapp/libsignal-client@0.97.3': true
   '@signalapp/ringrtc@2.69.4': true
-  '@signalapp/sqlcipher@3.3.9': true
+  '@signalapp/sqlcipher@4.0.3': true
   '@signalapp/windows-ucv@1.0.1': true
   '@swc/core@1.10.16': true
   '@tailwindcss/oxide@4.3.0': true

ts/sql/migrations/1750-fts-url.std.ts

@@ -0,0 +1,12 @@
+// Copyright 2026 Signal Messenger, LLC
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import type { WritableDB } from '../Interface.std.ts';
+
+export default function updateToSchemaVersion1750(db: WritableDB): void {
+  // @signalapp/sqlcipher@4.0.2 added support for tokenizing urls so we have
+  // to reindex.
+  db.exec(`
+    INSERT INTO messages_fts(messages_fts) VALUES('rebuild');
+  `);
+}

ts/sql/migrations/index.node.ts

@@ -151,6 +151,7 @@ import updateToSchemaVersion1710 from './1710-emoji-skin-tone-default.std.ts';
 import updateToSchemaVersion1720 from './1720-update-recent-emoji.std.ts';
 import updateToSchemaVersion1730 from './1730-protected-attachments-dedupe-token.std.ts';
 import updateToSchemaVersion1740 from './1740-cleanup-groups.node.ts';
+import updateToSchemaVersion1750 from './1750-fts-url.std.ts';
 
 import { DataWriter } from '../Server.node.ts';
 import { strictAssert } from '../../util/assert.std.ts';
@@ -1665,6 +1666,7 @@ export const SCHEMA_VERSIONS: ReadonlyArray<SchemaUpdateType> = [
   { version: 1720, update: updateToSchemaVersion1720 },
   { version: 1730, update: updateToSchemaVersion1730 },
   { version: 1740, update: updateToSchemaVersion1740 },
+  { version: 1750, update: updateToSchemaVersion1750 },
 ];
 
 class DBVersionFromFutureError extends Error {