Thanks for already being on top of this. :)
I don't see any clearly-labeled security fixes listed in https://sqlite.org/releaselog/3_25_2.html, although "Fixes for various other compiler warnings" can sometimes be security-relevant, and "a malfunction when complicated expressions involving window functions" is a bit vague. ;) (I see you've turned off window functions anyway.)
In general, I think it's fair-ish to say that security people prefer to take all stable updates, since you never definitely know what functional fixes are really/partially/also security fixes. See e.g. http://kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ ("remember all fixes are security fixes" -> http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/). Now, that's for the kernel, which is by definition a security-enforcing thing; SQLite for us lives in renderers and so we trust it less/its bugs can hurt our users less (one hopes). "But, still", as they say.
I also generally feel that the longer one waits to upgrade to latest stable, the more likely it is to be difficult/expensive when you do. Thankfully we're not super far behind right now, so we've got a bit of breathing room, but I'd ideally like to see the upgrade stick as soon as we can get it to. Easy for me to say...
Comment 1 by bugdroid1@chromium.org
, Oct 9