From 88dd0c3370fd37b2c7900d0a7de93ea9f55a8c11 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Fri, 8 Aug 2025 14:13:40 -0400
Subject: [PATCH 01/11] Converts log output to UTF-16 when writing to stdout or
 stderr on Windows

---
 src/sqlcipher.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 4 deletions(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 884f7bb4f..1c558a526 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -2266,6 +2266,43 @@ static int sqlcipher_codec_add_random(codec_ctx *ctx, const char *zRight, int ra
   return SQLITE_ERROR;
 }
 
+#if defined(_WIN32)
+/* On windows convert to utf-16 when writing to stderr or stdout to avoid
+ * a potential exception when writing mixed context to those streams
+ * when using the shell. */
+static int sqlcipher_fprintf(FILE* stream, const char* format, ...) {
+  int sz;
+  va_list ap;
+
+  if (stream == stderr || stream == stdout) {
+    char* buffer = NULL;
+    wchar_t* wbuffer = NULL;
+
+    va_start(ap, format);
+    buffer = sqlite3_vmprintf(format, ap);
+    va_end(ap);
+    sz = (int)strlen(buffer);
+
+    wbuffer = sqlite3_malloc((sz + 1) * sizeof(wchar_t));
+    if (wbuffer == NULL) return NULL;
+
+    sz = MultiByteToWideChar(CP_UTF8, 0, buffer, sz, wbuffer, sz);
+    wbuffer[sz] = NULL;
+    fputws(wbuffer, stream);
+
+    sqlite3_free(wbuffer);
+    sqlite3_free(buffer);
+  } else {
+    va_start(ap, format);
+    sz = vfprintf(stream, format, ap);
+    va_end(ap);
+  }
+  return sz;
+}
+#else
+#define sqlcipher_fprintf fprintf
+#endif
+
 #if !defined(SQLITE_OMIT_TRACE)
 
 #define SQLCIPHER_PROFILE_FMT        "Elapsed time:%.3f ms - %s\n"
@@ -2283,7 +2320,7 @@ static int sqlcipher_profile_callback(unsigned int trace, void *file, void *stmt
 #endif
 #endif
   } else {
-    fprintf(f, SQLCIPHER_PROFILE_FMT, elapsed, sqlite3_sql((sqlite3_stmt*)stmt));
+    sqlcipher_fprintf(f, SQLCIPHER_PROFILE_FMT, elapsed, sqlite3_sql((sqlite3_stmt*)stmt));
   }
   return SQLITE_OK;
 }
@@ -2387,8 +2424,9 @@ void sqlcipher_log(unsigned int level, unsigned int source, const char *message,
 
 #ifdef CODEC_DEBUG
 #if defined(SQLCIPHER_OMIT_LOG_DEVICE) || (!defined(__ANDROID__) && !defined(__APPLE__))
-    vfprintf(stderr, message, params);
-    fprintf(stderr, "\n");
+    sqlite3_vsnprintf(MAX_LOG_LEN, formatted, message, params);
+    sqlcipher_fprintf(stderr, formatted);
+    sqlcipher_fprintf(stderr, "\n");
     goto end;
 #else
 #if defined(__ANDROID__)
@@ -2447,7 +2485,7 @@ void sqlcipher_log(unsigned int level, unsigned int source, const char *message,
     localtime_r(&sec, &tt);
 #endif
     if(strftime(buffer, sizeof(buffer), "%Y-%m-%d %H:%M:%S", &tt)) {
-      fprintf((FILE*)sqlcipher_log_file, "%s.%03d: %s\n", buffer, ms, formatted);
+      sqlcipher_fprintf((FILE*)sqlcipher_log_file, "%s.%03d: %s\n", buffer, ms, formatted);
       goto end;
     }
   }

From aad96d9cb7cf02edd4e0a4ea15e0ef5fb43edd1b Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Tue, 12 Aug 2025 09:53:34 -0400
Subject: [PATCH 02/11] Relocates defines for SQLCIPHER_EN/DECRYPT to
 sqlcipher.h for non-amalgamation builds

---
 src/crypto_cc.c          |  2 +-
 src/crypto_libtomcrypt.c |  2 +-
 src/crypto_nss.c         |  2 +-
 src/sqlcipher.c          | 15 ++++++---------
 src/sqlcipher.h          |  3 +++
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/crypto_cc.c b/src/crypto_cc.c
index 8c1963a2a..37669cb46 100644
--- a/src/crypto_cc.c
+++ b/src/crypto_cc.c
@@ -139,7 +139,7 @@ static int sqlcipher_cc_cipher(
 ) {
   CCCryptorRef cryptor;
   size_t tmp_csz, csz;
-  CCOperation op = mode == CIPHER_ENCRYPT ? kCCEncrypt : kCCDecrypt;
+  CCOperation op = mode == SQLCIPHER_ENCRYPT ? kCCEncrypt : kCCDecrypt;
 
   if(CCCryptorCreate(op, kCCAlgorithmAES128, 0, key, kCCKeySizeAES256, iv, &cryptor) != kCCSuccess) return SQLITE_ERROR;
   if(CCCryptorUpdate(cryptor, in, in_sz, out, in_sz, &tmp_csz) != kCCSuccess) return SQLITE_ERROR;
diff --git a/src/crypto_libtomcrypt.c b/src/crypto_libtomcrypt.c
index 9a9bb17b7..b648faa7c 100644
--- a/src/crypto_libtomcrypt.c
+++ b/src/crypto_libtomcrypt.c
@@ -232,7 +232,7 @@ static int sqlcipher_ltc_cipher(
 
   if((cipher_idx = find_cipher(LTC_CIPHER)) == -1) return SQLITE_ERROR;
   if((rc = cbc_start(cipher_idx, iv, key, key_sz, 0, &cbc)) != CRYPT_OK) return SQLITE_ERROR;
-  rc = mode == 1 ? cbc_encrypt(in, out, in_sz, &cbc) : cbc_decrypt(in, out, in_sz, &cbc);
+  rc = mode == SQLCIPHER_ENCRYPT ? cbc_encrypt(in, out, in_sz, &cbc) : cbc_decrypt(in, out, in_sz, &cbc);
   if(rc != CRYPT_OK) return SQLITE_ERROR;
   cbc_done(&cbc);
   return SQLITE_OK;
diff --git a/src/crypto_nss.c b/src/crypto_nss.c
index c0fd9dbdb..e3555bb66 100644
--- a/src/crypto_nss.c
+++ b/src/crypto_nss.c
@@ -265,7 +265,7 @@ static int sqlcipher_nss_cipher(
                              CKA_ENCRYPT, &keyItem, NULL);
   if (symKey == NULL) goto error;
   SECStatus rv;
-  if (mode == CIPHER_ENCRYPT) {
+  if (mode == SQLCIPHER_ENCRYPT) {
     rv = PK11_Encrypt(symKey, CKM_AES_CBC, &params, out, &outLen,
                       in_sz + 16, in, in_sz);
   } else {
diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 1c558a526..3d0acd8c0 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -106,9 +106,6 @@ void sqlite3pager_reset(Pager *pPager);
 #define CIPHER_VERSION_BUILD community
 #endif
 
-#define CIPHER_DECRYPT 0
-#define CIPHER_ENCRYPT 1
-
 #define CIPHER_READ_CTX 0
 #define CIPHER_WRITE_CTX 1
 #define CIPHER_READWRITE_CTX 2
@@ -1673,14 +1670,14 @@ static int sqlcipher_page_cipher(codec_ctx *ctx, int for_ctx, Pgno pgno, int mod
     goto error;
   } 
 
-  if(mode == CIPHER_ENCRYPT) {
+  if(mode == SQLCIPHER_ENCRYPT) {
     /* start at front of the reserve block, write random data to the end */
     if(ctx->provider->random(ctx->provider_ctx, iv_out, ctx->reserve_sz) != SQLITE_OK) goto error;
-  } else { /* CIPHER_DECRYPT */
+  } else { /* SQLCIPHER_DECRYPT */
     memcpy(iv_out, iv_in, ctx->iv_sz); /* copy the iv from the input to output buffer */
   } 
 
-  if(SQLCIPHER_FLAG_GET(ctx->flags, CIPHER_FLAG_HMAC) && (mode == CIPHER_DECRYPT)) {
+  if(SQLCIPHER_FLAG_GET(ctx->flags, CIPHER_FLAG_HMAC) && (mode == SQLCIPHER_DECRYPT)) {
     if(sqlcipher_page_hmac(ctx, c_ctx, pgno, in, size + ctx->iv_sz, hmac_out) != SQLITE_OK) {
       sqlcipher_log(SQLCIPHER_LOG_ERROR, SQLCIPHER_LOG_CORE, "%s: hmac operation on decrypt failed for pgno=%d", __func__, pgno);
       goto error;
@@ -1715,7 +1712,7 @@ static int sqlcipher_page_cipher(codec_ctx *ctx, int for_ctx, Pgno pgno, int mod
     goto error;
   };
  
-  if(SQLCIPHER_FLAG_GET(ctx->flags, CIPHER_FLAG_HMAC) && (mode == CIPHER_ENCRYPT)) {
+  if(SQLCIPHER_FLAG_GET(ctx->flags, CIPHER_FLAG_HMAC) && (mode == SQLCIPHER_ENCRYPT)) {
     if(sqlcipher_page_hmac(ctx, c_ctx, pgno, out_start, size + ctx->iv_sz, hmac_out) != SQLITE_OK) {
       sqlcipher_log(SQLCIPHER_LOG_ERROR, SQLCIPHER_LOG_CORE, "%s: hmac operation on encrypt failed for pgno=%d", __func__, pgno);
       goto error;
@@ -3268,7 +3265,7 @@ static void* sqlite3Codec(void *iCtx, void *data, Pgno pgno, int mode) {
       if(pgno == 1) /* copy initial part of file header or SQLite magic to buffer */ 
         memcpy(ctx->buffer, ctx->plaintext_header_sz ? pData : (void *) SQLITE_FILE_HEADER, offset); 
 
-      rc = sqlcipher_page_cipher(ctx, cctx, pgno, CIPHER_DECRYPT, ctx->page_sz - offset, pData + offset, (unsigned char*)ctx->buffer + offset);
+      rc = sqlcipher_page_cipher(ctx, cctx, pgno, SQLCIPHER_DECRYPT, ctx->page_sz - offset, pData + offset, (unsigned char*)ctx->buffer + offset);
 #ifdef SQLCIPHER_TEST
       if((cipher_test_flags & TEST_FAIL_DECRYPT) > 0 && sqlcipher_get_test_fail()) {
         rc = SQLITE_ERROR;
@@ -3309,7 +3306,7 @@ static void* sqlite3Codec(void *iCtx, void *data, Pgno pgno, int mode) {
         }
         memcpy(ctx->buffer, ctx->plaintext_header_sz ? pData : kdf_salt, offset);
       }
-      rc = sqlcipher_page_cipher(ctx, cctx, pgno, CIPHER_ENCRYPT, ctx->page_sz - offset, pData + offset, (unsigned char*)ctx->buffer + offset);
+      rc = sqlcipher_page_cipher(ctx, cctx, pgno, SQLCIPHER_ENCRYPT, ctx->page_sz - offset, pData + offset, (unsigned char*)ctx->buffer + offset);
 #ifdef SQLCIPHER_TEST
       if((cipher_test_flags & TEST_FAIL_ENCRYPT) > 0 && sqlcipher_get_test_fail()) {
         rc = SQLITE_ERROR;
diff --git a/src/sqlcipher.h b/src/sqlcipher.h
index 40416cb53..6fe600f28 100644
--- a/src/sqlcipher.h
+++ b/src/sqlcipher.h
@@ -37,6 +37,9 @@
 
 #include "sqlite3.h"
 
+#define SQLCIPHER_DECRYPT 0
+#define SQLCIPHER_ENCRYPT 1
+
 #define SQLCIPHER_HMAC_SHA1 0
 #define SQLCIPHER_HMAC_SHA1_LABEL "HMAC_SHA1"
 #define SQLCIPHER_HMAC_SHA256 1

From c89bab0b416163efd998d7c65846bbe15514499f Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Tue, 12 Aug 2025 10:04:46 -0400
Subject: [PATCH 03/11] Fixes call to provider free_ctx to pass **

---
 src/sqlcipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 3d0acd8c0..40f755799 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -550,7 +550,7 @@ int sqlcipher_extra_init(const char* arg) {
     }
   }
 
-  default_provider->ctx_free(provider_ctx);
+  default_provider->ctx_free(&provider_ctx);
 
   sqlcipher_init = 1;
   sqlcipher_shutdown = 0;

From e3ee52a711a0c998056c7e7fdec5296e91e13c91 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Thu, 14 Aug 2025 14:47:30 -0400
Subject: [PATCH 04/11] Relocates includes to support non-amalgamated builds

---
 src/sqlcipher.c | 8 +++-----
 src/sqlcipher.h | 1 +
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 40f755799..292ce7907 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -31,11 +31,6 @@
 /* BEGIN SQLCIPHER */
 #ifdef SQLITE_HAS_CODEC
 
-#include "sqliteInt.h"
-#include "btreeInt.h"
-#include "pager.h"
-#include "vdbeInt.h"
-
 #if !defined(SQLCIPHER_OMIT_LOG_DEVICE)
 #if defined(__ANDROID__)
 #include <android/log.h>
@@ -64,6 +59,9 @@
 
 #include <assert.h>
 #include "sqlcipher.h"
+#include "btreeInt.h"
+#include "pager.h"
+#include "vdbeInt.h"
 
 #if !defined(SQLITE_EXTRA_INIT) || !defined(SQLITE_EXTRA_SHUTDOWN)
 #error "SQLCipher must be compiled with -DSQLITE_EXTRA_INIT=sqlcipher_extra_init -DSQLITE_EXTRA_SHUTDOWN=sqlcipher_extra_shutdown"
diff --git a/src/sqlcipher.h b/src/sqlcipher.h
index 6fe600f28..de25d0b1f 100644
--- a/src/sqlcipher.h
+++ b/src/sqlcipher.h
@@ -36,6 +36,7 @@
 #define SQLCIPHER_H
 
 #include "sqlite3.h"
+#include "sqliteInt.h"
 
 #define SQLCIPHER_DECRYPT 0
 #define SQLCIPHER_ENCRYPT 1

From cd8909864d9421f3dfb33afebeb873c035112694 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Wed, 20 Aug 2025 12:34:36 -0400
Subject: [PATCH 05/11] Updates version to 4.11.0

---
 CHANGELOG.md                | 2 ++
 src/sqlcipher.c             | 2 +-
 test/sqlcipher-pragmas.test | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f10939324..b33b61903 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 Notable changes to this project are documented in this file.
 
 ## [4.11.0] - (? 2025 - [4.11.0 changes])
+- Converts log output to UTF-16 when writing to stdout or stderr on Windows
+- Fixes scope issues to allow --disable-amalgamation to work properly
 
 ## [4.10.0] - (August 2025 - [4.10.0 changes])
 - Updates baseline to SQLite 3.50.4
diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 292ce7907..ec1e39eae 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -97,7 +97,7 @@ void sqlite3pager_reset(Pager *pPager);
 #define CIPHER_STR(s) #s
 
 #ifndef CIPHER_VERSION_NUMBER
-#define CIPHER_VERSION_NUMBER 4.10.0
+#define CIPHER_VERSION_NUMBER 4.11.0
 #endif
 
 #ifndef CIPHER_VERSION_BUILD
diff --git a/test/sqlcipher-pragmas.test b/test/sqlcipher-pragmas.test
index 5a0a00006..ae03bf676 100644
--- a/test/sqlcipher-pragmas.test
+++ b/test/sqlcipher-pragmas.test
@@ -46,7 +46,7 @@ do_test verify-pragma-cipher-version {
     execsql {
         PRAGMA cipher_version;
     }
-} {{4.10.0 community}}
+} {{4.11.0 community}}
 db close
 file delete -force test.db
 

From ea37f3d271146eec5a7a2e5439922a6b46244c88 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Wed, 20 Aug 2025 12:35:28 -0400
Subject: [PATCH 06/11] Removes CocoaPod support (SQLCipher.podspec.json)

---
 CHANGELOG.md           |   1 +
 SQLCipher.podspec.json | 100 -----------------------------------------
 2 files changed, 1 insertion(+), 100 deletions(-)
 delete mode 100644 SQLCipher.podspec.json

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b33b61903..e1b86fea0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ Notable changes to this project are documented in this file.
 ## [4.11.0] - (? 2025 - [4.11.0 changes])
 - Converts log output to UTF-16 when writing to stdout or stderr on Windows
 - Fixes scope issues to allow --disable-amalgamation to work properly
+- Removes CocoaPods support (SQLCipher.podspec.json)
 
 ## [4.10.0] - (August 2025 - [4.10.0 changes])
 - Updates baseline to SQLite 3.50.4
diff --git a/SQLCipher.podspec.json b/SQLCipher.podspec.json
deleted file mode 100644
index 343ca965b..000000000
--- a/SQLCipher.podspec.json
+++ /dev/null
@@ -1,100 +0,0 @@
-{
-  "authors": "Zetetic LLC",
-  "default_subspecs": "standard",
-  "description": "SQLCipher is an open source extension to SQLite that provides transparent 256-bit AES encryption of database files.",
-  "homepage": "https://www.zetetic.net/sqlcipher/",
-  "license": {
-    "type": "BSD-3-Clause",
-    "file": "LICENSE.txt"
-  },
-  "name": "SQLCipher",
-  "platforms": {
-    "ios": "12.0",
-    "osx": "10.13",
-    "tvos": "12.0",
-    "watchos": "7.0"
-  },
-  "prepare_command": "./configure && make sqlite3.c",
-  "requires_arc": false,
-  "source": {
-    "git": "https://github.com/sqlcipher/sqlcipher.git",
-    "tag": "v4.10.0"
-  },
-  "summary": "Full Database Encryption for SQLite.",
-  "version": "4.10.0",
-  "subspecs": [
-    {
-      "compiler_flags": [
-        "-DNDEBUG",
-        "-DSQLITE_HAS_CODEC",
-        "-DSQLITE_TEMP_STORE=2",
-        "-DSQLITE_SOUNDEX",
-        "-DSQLITE_THREADSAFE",
-        "-DSQLITE_ENABLE_RTREE",
-        "-DSQLITE_ENABLE_STAT3",
-        "-DSQLITE_ENABLE_STAT4",
-        "-DSQLITE_ENABLE_COLUMN_METADATA",
-        "-DSQLITE_ENABLE_MEMORY_MANAGEMENT",
-        "-DSQLITE_ENABLE_LOAD_EXTENSION",
-        "-DSQLITE_ENABLE_FTS4",
-        "-DSQLITE_ENABLE_FTS4_UNICODE61",
-        "-DSQLITE_ENABLE_FTS3_PARENTHESIS",
-        "-DSQLITE_ENABLE_UNLOCK_NOTIFY",
-        "-DSQLITE_ENABLE_JSON1",
-        "-DSQLITE_ENABLE_FTS5",
-        "-DSQLCIPHER_CRYPTO_CC",
-        "-DHAVE_USLEEP=1",
-        "-DSQLITE_MAX_VARIABLE_NUMBER=99999",
-        "-DSQLITE_EXTRA_INIT=sqlcipher_extra_init",
-        "-DSQLITE_EXTRA_SHUTDOWN=sqlcipher_extra_shutdown"
-      ],
-      "frameworks": [
-        "Foundation",
-        "Security"
-      ],
-      "name": "common",
-      "source_files": "sqlite3.{h,c}",
-      "resource_bundles": {"SQLCipher": ["sqlcipher-resources/PrivacyInfo.xcprivacy"]},
-      "xcconfig": {
-        "HEADER_SEARCH_PATHS": "$(PODS_ROOT)/SQLCipher",
-        "GCC_PREPROCESSOR_DEFINITIONS": "SQLITE_HAS_CODEC=1",
-        "OTHER_CFLAGS": "$(inherited) -DSQLITE_HAS_CODEC -DSQLITE_TEMP_STORE=2 -DSQLITE_SOUNDEX -DSQLITE_THREADSAFE -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_STAT3 -DSQLITE_ENABLE_STAT4 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_MEMORY_MANAGEMENT -DSQLITE_ENABLE_LOAD_EXTENSION -DSQLITE_ENABLE_FTS4 -DSQLITE_ENABLE_FTS4_UNICODE61 -DSQLITE_ENABLE_FTS3_PARENTHESIS -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_JSON1 -DSQLITE_ENABLE_FTS5 -DSQLCIPHER_CRYPTO_CC -DHAVE_USLEEP=1 -DSQLITE_MAX_VARIABLE_NUMBER=99999 -DSQLITE_EXTRA_INIT=sqlcipher_extra_init -DSQLITE_EXTRA_SHUTDOWN=sqlcipher_extra_shutdown"
-      },
-      "user_target_xcconfig": {
-          "GCC_PREPROCESSOR_DEFINITIONS": "_SQLITE3_H_=1 _FTS5_H=1 _SQLITE3RTREE_H_=1"
-      }
-    },
-    {
-      "dependencies": {
-        "SQLCipher/common": [
-
-        ]
-      },
-      "name": "standard"
-    },
-    {
-      "compiler_flags": "",
-      "dependencies": {
-        "SQLCipher/common": [
-
-        ]
-      },
-      "name": "fts",
-      "xcconfig": {
-        "OTHER_CFLAGS": "$(inherited)"
-      }
-    },
-    {
-      "compiler_flags": "",
-      "dependencies": {
-        "SQLCipher/common": [
-
-        ]
-      },
-      "name": "unlock_notify",
-      "xcconfig": {
-        "OTHER_CFLAGS": "$(inherited)"
-      }
-    }
-  ]
-}

From 7dbc295e6852d123b8c36f6cade2fbd5342349ca Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Thu, 21 Aug 2025 21:51:36 -0400
Subject: [PATCH 07/11] Replaces fortuna seeding mechanism for libtomcrypt with
 rng_get_bytes()

---
 CHANGELOG.md             | 1 +
 src/crypto_libtomcrypt.c | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1b86fea0..ca9b45a15 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@ Notable changes to this project are documented in this file.
 ## [4.11.0] - (? 2025 - [4.11.0 changes])
 - Converts log output to UTF-16 when writing to stdout or stderr on Windows
 - Fixes scope issues to allow --disable-amalgamation to work properly
+- Replaces fortuna seeding mechanism for libtomcrypt with rng_get_bytes()
 - Removes CocoaPods support (SQLCipher.podspec.json)
 
 ## [4.10.0] - (August 2025 - [4.10.0 changes])
diff --git a/src/crypto_libtomcrypt.c b/src/crypto_libtomcrypt.c
index b648faa7c..c8ee378d3 100644
--- a/src/crypto_libtomcrypt.c
+++ b/src/crypto_libtomcrypt.c
@@ -73,6 +73,7 @@ static int sqlcipher_ltc_add_random(void *ctx, const void *buffer, int length) {
 
 static int sqlcipher_ltc_activate(void *ctx) {
   unsigned char random_buffer[FORTUNA_MAX_SZ];
+  int bytes = 0;
 
   sqlcipher_log(SQLCIPHER_LOG_TRACE, SQLCIPHER_LOG_MUTEX, "sqlcipher_ltc_activate: entering SQLCIPHER_MUTEX_PROVIDER_ACTIVATE");
   sqlite3_mutex_enter(sqlcipher_mutex(SQLCIPHER_MUTEX_PROVIDER_ACTIVATE));
@@ -94,8 +95,9 @@ static int sqlcipher_ltc_activate(void *ctx) {
   ltc_ref_count++;
 
 #ifndef SQLCIPHER_TEST
-  sqlite3_randomness(FORTUNA_MAX_SZ, random_buffer);
+  bytes = rng_get_bytes(random_buffer, FORTUNA_MAX_SZ, NULL);
 #endif
+  sqlcipher_log(SQLCIPHER_LOG_TRACE, SQLCIPHER_LOG_PROVIDER, "sqlcipher_ltc_activate: seeded fortuna with %d bytes from rng_get_bytes", bytes);
 
   if(sqlcipher_ltc_add_random(ctx, random_buffer, FORTUNA_MAX_SZ) != SQLITE_OK) {
     return SQLITE_ERROR;

From d16327695d8f9795bc0254d30565d53fe29f5687 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Mon, 25 Aug 2025 14:40:17 -0400
Subject: [PATCH 08/11] Fixes several compiler warnings

---
 src/sqlcipher.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index ec1e39eae..0424828ce 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -475,11 +475,11 @@ int sqlcipher_extra_init(const char* arg) {
     while(private_heap_sz >= SQLCIPHER_PRIVATE_HEAP_SIZE_STEP) {
       /* attempt to allocate the private heap. If allocation fails, reduce the size and try again */
       if((private_heap = sqlcipher_internal_malloc(private_heap_sz))) {
-        xoshiro_randomness(private_heap, private_heap_sz);
+        xoshiro_randomness(private_heap, (int) private_heap_sz);
         /* initialize the head block of the linked list at the start of the heap */ 
         private_block *head = (private_block *) private_heap; 
         head->is_used = 0;
-        head->size = private_heap_sz - sizeof(private_block);
+        head->size = (u32) private_heap_sz - sizeof(private_block);
         head->next = NULL;
         break;
       }
@@ -542,7 +542,7 @@ int sqlcipher_extra_init(const char* arg) {
       sqlcipher_log(SQLCIPHER_LOG_ERROR, SQLCIPHER_LOG_MEMORY, "%s: failed to allocate shield mask", __func__); 
       goto error; 
     }
-    if((rc = default_provider->random(provider_ctx, sqlcipher_shield_mask, sqlcipher_shield_mask_sz)) != SQLITE_OK) {
+    if((rc = default_provider->random(provider_ctx, sqlcipher_shield_mask, (int) sqlcipher_shield_mask_sz)) != SQLITE_OK) {
       sqlcipher_log(SQLCIPHER_LOG_ERROR, SQLCIPHER_LOG_MEMORY, "%s: failed to generate requisite random mask data %d", __func__, rc); 
       goto error; 
     }
@@ -2282,7 +2282,7 @@ static int sqlcipher_fprintf(FILE* stream, const char* format, ...) {
     if (wbuffer == NULL) return NULL;
 
     sz = MultiByteToWideChar(CP_UTF8, 0, buffer, sz, wbuffer, sz);
-    wbuffer[sz] = NULL;
+    wbuffer[sz] = (wchar_t) 0;
     fputws(wbuffer, stream);
 
     sqlite3_free(wbuffer);

From 04ebb65f91cfc55686b6063415ec1fbc328694e9 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Mon, 25 Aug 2025 14:40:31 -0400
Subject: [PATCH 09/11] Corrects return value from sqlcipher_fprintf

---
 src/sqlcipher.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index 0424828ce..fb70160f7 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -2279,7 +2279,7 @@ static int sqlcipher_fprintf(FILE* stream, const char* format, ...) {
     sz = (int)strlen(buffer);
 
     wbuffer = sqlite3_malloc((sz + 1) * sizeof(wchar_t));
-    if (wbuffer == NULL) return NULL;
+    if (wbuffer == NULL) return -1;
 
     sz = MultiByteToWideChar(CP_UTF8, 0, buffer, sz, wbuffer, sz);
     wbuffer[sz] = (wchar_t) 0;

From 1e6efba8b5c0ff42244b1acd6f2b2520a5fca666 Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Tue, 23 Sep 2025 10:22:49 -0400
Subject: [PATCH 10/11] Fixes check for __has_feature to resolve GHI #572

---
 src/sqlcipher.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/sqlcipher.c b/src/sqlcipher.c
index fb70160f7..66e00dce1 100644
--- a/src/sqlcipher.c
+++ b/src/sqlcipher.c
@@ -397,11 +397,11 @@ static void sqlcipher_fini(void) {
   }
   #endif
 #elif defined(__APPLE__)
-  #if !defined(__has_feature) || !__has_feature(address_sanitizer)
-  static void (*const sqlcipher_fini_func)(void) __attribute__((used, section("__DATA,__mod_term_func"))) = sqlcipher_fini;
-  #else
+  #if defined(__has_feature) && __has_feature(address_sanitizer)
   static void sqlcipher_cleanup_destructor(void) __attribute__((destructor));
   static void sqlcipher_cleanup_destructor(void) { sqlcipher_fini(); }
+  #else
+  static void (*const sqlcipher_fini_func)(void) __attribute__((used, section("__DATA,__mod_term_func"))) = sqlcipher_fini;
   #endif
 #else
 static void (*const sqlcipher_fini_func)(void) __attribute__((used, section(".fini_array"))) = sqlcipher_fini;

From c6e8461bfa0b7317dfd96278dd950b1eb6b21a1a Mon Sep 17 00:00:00 2001
From: Stephen Lombardo <sjlombardo@zetetic.net>
Date: Tue, 30 Sep 2025 16:39:04 -0400
Subject: [PATCH 11/11] Updates CHANGELOG.md with relevant changes for 4.11.0

---
 CHANGELOG.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca9b45a15..c067b7b12 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,11 +1,16 @@
 # SQLCipher Change Log
 Notable changes to this project are documented in this file.
 
-## [4.11.0] - (? 2025 - [4.11.0 changes])
+## [4.11.0] - (October 2025 - [4.11.0 changes])
 - Converts log output to UTF-16 when writing to stdout or stderr on Windows
 - Fixes scope issues to allow --disable-amalgamation to work properly
 - Replaces fortuna seeding mechanism for libtomcrypt with rng_get_bytes()
 - Removes CocoaPods support (SQLCipher.podspec.json)
+- Fixes includes and macros to support non-amalgamated builds
+- Fixes check for __has_feature to resolve issue with compilers that don't support it
+- Corrects return value from sqlcipher_fprintf
+- Fixes use of provider free_ctx
+- Fixes some compiler warnings
 
 ## [4.10.0] - (August 2025 - [4.10.0 changes])
 - Updates baseline to SQLite 3.50.4