build(deps): bump modernc.org/sqlite from 1.54.0 to 1.55.0

[dependabot]

Bumps modernc.org/sqlite from 1.54.0 to 1.55.0.

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

• 2026-07-30 v1.56.0:

  • Add NewConnector, returning a database/sql/driver.Connector for use with sql.OpenDB. It opens the same connections sql.Open("sqlite", dsn) does, from the same registered driver, so every function, collation, connection hook and virtual table module registered through this package applies to them. It exists for callers that need to interpose on the physical connections database/sql opens — tracing, metrics, connection-scoped setup — which sql.Open gives no access to: such a caller can embed the returned Connector, override Connect, and pass its own wrapper to sql.OpenDB. Previously the only way to reach the registered driver was the db, _ := sql.Open("sqlite", ""); drv := db.Driver(); db.Close() idiom, which works only because sql.Open does not connect and this driver does not implement driver.DriverContext; and the only way to get a wrapper into a *sql.DB was sql.Register, which is process-global, panics on a name it has already seen, and cannot be undone, so a library had to invent a unique driver name per configuration. sql.OpenDB registers nothing. Constructing a &sqlite.Driver{} is not an alternative — its fields are unexported, so it carries none of the registrations. NewConnector checks the DSN only as far as it can without opening a database — a query string that does not parse, and conflicting vfs parameters; everything else continues to be validated when the connection is opened, so an unknown parameter or an out-of-range value is reported by Connect rather than at construction. Nothing about the existing sql.Open path changes: *Driver deliberately still does not implement driver.DriverContext, so sql.Open remains lazy and DSN errors continue to surface where they always have. A runnable sample is in examples/connector. Resolves [GitLab issue #253](https://gitlab.com/cznic/sqlite/-/issues/253), thanks Alessandro Segala (@​ItalyPaleAle)!
  • Document that a caller-constructed sqlite.Driver is not the driver this package registers as "sqlite". Its fields are unexported, so it starts with no functions, collations or connection hooks and the only way to give it any is its own RegisterConnectionHook method; the package-level Register* functions always apply to the registered driver. Connections such a Driver opens therefore run without the package-level functions and collations — and because a registered function silently replaces a SQLite built-in of the same name, a Driver you construct can evaluate upper(x), date(x) and the like differently from one opened through sql.Open. Virtual table modules are the one exception: they are held process-globally and reach every Driver. Constructing one remains supported for the private-hook pattern — a driver registered under a name of its own with sql.Register so its connection hooks apply only to its own connections — and is otherwise best avoided in favour of sql.Open or NewConnector. Documentation only; no behavior changes.

• 2026-07-20 v1.55.0:

  • Add github.com/mattn/go-sqlite3-compatible shorthand DSN query parameters to ease migration from that driver: _busy_timeout/_timeout, _foreign_keys/_fk, _journal_mode/_journal, _synchronous/_sync, _auto_vacuum/_vacuum, and _query_only, each setting the correspondingly named PRAGMA. Values are validated against the same set mattn/go-sqlite3 accepts (case-insensitive) and an unrecognized value fails the connection with an error, so a typo such as _synchronous=fu1l or _foreign_keys=yes_please is reported rather than silently downgrading durability or dropping foreign-key enforcement. The keys are applied in a fixed order independent of their order in the DSN — _busy_timeout and _auto_vacuum before any _pragma values (auto_vacuum must be set before the database is first written), the rest after, and _query_only last — and where a key and its alias are both supplied the alias wins, matching mattn/go-sqlite3; selection is by presence rather than by value, so supplying the alias empty (_foreign_keys=on&_fk=) suppresses the PRAGMA rather than deferring to the primary key, again matching that driver. Behavior change to note: prior releases ignored these keys entirely, so a DSN carried over from a mattn/go-sqlite3 setup changes in two ways. A recognized key that previously did nothing now takes effect — _foreign_keys=on begins enforcing constraints against data that may already violate them, _journal_mode=wal persistently converts the database file, and _query_only=1 makes the connection read-only. And a value outside the accepted set now fails the connection with an error where the same DSN previously opened successfully — for example a duration-style _busy_timeout=5s or _timeout=5000ms, neither of which is the integer that key requires. Review such DSNs before upgrading. _pragma is unchanged and no pre-existing parameter changes meaning, though see the following entry for a change in when all of them are validated.
  • See [GitLab merge request #134](https://gitlab.com/cznic/sqlite/-/merge_requests/134), thanks Toni Spets (@​beeper-hifi) and Ian Chechin!
  • Validate every DSN query parameter before applying any of them. Parameters were previously checked as each was reached, so a DSN whose later parameter was rejected had already executed the PRAGMAs ahead of it. Because PRAGMA journal_mode and PRAGMA auto_vacuum are persistent changes to the database file, a DSN such as file:x.db?_journal_mode=wal&_synchronous=bogus failed the connection and yet left x.db converted to WAL. A failed Open now leaves the database as it found it. This covers the pre-existing _txlock, _timezone, _time_format, _time_integer_format, _inttotime and _texttotime parameters as well as the shorthand keys above: all of them were validated only after the _pragma list had already run, so the same DSN shape — a valid _pragma=journal_mode=wal alongside a misspelled _txlock — converted the file before reporting the error. Only the values accepted for each parameter are unchanged; a DSN that opened successfully before still opens, and one that failed still fails with the same error. _pragma remains the sole exception, since its values are executed verbatim and cannot be checked in advance: a malformed _pragma is still rejected by SQLite as it runs, after any earlier _pragma in the list has taken effect.

• 2026-07-15 v1.54.0:

  • Upgrade to SQLite 3.53.3. This also bumps the pinned modernc.org/libc to v1.74.1; as always, downstream modules must pin the exact same modernc.org/libc version this module's go.mod pins (see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177)).
  • Under the opt-in _texttotime DSN parameter, best-effort parse date-shaped TEXT values from columns SQLite reports with an empty declared type — aggregates and expressions over a date column (MAX(d), COALESCE(d, ...), upper(d), d || ''), subqueries, and typeless real columns (CREATE TABLE t(x)) — into time.Time, instead of delivering them as a raw string that Scan cannot store into a *time.Time. The existing declared DATE/DATETIME/TIME/TIMESTAMP path is unchanged; this only adds the empty-decltype case. The conversion is strictly best-effort: a value that does not parse as a time falls through to the original string, so no Scan that worked before can newly fail. ColumnTypeScanType continues to report string for empty-decltype columns, since the declared type cannot prove the column is temporal. Without _texttotime the behavior is byte-for-byte unchanged. Resolves [GitLab issue #248](https://gitlab.com/cznic/sqlite/-/issues/248).
  • See [GitLab merge request #133](https://gitlab.com/cznic/sqlite/-/merge_requests/133), thanks Ian Chechin!

• 2026-06-21 v1.53.0:

  • Add experimental netbsd/amd64 support, resolving the long-standing build break in [GitLab issue #246](https://gitlab.com/cznic/sqlite/-/issues/246). This target is intentionally not yet listed among the supported platforms in the package documentation: the port had been broken for years and is only now revived, and there is as yet no real-world experience running it under production workloads. Green CI is not the same as battle-tested — so while the full test suite (including the pcache and vec packages and the -race concurrency test) passes on NetBSD 10.1 / Go 1.26.3, and the entire upstream toolchain (libc, cc, ccgo, libz, libtcl8.6, libsqlite3, libsqlite_vec) is green on the NetBSD CI builder, the target is offered for evaluation only. If you run NetBSD, please exercise it with your own workloads and report back via #246; the intent is to promote it to a fully supported platform after a period of broader real-world testing (on the order of a month) elapses without surprises.
  • Implementation notes: the previously shipped lib/sqlite_netbsd_amd64.go was a stale old-generator transpile that no longer compiled (the mu.enter/mu.leave break in #246); it is replaced by a fresh new-generator transpile consistent with every other platform, and modernc.org/sqlite/vec (sqlite-vec) is vendored and auto-registers on netbsd. Correct operation requires the matching pinned modernc.org/libc, which carries two NetBSD-specific fixes found during this work: the mmap(2) PAD-argument ABI (without it, concurrent WAL access faults with SIGBUS in the WAL-index shared memory) and a working abort(3) (the prior stub left SQLite's crash-recovery writecrash test unable to terminate by signal). As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.
  • See [GitLab merge request #82](https://gitlab.com/cznic/sqlite/-/merge_requests/82), thanks Leonardo Taccari (@​iamleot) and Thomas Klausner (@wiz)!
  • Add experimental freebsd/386 and freebsd/arm support. As with the netbsd/amd64 target above, these two 32-bit FreeBSD ports are intentionally not yet listed among the supported platforms in the package documentation: freebsd/386 previously shipped a stale, effectively untested SQLite 3.41 transpile, and freebsd/arm is entirely new, so neither has real-world production mileage yet. Both are now freshly transpiled at SQLite 3.53.2 consistent with every other platform, build cleanly, and pass the full test suite (core, WAL/concurrency, and the vec package) on the FreeBSD CI builders; they are offered for evaluation only. If you run 32-bit FreeBSD, please exercise these targets with your own workloads and report back — the intent is to promote freebsd/386, freebsd/arm, and netbsd/amd64 to fully supported platforms in a future release cycle, once a period of broader real-world testing elapses without surprises.
  • Implementation notes: correct operation on freebsd/arm requires the matching pinned modernc.org/libc (v1.73.4), which fixes the per-arch mmap(2) off_t encoding for 32-bit FreeBSD; without it the WAL shared-memory mapping faults with SIGBUS under concurrent access, the same class of bug found on the netbsd port. As usual, downstream modules must pin the exact modernc.org/libc version this module's go.mod pins.
  • See [GitLab merge request #119](https://gitlab.com/cznic/sqlite/-/merge_requests/119), thanks Olivier Cochard-Labbé (@​ocochard)!
  • Add a Go-facing wrapper for SQLITE_CONFIG_PCACHE2. PageCache is the factory and Cache the per-database instance, both idiomatic Go interfaces; Page exposes the raw Buf and Extra pointers that SQLite reads through the C pcache contract. RegisterPageCache and MustRegisterPageCache install the module process-globally before the first sql.Open; subsequent Open calls are gated through a one-shot Xsqlite3_config(SQLITE_CONFIG_PCACHE2) so a too-late Register returns ErrPageCacheTooLate rather than silently falling through to the built-in pcache1. The binding owns the sqlite3_pcache_page stub and re-consults the implementation on every Fetch, reusing the stub only when the returned Page value is unchanged, which keeps a bounded/evicting purgeable cache safe by construction.
  • See [GitLab merge request #126](https://gitlab.com/cznic/sqlite/-/merge_requests/126), thanks Ian Chechin!
  • Add modernc.org/sqlite/pcache, the reference page-cache implementation that accompanies the #126 SQLITE_CONFIG_PCACHE2 wrapper. pcache.New returns a *Pool satisfying the PageCache interface; register it once with sqlite.MustRegisterPageCache(pcache.New()) and every connection opened afterwards draws its pages from it. Each Pool.Create mints a fresh per-database Cache: a bounded, LRU-evicting page store that honours the PRAGMA cache_size soft cap and releases the least-recently-unpinned page when it must make room. Page memory — the Buf and Extra buffers SQLite reads through — is allocated with libc.Xmalloc/libc.Xcalloc and therefore lives off the Go heap, which keeps SQLite's interior pointer arithmetic on the page extras from tripping the race detector's checkptr enforcement. Pool.Stats reports aggregate lifetime counters (hits, misses, allocs, evictions, rekeys, truncates, caches) across every cache a Pool has created, so hit/miss/eviction behaviour is observable without instrumenting individual caches. Cross-connection page sharing is out of scope for now; each Create returns an independent per-database cache.
  • Validated end-to-end against the #126 stress workload (cache_size=16, 4000 BLOB rows with DELETE and incremental_vacuum, integrity_check clean under -race) and benchmarked for the memory-utilization goal tracked in [GitLab issue #204](https://gitlab.com/cznic/sqlite/-/issues/204).
  • See [GitLab merge request #127](https://gitlab.com/cznic/sqlite/-/merge_requests/127), thanks Ian Chechin!
  • Tighten the modernc.org/sqlite/pcache reference implementation per cznic's !127 review follow-ups. Adds Stats.EasyRefusals, a per-Pool counter for the cases where FetchCreateEasy returns nil at cap; SQLite reacts to a refusal by spilling dirty pages and retrying with FetchCreateForce, so the new field is a direct proxy for the I/O pressure the strict Easy contract imposes vs pcache1's recycle-without-spill behavior. BenchmarkPoolEvictionChurn was reworked to drive a rotating-residue DELETE (k % 3 = i % 3) and re-insert a matching batch each cycle so the spill pressure recurs and easy-refusals/op scales with b.N instead of capping at the seed's one-time first-cycle cost; both existing benchmarks now report easy-refusals/op alongside the page-allocs/evictions metrics. Stats.Evictions documentation was tightened to match the actual behavior (counts LRU eviction, Unpin(discard=true), Shrink releases, and Unpin(discard=false) trimming back to target after a FetchCreateForce overcommit; bulk frees from Truncate, Rekey collisions, and Destroy are not counted). The TestPoolRoundTripIntegrity comment claiming the workload exercises xRekey ~15 times has been corrected; the SQL surface does not reliably emit xRekey here, and that codepath is covered by the unit tests instead.
  • See [GitLab merge request #130](https://gitlab.com/cznic/sqlite/-/merge_requests/130), thanks Ian Chechin!
  • Make modernc.org/sqlite/pcache -race-clean under SQLite's cache=shared mode. The pool already runs correctly under shared-cache because every callback into a given Cache is serialised internally by SQLite's sqlite3BtreeEnter on the BtShared mutex; verified empirically with a lock-free in-flight probe (max-in-flight = 1 on the canonical two-connection workload, 4 on a positive control with goroutines hitting the cache directly). However the Go race detector does not recognise SQLite's libc mutex as a happens-before edge and reports false-positive races on Fetch vs Unpin reads/writes of the per-cache state, which surfaces as DATA RACE failures for any user who registers the pool and runs their suite under -race. A sync.Mutex on the cache type is now taken on every public method (SetSize, PageCount, Fetch, Unpin, Rekey, Truncate, Destroy, Shrink), always. On the common non-shared-cache path the lock is uncontended (one atomic CAS per Lock/Unlock pair, negligible next to the SQLite work it bookends); on the shared-cache path it just rubber-stamps the order SQLite's BtShared mutex already established. A new e2e_test.go TestSharedCacheTwoConns_Integrity drives two sql.Conn against the same cache=shared URI with concurrent writers and asserts PRAGMA integrity_check = ok under -race; passes cleanly with the lock, would surface the false-positive without it. Design notes live in pcache/sharing.go.
  • See [GitLab merge request #131](https://gitlab.com/cznic/sqlite/-/merge_requests/131), thanks Ian Chechin!
  • Add a Go wrapper for sqlite3_db_status, the per-connection runtime counters (cache hit/miss/write/spill rates, schema and prepared-statement memory, lookaside usage, deferred foreign keys). DBStatus is an interface implemented by the driver connection and reached through the database/sql escape hatch (*sql.Conn).Raw(), mirroring the existing FileControl surface; DBStatusOp is a distinct typed enum of the SQLITE_DBSTATUS_* verbs so a counter from a different op family will not compile in its place. Status(op, reset) returns the (current, high) pair and optionally resets the counter. This also lets modernc.org/sqlite/pcache measure real I/O instead of the EasyRefusals proxy: the new BenchmarkPoolSpillIO reads the pager-level SQLITE_DBSTATUS_CACHE_SPILL/_CACHE_WRITE counters, which the pager maintains identically for pcache1 and the pool, making the pcache1-vs-pool comparison cznic raised on the !127 review a genuine apples-to-apples measurement. On the rotating-residue eviction-churn workload at cache_size=16 the pool spills ~3.5x more than pcache1 (cache-spill/op 31.96 vs 8.96) for ~3% more page writes (cache-write/op 450 vs 436) at identical hit/miss, quantifying the I/O cost of the strict Easy contract that EasyRefusals only proxied.
  • See [GitLab merge request #132](https://gitlab.com/cznic/sqlite/-/merge_requests/132), thanks Ian Chechin!
  • Add an opt-in _dqs DSN query parameter that disables SQLite's double-quoted string literal compatibility quirk on a per-connection basis. When _dqs=0 (or any strconv.ParseBool false value) is supplied, the driver calls sqlite3_db_config with SQLITE_DBCONFIG_DQS_DDL and SQLITE_DBCONFIG_DQS_DML set to off before any statement is prepared, so a double-quoted identifier that fails to resolve raises a parse error instead of silently falling back to a string literal. Absence of the parameter, or _dqs=1, leaves SQLite's default behavior unchanged; existing DSNs continue to work byte-for-byte. Resolves [GitLab issue #61](https://gitlab.com/cznic/sqlite/-/issues/61).
  • See [GitLab merge request #128](https://gitlab.com/cznic/sqlite/-/merge_requests/128), thanks Ian Chechin!
  • Add an opt-in _error_rc DSN query parameter for clearer error reporting on open-time failures. When _error_rc=1 (or any strconv.ParseBool true value) is supplied, error strings synthesised from a (rc, db) pair only append sqlite3_errmsg(db) when sqlite3_extended_errcode(db) is consistent with the operation rc (full match first, primary code &0xff as fallback). On mismatch the canonical sqlite3_errstr(rc) is used alone, so an open-time SQLITE_CANTOPEN no longer carries the temporary handle's stale "out of memory" errmsg. Absence of the parameter, or _error_rc=0, preserves the legacy "errstr: errmsg" form byte-for-byte; existing callers that parse error strings are unaffected. The driver's *Error.Code() returns the same SQLite result code in both modes. Parsed before sqlite3_open_v2 so open-time errors are covered. Resolves [GitLab issue #230](https://gitlab.com/cznic/sqlite/-/issues/230).
  • See [GitLab merge request #129](https://gitlab.com/cznic/sqlite/-/merge_requests/129), thanks Ian Chechin!

• 2026-06-06 v1.52.0:

  • Upgrade to SQLite 3.53.2.
  • Add Backup.Remaining and Backup.PageCount, thin wrappers around the existing sqlite3_backup_remaining and sqlite3_backup_pagecount C symbols. Together they expose the per-Step progress counters that the underlying backup object already maintains, enabling progress reporting during online backups without dropping to modernc.org/sqlite/lib directly.
  • See [GitLab merge request #122](https://gitlab.com/cznic/sqlite/-/merge_requests/122), thanks Ian Chechin!
  • Drop the redundant second copy in (*conn).columnText, the path that backs every Rows.Scan into a Go string for a TEXT column. The value's bytes are still copied once out of SQLite-owned memory into a fresh Go buffer; that buffer is then reinterpreted as the result string with unsafe.String rather than copied a second time by the implicit string([]byte) conversion. This removes one allocation per TEXT value per row and roughly halves the bytes allocated on that path; on the new BenchmarkColumnTextScan cases it is ~13–20% faster for payloads of 256 B and larger, with no measurable change for very short strings. Purely internal: no API or behavioral change, and the returned string never aliases SQLite's buffer.
  • See [GitLab merge request #123](https://gitlab.com/cznic/sqlite/-/merge_requests/123), thanks Ian Chechin!
  • Cache each result column's declared type once per result set in newRows instead of recomputing it on every row. The TEXT branch of Rows.Next calls ColumnTypeDatabaseTypeName for every TEXT column on every row (independent of any DSN flag), which previously did a libc.GoString + strings.ToUpper each time; that lookup is now a single index into a cached, pre-uppercased []string, and ColumnTypeScanType reads the same cache and drops its per-call strings.ToLower. The declared type is fixed for the lifetime of a prepared statement, so the C round-trip is paid once per column rather than once per column per row, removing exactly 1 alloc + 8 B per TEXT column per row from the Next hot path. The new BenchmarkTextToTimeScan cases show ~7% faster on a 1000-row DATETIME SELECT under _texttotime=1. Purely internal: ColumnTypeDatabaseTypeName and ColumnTypeScanType return identical values, no API or behavioral change.
  • See [GitLab merge request #124](https://gitlab.com/cznic/sqlite/-/merge_requests/124), thanks Ian Chechin!
  • Cache, per result column, the parseTimeFormats index that first parsed a TEXT-stored DATE/DATETIME/TIMESTAMP value, and try that format first on later rows instead of re-walking the list from the top. (*conn).parseTime previously ran time.Parse down the format list on every such row; for the canonical SQLite TEXT datetime format every row paid two failed time.Parse attempts — each allocating a *time.ParseError — before the match. On a 1000-row DATETIME TEXT SELECT this cuts ~50% of allocs/op and ~57% of B/op and is ~37% faster. The fall-through chain is preserved exactly: the seven formats are mutually exclusive, so the cached hint can never select a different match than the in-order scan, and the parsed driver.Value is identical to before. Purely internal: no API or behavioral change.
  • See [GitLab merge request #125](https://gitlab.com/cznic/sqlite/-/merge_requests/125), thanks Ian Chechin!

... (truncated)

Commits

• cfb9734 CHANGELOG.md: document the DSN validation-order change
• 0895392 sqlite: validate all DSN parameters before applying any of them
• 63a57e4 sqlite: select DSN shorthand aliases by presence, matching mattn (!134 follow...
• d7210fc CHANGELOG.md: correct the !134 DSN shorthand-key entry
• b31f521 Merge branch 'dsn-compat-keys' into 'master'
• 266b979 sqlite: validate mattn-compat DSN keys and fix auto_vacuum apply order
• 9784122 sqlite: document mattn-compat DSN pragma keys and test them together
• 5831f4b Support more underscore keys in DSN
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 1, 2026, 6:57 PM ET / 22:57 UTC.

ClawSweeper review

What this changes

The PR updates Gitcrawl’s direct production SQLite driver from modernc.org/sqlite v1.54.0 to v1.55.0 and refreshes the matching Go module checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 6 items remain

Keep this PR open: the SQLite upgrade changes the meaning and validation of URI query parameters, but Gitcrawl still accepts configured db_path and GITCRAWL_DB_PATH values directly into its production open path. The existing init --db contract rejects SQLite URIs, so the PR needs a narrow compatibility repair and regression coverage before merge.

Priority: P2
Reviewed head: f3451e10d613e35b9393d6d00b35ac92036c9fb6

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The dependency diff is small, but an unresolved P1 upgrade-compatibility defect and absent real behavior proof prevent merge readiness.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The PR provides an upstream changelog and CI status but no after-fix run showing configured database-path behavior; add a redacted terminal transcript or equivalent live validation after the compatibility repair. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The PR provides an upstream changelog and CI status but no after-fix run showing configured database-path behavior; add a redacted terminal transcript or equivalent live validation after the compatibility repair. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	PR diff changes the production driver: The branch changes the direct modernc.org/sqlite requirement from v1.54.0 to v1.55.0; the dependency changelog supplied in the PR states that v1.55.0 begins applying and validating previously ignored file: URI shorthand parameters. Configured runtime paths remain unvalidated: ApplyRuntimeEnv accepts GITCRAWL_DB_PATH after only home expansion, and the local runtime passes the resulting path to store.Open; a configured file: URI can therefore reach the upgraded driver. Existing CLI contract rejects URI paths only at init: gitcrawl init --db explicitly rejects file: and :memory: inputs, but that validation is not applied to loaded configuration or environment overrides before runtime opens.
Findings	1 actionable finding	[P1] Preserve or reject configured SQLite URI behavior explicitly
Security	None	None.

How this fits together

Gitcrawl loads its database path from configuration or GITCRAWL_DB_PATH, optionally redirects portable stores to a runtime mirror, and passes that value to the SQLite-backed store. The store then backs CLI sync, search, doctor, and archive operations, so driver-level DSN interpretation affects existing local archives.

flowchart LR
  A[Config file or environment] --> B[Runtime database path]
  B --> C[Portable-store redirect check]
  C --> D[SQLite store open]
  D --> E[Schema migration and queries]
  E --> F[CLI archive commands]

Loading

Before merge

• Preserve or reject configured SQLite URI behavior explicitly (P1) - This bump makes v1.55.0 apply and validate shorthand query parameters that v1.54.0 ignored, but db_path and GITCRAWL_DB_PATH still flow into store.Open without the filesystem-path validation used by init --db. Existing configured file: URIs can therefore change database settings, become read-only, or fail on upgrade; reject these values consistently or add an explicitly supported, tested URI compatibility path before updating the pin.
• Resolve merge risk (P1) - Merging v1.55.0 without an explicit runtime-path policy can make existing configured file: URIs become read-only, persist PRAGMA changes such as WAL mode, enforce foreign keys against existing data, or fail to open when formerly ignored shorthand values are invalid.
• Resolve merge risk (P1) - The PR has no after-fix real behavior evidence showing fresh and upgrade behavior for configured database paths; green CI does not establish compatibility for user-provided DSNs.
• Complete next step (P2) - A focused mechanical repair can preserve the already-documented filesystem-path-only database contract before this dependency update lands.
• Improve patch quality - Apply the filesystem-path validation to configured and environment-supplied database paths, or implement and test an explicit URI policy.
• Improve patch quality - Show a redacted real CLI run covering the repaired upgrade path; after updating the PR body, request @clawsweeper re-review if a fresh review does not start automatically.

Findings

• [P1] Preserve or reject configured SQLite URI behavior explicitly — go.mod:15

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	1 direct production dependency; 2 files changed	The small diff still changes how all configured SQLite connection strings are interpreted at runtime.

Merge-risk options

Maintainer options:

1. Reject URI values consistently (recommended)
   Extend the existing filesystem-path validation to config and GITCRAWL_DB_PATH, add focused regressions, and retain the v1.55.0 update.
2. Pause the dependency bump
   Leave the direct driver at v1.54.0 until a separately reviewed URI compatibility policy and upgrade proof are available.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Preserve the filesystem-path-only database contract for config and GITCRAWL_DB_PATH; add regression coverage for rejected file: and :memory: values, then rerun focused configuration and CLI tests.

Technical review

Best possible solution:

Preserve Gitcrawl’s documented filesystem-path-only contract by rejecting SQLite URI and in-memory values from every configuration and environment source before opening the database, then merge the version bump with focused upgrade regressions.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes a high-confidence path: set db_path or GITCRAWL_DB_PATH to a file: SQLite URI with a v1.55.0 shorthand parameter, then invoke a local-runtime command. Current code accepts that value while init --db rejects the same class of input.

Is this the best way to solve the issue?

No; a version-only pin is not the safest solution while runtime configuration bypasses the existing filesystem-path validation. Applying that existing contract to all configuration sources is the narrowest maintainable repair.

Full review comments:

• [P1] Preserve or reject configured SQLite URI behavior explicitly — go.mod:15
  This bump makes v1.55.0 apply and validate shorthand query parameters that v1.54.0 ignored, but db_path and GITCRAWL_DB_PATH still flow into store.Open without the filesystem-path validation used by init --db. Existing configured file: URIs can therefore change database settings, become read-only, or fail on upgrade; reject these values consistently or add an explicitly supported, tested URI compatibility path before updating the pin.
  Confidence: 0.97

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against dcdf94703540.

Labels

Label justifications:

• P2: This is a bounded production dependency upgrade with a concrete compatibility defect affecting configured archive paths.
• merge-risk: 🚨 compatibility: v1.55.0 changes URI DSN parameter behavior while Gitcrawl still passes configured URI-shaped paths through to SQLite.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR provides an upstream changelog and CI status but no after-fix run showing configured database-path behavior; add a redacted terminal transcript or equivalent live validation after the compatibility repair. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Acceptance criteria:

• [P1] GOWORK=off go test ./internal/config ./internal/cli ./internal/store.
• [P1] Add focused tests proving config-file and process-environment file: and :memory: values fail before a SQLite open.
• [P1] Capture a redacted CLI validation showing a supported filesystem db_path still opens normally after the change.

What I checked:

• PR diff changes the production driver: The branch changes the direct modernc.org/sqlite requirement from v1.54.0 to v1.55.0; the dependency changelog supplied in the PR states that v1.55.0 begins applying and validating previously ignored file: URI shorthand parameters. (go.mod:15, f3451e10d613)
• Configured runtime paths remain unvalidated: ApplyRuntimeEnv accepts GITCRAWL_DB_PATH after only home expansion, and the local runtime passes the resulting path to store.Open; a configured file: URI can therefore reach the upgraded driver. (internal/config/config.go:232, dcdf94703540)
• Existing CLI contract rejects URI paths only at init: gitcrawl init --db explicitly rejects file: and :memory: inputs, but that validation is not applied to loaded configuration or environment overrides before runtime opens. (internal/cli/app.go:3306, dcdf94703540)
• Prior review blocker remains on unchanged relevant code: The supplied prior review recorded the same P1 URI-compatibility finding at the identical PR head. Current-main changes since that head do not touch internal/store, internal/config, or the relevant runtime path, so no repair has addressed the blocker. (internal/cli/runtime.go:79, f3451e10d613)
• Current main and latest release remain on v1.54.0: Current main and release v0.8.7 both require v1.54.0, so the requested upgrade is neither implemented nor shipped. (go.mod:15, 4f737bb846e0)
• Portable runtime ownership history: Recent merged portable-runtime and database-target work was authored by Peter Steinberger, including the runtime-mirror behavior adjacent to this upgrade boundary. (internal/cli/runtime.go:56, 9d29256d325b)

Likely related people:

• Peter Steinberger: Authored the recent portable runtime-mirror and database-target work that owns the path from configured database locations to SQLite opens. (role: recent runtime-path contributor; confidence: high; commits: 9d29256d325b, 8670e461f32d, 6b301806853d; files: internal/cli/runtime.go, internal/cli/app.go)
• Andy Ye: Authored archive lock and database diagnostics adjacent to the direct configured database-open surface. (role: adjacent diagnostics contributor; confidence: medium; commits: 1a47fcc46146, 6206f42ea038; files: internal/cli/lock_diagnostics.go, internal/store/schema_diagnostics.go)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-07-31T21:16:55.890Z sha f3451e1 :: found issues before merge. :: [P1] Prove configured SQLite DSN upgrade compatibility
• reviewed 2026-07-31T22:39:22.757Z sha f3451e1 :: found issues before merge. :: [P1] Prove configured SQLite DSN upgrade compatibility
• reviewed 2026-08-01T05:08:15.798Z sha f3451e1 :: found issues before merge. :: [P1] Prove configured SQLite URI upgrade compatibility
• reviewed 2026-08-01T13:11:55.030Z sha f3451e1 :: found issues before merge. :: [P1] Preserve or reject configured SQLite URI behavior explicitly
• reviewed 2026-08-01T16:17:31.485Z sha f3451e1 :: found issues before merge. :: [P1] Preserve or reject configured SQLite URI behavior explicitly
• reviewed 2026-08-01T17:34:18.960Z sha f3451e1 :: found issues before merge. :: [P1] Preserve or reject configured SQLite URI behavior explicitly
• reviewed 2026-08-01T20:15:08.000Z sha f3451e1 :: needs changes before merge. :: [P1] Define configured SQLite URI behavior before upgrading
• reviewed 2026-08-01T21:23:23.159Z sha f3451e1 :: found issues before merge. :: [P1] Preserve or reject configured SQLite URI behavior explicitly

[steipete]

Superseded by #136, which reproduces the configured SQLite URI gap, applies the filesystem-only path contract to top-level config, config-backed environment values, and process environment overrides, adds regression coverage, and updates SQLite to v1.55.0 with the current dependency closure.

Proof on #136 includes the full Go suite, build, lint/vulnerability/dead-code gates, and source-blind CLI runs: ordinary filesystem paths succeed, while file: and :memory: variants from all three configuration sources fail before creating a database. Recommend closing this version-only PR after #136 lands.

[steipete]

Superseded by the verified fix and dependency refresh landed in #136. The reproduction and proof are recorded in #132 (comment).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.