[dependabot]

Bumps modernc.org/sqlite from 1.60.0 to 1.61.0.

Changelog

Sourced from modernc.org/sqlite's changelog.

Changelog

Entries for v1.38.1 through v1.44.1 and for v1.49.1 were added on 2026-09-05, reconstructed from the git history and the merge requests they cite; they were missing at release time.

• 2026-10-31 v1.61.1:

  • Prepared statements are no longer parsed and planned again on every execution. Since v1.61.0, SQLite 3.54 expired a cached statement that has a col = ? term in a join or an ORDER BY query whenever the driver cleared its bindings after a run, so a statement prepared with db.Prepare or tx.Prepare cost about twice what it did in v1.60.1. Integer bindings now stay in place between executions, so a parameter bound to 0 or 1 does not re-prepare it either. Resolves [GitLab issue #264](https://gitlab.com/cznic/sqlite/-/issues/264). See [GitLab merge request #147](https://gitlab.com/cznic/sqlite/-/merge_requests/147), thanks Roman Khafizianov (@​requilence)!
  • Fix a panic reachable from SQL through a VFS made by vfs.New. It reported its files as writable, so with PRAGMA journal_mode=OFF a write reached a write method the VFS does not have and the process panicked, as did closing a WAL database shipped with its -wal file; with the journal on, the write failed with a misleading SQLITE_NOMEM. Such files are now read-only to SQLite, and every write fails with SQLITE_READONLY. See [GitLab merge request #145](https://gitlab.com/cznic/sqlite/-/merge_requests/145), thanks Ian Chechin!
  • Fix a process abort reachable through a VFS made by vfs.New. SQLite's request to delete a journal, made when PRAGMA journal_mode leaves PERSIST or TRUNCATE and on the first read of a 0-byte database that has a -journal file next to it in the served file system, reached the transpiled xDelete, an unimplemented stub that aborted the process. It now fails with SQLITE_IOERR_DELETE, which SQLite tolerates, and nothing is deleted; the write methods the VFS lacked answer SQLITE_READONLY instead of being nil.
  • Tx.Commit now stops waiting for a lock once the context given to BeginTx is done, and Rows.Next and Rows.Close once the query's context is done, each returning the context's error; they used to wait the full busy_timeout when a reader's lock in rollback-journal mode blocked the COMMIT, or the commit of an autocommit INSERT ... RETURNING finished or closed after its first row. Only the wait watches the context; Rollback is unchanged. Resolves [GitLab issue #263](https://gitlab.com/cznic/sqlite/-/issues/263), thanks SirLouen!
  • The attest CI job now copies vendor.json into the provenance document from the tagged commit, not from the working tree make vendor-check has just stamped with its own Go release; the v1.61.0 job failed its own verification over that field, so v1.61.0 has no provenance document, see VERIFYING.md. Tooling only.
  • Add THREAT-MODEL.md, the threat model behind the scope in SECURITY.md: the connection string, the connection lifecycle, the page cache binding and the VFS bridge, one row per concern with its status and the commit that settled it. TestVFSReadEOF now also checks the short read on vfsRead itself. Documentation and tests only. See [GitLab merge request #146](https://gitlab.com/cznic/sqlite/-/merge_requests/146), thanks Ian Chechin!

• 2026-10-21 v1.61.0:

  • Upgrade to SQLite 3.54.1, re-vendoring lib/ from modernc.org/libsqlite3 v1.15.2 and vec/ from modernc.org/libsqlite_vec v0.7.0; sqlite-vec stays v0.1.9. The pinned modernc.org/libc becomes v1.79.0; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Add _time_format=string_no_monotonic, opt-in: times are written in the default layout but without Go's monotonic clock reading, the m=+... suffix, so a scanned time matches its row again when bound in WHERE col = ?. The default is unchanged. Resolves [GitLab issue #259](https://gitlab.com/cznic/sqlite/-/issues/259). See [GitLab merge request #142](https://gitlab.com/cznic/sqlite/-/merge_requests/142), thanks 不插电 (@​r27153733)!
  • Each release tag now gets a signed provenance document, linked from its GitLab release; VERIFYING.md says what it proves and how to check one. Tooling only. See [GitLab merge request #141](https://gitlab.com/cznic/sqlite/-/merge_requests/141).
  • Add an opt-in SQLite authorizer per connection: AuthorizerRegisterer, reached through sql.Conn.Raw or installed on every pooled connection from RegisterConnectionHook; existing connections are unchanged. Resolves [GitLab issue #256](https://gitlab.com/cznic/sqlite/-/issues/256). See [GitLab merge request #139](https://gitlab.com/cznic/sqlite/-/merge_requests/139), thanks Tedla Brandsema (@​TedlaBrandsema)!
  • Closing a connection now forgets the pre-update, commit and rollback hooks registered on it; their entries used to linger after Close.
  • With a shared cache, BeginTx now waits for a lock another connection holds instead of failing at once with SQLITE_LOCKED_SHAREDCACHE (262), as executing BEGIN IMMEDIATE did; Commit and Rollback wait likewise while another connection changes the schema. busy_timeout does not bound the wait; the call's context does. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • PrepareContext and BeginTx with a context that is already done now return the context's error, as ExecContext and QueryContext do. See [GitLab merge request #143](https://gitlab.com/cznic/sqlite/-/merge_requests/143), thanks Ian Chechin!
  • A context that is done before a statement starts running, for example while its arguments are being bound, now stops the statement within 1000 VM steps. SQLite discarded that interrupt, so a long statement ran to completion and only then returned the context's error. See [GitHub pull request #9](modernc-org/sqlite#9), thanks Chris Gianelloni (@​wolf31o2)!
  • A statement waiting for a lock under busy_timeout now stops waiting once its context is done, with the context's error, instead of sleeping on until the timeout; the wait's retry schedule and its bound are otherwise unchanged, and so is a call without a deadline. PrepareContext ended this way returns the context's error too, where it returned SQLITE_BUSY. Resolves [GitLab issue #262](https://gitlab.com/cznic/sqlite/-/issues/262), thanks SirLouen!

• 2026-09-29 v1.60.1:

  • Binding arguments to a statement is no longer quadratic in the number of its parameters, which made multi-row INSERTs with thousands of ? parameters slow. Resolves [GitHub issue #8](modernc-org/sqlite#8), thanks wencycool!

• 2026-09-28 v1.60.0:

  • A fault while reading the memory-mapped -shm file of a WAL database no longer crashes the process. The statement fails with a disk I/O error, extended code SQLITE_IOERR_IN_PAGE (8714), and the connection stays usable, as in MSVC builds of SQLite. On by default on every platform and not switchable; lib.SehInject and lib.SehPending inject such a fault for tests. Resolves [GitLab issue #221](https://gitlab.com/cznic/sqlite/-/issues/221), thanks Roman (@​requilence) for the report, and supersedes libsqlite3!4 and [GitHub pull request #7](modernc-org/sqlite#7), thanks hazyhaar for the two rounds, the ccgo finding and the Windows Server runs!
  • Re-vendor lib/ from modernc.org/libsqlite3 v1.15.0 and vec/ from modernc.org/libsqlite_vec v0.6.0; SQLite stays 3.53.4 and sqlite-vec v0.1.9. Go 1.26 is now required, and the pinned modernc.org/libc becomes v1.77.1; as always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Nine exported lib constants that never had a meaningful value are gone: INFINITY, MB_CUR_MAX, NAN, RESERVED_BYTE, SHARED_FIRST, SQLITE_CANTOPEN_BKPT, SQLITE_CORRUPT_BKPT, SQLITE_DEFAULT_LOOKASIDE and SQLITE_MISUSE_BKPT. The transpiler now evaluates object-like macros as C expressions, so other constants take their C value (lib.WALINDEX_PGSZ is 32768, not 0) and some appear; the full list is in libsqlite3's CHANGELOG under 2026-09-19.
  • make vendor now writes vendor.json, the modernc.org/libsqlite3 and modernc.org/libsqlite_vec commits and the Go toolchain lib/ and vec/ were vendored with, so git show vX.Y.Z:vendor.json says which revisions a release carries; the test suite fails when they no longer match. Tooling only. See [GitLab merge request #140](https://gitlab.com/cznic/sqlite/-/merge_requests/140).
  • vfs.FS.Close now refuses while a database opened through it is still open, returning an error that wraps the new vfs.ErrInUse and leaving the VFS registered. It used to free the VFS the open connection still called through, so the next query crashed the process or read through freed memory. Close the databases first, then the FS.
  • Fix handle reuse in modernc.org/sqlite/vfs on 32-bit targets: after 2^32 file opens in one process the handle counter wrapped and could overwrite a live entry, such as a file system registered at start-up, and crash. 64-bit targets were not affected.
  • The pluggable page cache now panics when a Cache breaks its contract by returning nil, or a different Page, from Fetch for a page SQLite still holds pinned. It used to free memory SQLite was still using, corrupting the database without an error. Only a Cache implementation with that bug is affected; modernc.org/sqlite/pcache is not.
  • Document three limits of the pluggable page cache on RegisterPageCache and Cache: it cannot be combined with modernc.org/sqlite/vec, PageCache.Create may be called concurrently, and under cache=shared a Cache is called from several goroutines. Documentation only.
  • Document in the package documentation that state set on a pooled connection is inherited by the next caller to borrow it, and that a connection reached through sql.Conn.Raw is not safe for concurrent use. Documentation only.
  • Add StrictPragmas, opt-in and off by default: once enabled, a connection whose _pragma DSN value holds more than one SQL statement fails to open with ErrMultiStatementPragma, before any DSN parameter is applied. A _pragma value runs as SQL text, so anything after a ; runs too. Recommended for any application whose DSN is not a compile-time constant.
  • Document SQLite's own URI query parameters on Driver.Open: mode, cache, immutable, nolock, psow and modeof, which have always worked in a DSN starting with file:, and the trap that a plain file name has its query stripped before SQLite sees it, so /path/to.db?mode=ro opens read-write. Resolves [GitLab issue #257](https://gitlab.com/cznic/sqlite/-/issues/257). Documentation only.
  • Add SECURITY.md, the vulnerability reporting policy: three private channels, what is in scope, that only the latest release is supported, and how a confirmed report is disclosed, including an entry in the Go vulnerability database so govulncheck reports it. IRP.md, linked from it, is the maintainers' incident response plan. Documentation only.
  • Add CONTRIBUTING.md: where to send a merge request, which files are generated and must not be edited by hand, how to build and test across the 20 supported targets, and the AUTHORS/CONTRIBUTORS convention. Documentation only.
  • Ship LICENSE-3RD-PARTY.md, a transitively flattened inventory of every third-party component this module carries with all seventeen license texts in full, and a Software Bill of Materials, sbom.cdx.json (CycloneDX 1.6) and sbom.spdx.json (SPDX 2.3), explained in SBOM.md. Both cover what a module-graph tool cannot see: the transpiled SQLite and sqlite-vec C, and the upstreams modernc.org/libc carries, musl among them. Documentation only.

• 2026-09-15 v1.59.0:

  • Bump the pinned modernc.org/libc to v1.75.7 and re-vendor lib/ and vec/. The transpiled SQLite is unchanged, still 3.53.4. On the Linux targets the new libc replaces transpiled musl memcpy, memmove, memset, memcmp and strlen with native Go, cutting CPU time on query-heavy workloads by up to a third; see the new Performance section below. As always, downstream go.mod files must pin the same modernc.org/libc version this repository's go.mod does; see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).
  • Hand user-defined function and aggregate callbacks a pooled *FunctionContext instead of allocating a fresh one per call, removing the last driver-side allocation per invocation. Like the argument slice, it is valid only for the duration of the callback and must not be retained past its return. Updates [GitLab issue #226](https://gitlab.com/cznic/sqlite/-/issues/226). See [GitLab merge request #137](https://gitlab.com/cznic/sqlite/-/merge_requests/137).
  • Add regression tests pinning the identity and the pooling of that context. See [GitLab merge request #138](https://gitlab.com/cznic/sqlite/-/merge_requests/138), thanks Ian Chechin!
  • Add a Performance section to the package documentation: measured CPU-time ratios of this driver against the same SQLite compiled from C, where the gap comes from, and the two consequences for applications — index the columns that ORDER BY, GROUP BY and WHERE use, and bound the database/sql pool with SetMaxOpenConns.

• 2026-09-01 v1.58.0:

  • Upgrade to SQLite 3.53.4. It carries upstream's own fix for the journal-rollback data-corruption bug, so the local super-journal patch v1.56.0 introduced is dropped; recovery behavior is unchanged. Also bumps the pinned modernc.org/libc to v1.75.6; as always, downstream modules must pin the same version this one does, see [GitLab issue #177](https://gitlab.com/cznic/sqlite/-/issues/177).

... (truncated)

Commits

• 4df1ebe sqlite, conn, stmt, tx: end a busy_timeout wait when the call's context is done
• 44ae8d4 update dependencies, make vendor: SQLite 3.54.1, libc v1.79.0
• 570dc56 CHANGELOG.md: context cancellation before a statement starts (GitHub PR #9)
• 4eacffe sqlite, conn: keep one cancellation flag per connection
• 4926b7a Merge GitHub pull request #9 'fix/context-cancellation'
• 3587a68 fix: preserve cancellation before SQLite execution
• fd37819 Merge branch 'tx-shared-cache-wait' into 'master'
• 75b4e62 conn: watch the context only while waiting for a shared-cache lock
• 5856ee8 tx, conn: wait for a shared-cache lock in BeginTx, Commit and Rollback, and e...
• 0fc3f90 conn: forget the pre-update, commit and rollback hooks on Close
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[harshsaver]

🤖 Agentbox PR audit: ready to merge

What this PR changes

• What it does: Updates the SQLite library used to store local messages, tasks and agents, together with its required supporting libraries. No application code changes.
• What changes in the product: Nothing visible in the interface or normal workflow. Some cancelled database operations can stop sooner, and writing batches of records may become faster.
• Why it exists: Routine dependency maintenance that brings upstream database fixes and improvements.
• Why merge (or why not yet): The dependency versions match upstream requirements, existing database tests cover relevant operations, and all 11 CI checks report success. No product decision or application fix is needed.
• What to expect after merging: The application’s database schema stays unchanged. A newer patch release, 1.61.1, is available as a routine follow-up; its documented fixes do not establish a blocker for this application. Dependabot checks monthly, but the exact timing of its next proposal is not guaranteed.

Full audit (Claude (fable, xhigh) × Codex (gpt-6-astra, xhigh), 2 turns, commit f30add1)

PR audit: #172 — chore(deps): bump modernc.org/sqlite from 1.60.0 to 1.61.0

Head: f30add1

Sign-off

• Claude (fable, xhigh): ✅ satisfied — pure dependency bump; every go.sum hash and the libc pin verified against upstream, no code path in this repo is touched by the behaviour changes, CI 11/11 green.
• Codex (gpt-6-astra, xhigh): ✅ satisfied — merge decision confirmed; no blocking regression found; clarified reachable behaviour changes, patch-release scope and verification limits.

Decision

merge — dependency pins match upstream requirements, no blocking regression was identified, and all 11 reported CI checks pass; required maintainer review remains outstanding.

What changes (plain language)

• What it does: Updates the SQLite library used to store local messages, tasks and agents, together with its required supporting libraries. No application code changes.
• What changes in the product: Nothing visible in the interface or normal workflow. Some cancelled database operations can stop sooner, and writing batches of records may become faster.
• Why it exists: Routine dependency maintenance that brings upstream database fixes and improvements.
• Why merge (or why not yet): The dependency versions match upstream requirements, existing database tests cover relevant operations, and all 11 CI checks report success. No product decision or application fix is needed.
• What to expect after merging: The application’s database schema stays unchanged. A newer patch release, 1.61.1, is available as a routine follow-up; its documented fixes do not establish a blocker for this application. Dependabot checks monthly, but the exact timing of its next proposal is not guaranteed.

Findings

Blocking

• None.

Non-blocking

• v1.61.1 is available; its prepared-statement regression does not appear reachable here. go.mod:17 targets v1.61.0. Repository searches found no explicit Prepare, PrepareContext or sql.Stmt use. More importantly, the application wrappers (bus/sql_database.go:82) call driver paths that create a fresh statement for each operation: upstream conn.exec closes it afterward, and conn.query transfers ownership to rows for finalization. Therefore, the repeated execution of a cached statement required by the reported slowdown is absent. This conclusion is grounded in the driver implementation, not solely a grep. See upstream issue #264 and v1.61.0 connection implementation.

• The later patch contains more than prepared-statement and VFS fixes. v1.61.1, released October 31, also makes lock waits during Tx.Commit, Rows.Next and Rows.Close respect cancellation. The reported reproduction requires competing connections in rollback-journal mode; this store configures one connection and WAL (bus/store.go:95, bus/store.go:126). The remaining wait limitation predates this bump. Its VFS fixes concern the optional modernc.org/sqlite/vfs package, which the repo does not import. The patch also repairs upstream provenance generation: v1.61.0 has no provenance document. Checksum matching does not substitute for that attestation, but no repository rule requires one. These are useful follow-up details, not demonstrated blockers. See issue #263 and the v1.61.1 changelog.

• Cancellation changes do affect application paths, beneficially on the evidence reviewed. bus/scope_authority.go:34 passes contexts into transactions; bus/sql_database.go:82 forwards contexts into queries and writes; backups use a request-derived timeout (bus/backup.go:46). v1.61.0 can interrupt work cancelled before execution and end statement lock waits sooner. Thus, “no code path is touched” and “at most a faster error on client disconnect” were too strong. The store’s single connection prevents competing application transactions on that pool, but the separate .lock file does not prevent arbitrary SQLite clients from opening the database; internal/gateway/gateway_test.go:1010 demonstrates such a second connection. No shared-cache configuration was found. No incompatible application assumption was identified. See the v1.61.0 cancellation implementation and transaction implementation.

• The upgrade also includes v1.60.1’s parameter-binding performance fix. The original audit omitted this intermediate release. Its fix removes quadratic argument-binding work, relevant to batched peer insertion (bus/store.go:568) and event insertion (bus/events.go:43, bus/events.go:75). Existing registration tests exercise 50 peers and verify atomicity, event ordering and rollback (bus/registration_batch_test.go:9). This is a potential performance benefit; no local benchmark was run. See the v1.60.1 entry in the upstream changelog.

• SQLite 3.53.4 → 3.54.1: no incompatible SQL change identified. The new restriction on altering columns named ROWID/ROWID/OID does not match this repo’s table-renaming migrations (bus/migration.go:55, bus/migration.go:132). No authorizer registration was found. The library’s CLI changes do not change this application’s CLI. Query-planner and temporary-file changes can affect ordinary operations, so “no SQL is affected” is not a justified blanket claim. Existing checks cover selected query plans (bus/query_plans_test.go:8), migration integrity (bus/migration_test.go:43, bus/migration_test.go:129), restart durability (bus/runtime_test.go:515) and large backup restoration (bus/hardening_test.go:243). These support compatibility without proving unchanged performance for every workload. See SQLite 3.54.1 release notes.

• The golang.org/x/sync update also reaches hosted authentication. go.mod:14 moves v0.23.0 → v0.24.0, matching libc’s requirement. The repo’s direct use is singleflight.Group.Do in bus/hosted_identity.go:126. The complete singleflight.go implementation is unchanged between the old version and new version. Hosted CI is therefore relevant evidence; describing the hosted path as wholly unaffected by this dependency update was too broad.

• Constraint-error handling remains valid. bus/store.go:212 extracts sqlite.Error.Code() and masks it to compare with SQLITE_CONSTRAINT. Both remain present in the v1.61.0 error implementation. Constants removed in v1.60.0 were already absent at the PR’s base and are not new changes here.

• The public pin-record requirement is explicitly satisfied. CONTRIBUTING.md:62 requires updating dependency pins, and docs/dependencies.md:3 expressly identifies go.mod and go.sum as the Go version/checksum record. Both are updated. No duplicated SQLite version requiring a documentation edit was found. This is direct policy evidence, stronger than relying on the precedent of PR chore(deps): bump modernc.org/sqlite from 1.57.0 to 1.60.0 #150.

Fix plan

n/a

Message to the developer

n/a

Questions for Harsh

n/a

Verification

• Static review only. Neither reviewer ran application code, installs, tests, builds or repository scripts locally, following the outside-contributor restriction. Codex used read-only Git/GitHub commands, source inspection, searches and upstream web reads. The checkout remains unchanged; this response supplies the updated audit.

• Full diff checked. git diff b5bc072a8d2adab5fad32252c6c8621225a9fb9e...HEAD changes only go.mod and go.sum: 28 insertions and 28 deletions. HEAD matches the supplied SHA. The merge-base matches the local origin/main reference, and GitHub reports MERGEABLE. No go.work or vendor directory was found.

• PR description and review state checked. The requested gh pr view 172 -R october-dev/october-bus --comments fails because of the deprecated GraphQL Projects field. Explicit JSON fields successfully returned the description, zero comments, zero reviews, REVIEW_REQUIRED, and a review request for harshsaver. .github/CODEOWNERS assigns the dependency files to Harsh. The description links upstream changes; the relevant prepared-statement and cancellation issues were read. GitHub’s BLOCKED state is consistent with the missing review; all branch-protection settings were not independently inspected.

• CI independently reconfirmed through the PR check rollup. All 11 checks attached to the current PR head report SUCCESS. The reported CI run covers runtime, npm platforms, TypeScript SDK, Node compatibility, interoperability, hosted tests, workspace UI and vulnerability scanning. A separate gh run view request failed on network access, so individual execution logs were not independently inspected.

• CI coverage stated precisely. .github/workflows/ci.yml:26 runs Go tests on Linux, macOS and Windows; the full-suite race run is Linux only (ci.yml:27). Vet, binary builds and the demo are configured on all three OSes. The npm-platforms job cross-compiles six OS/architecture combinations with CGO disabled (scripts/npm-distribution.mjs:69, sdk/typescript/cli/agentintercom.cjs:9). Cross-compilation is not runtime testing of every architecture. TypeScript typechecking/build/tests, hosted race tests, browser tests and vulnerability scanning are also configured.

• Upstream requirements independently checked. The SQLite v1.61.0 manifest requires Go 1.26 and libc v1.79.0, matching go.mod:3 and go.mod:37; this repo selects Go 1.27. The libc v1.79.0 manifest accounts for the changed supporting module versions. v1.61.1’s manifest has the same requirements. These comparisons establish matching requirements, not a locally verified go mod tidy result.

• Checksum evidence distinguished by reviewer. Claude’s turn-1 record reports matching both checksum lines for all 11 updated module versions against sum.golang.org. Codex could not reproduce those direct lookups because the web tools rejected the lookup URLs. Codex instead independently matched all 20 changed checksum lines for the ten supporting modules against SQLite’s tagged go.sum, corroborated where applicable by libc’s tagged go.sum. SQLite’s own two checksum lines therefore retain Claude’s verification, rather than a second independent checksum-database check.

• Review scope and limits. Rechecked database initialization, pooling, file locking, SQL wrappers, transactions, batch binding, error handling, migrations, backups, schema, relevant tests, hosted singleflight usage, dependency policy and CI/release configuration. Examined upstream statement ownership, cancellation and transaction implementations, patch-release issues and SQLite release notes. Existing tests cover logical migrations, restart and backup restoration; this review did not execute a binary-to-binary v1.60.0 → v1.61.0 database upgrade or performance benchmark.

• Ruleset assessment. This keeps the established database library and modular storage design, adds no compatibility layer, migration, abstraction or configuration, and follows the documented pin policy. No simpler application change is required. Behavioural and verification claims have been narrowed to the evidence above.

Audit log

• Turn 1 (Claude (fable, xhigh)): Read the full diff and the driver-facing code; confirmed the repo uses no prepared statements, no shared cache, no VFS/vec/pcache sub-packages; verified all 11 go.sum entries against sum.golang.org and the libc/indirect pins against upstream go.mod files; reviewed SQLite 3.54.0/3.54.1 release notes and the v1.61.0/v1.61.1 changelogs against the repo's SQL; checked prior Dependabot precedent (chore(deps): bump modernc.org/sqlite from 1.57.0 to 1.60.0 #150) and the CONTRIBUTING pin-record rule; CI 11/11 green on the head. Decision: merge, with the v1.61.1 follow-up noted as non-blocking.
• Turn 2 (Codex (gpt-6-astra, xhigh)): Independently checked the full diff, upstream requirements, driver statement lifecycle, cancellation paths, hosted singleflight, relevant tests and CI statuses; confirmed the pin policy directly in docs/dependencies.md. Retained merge with no blockers. Added the omitted v1.60.1 benefit and v1.61.1 cancellation/provenance details; corrected blanket “unaffected” claims, race/platform coverage and verification attribution. No material changes.

Final checks

Not run here: this PR is from an outside contributor, so its code is never executed on this machine. Rely on CI before merging.

_{Automated review by Harsh's agentbox: two AI reviewers audited this PR against the project ruleset and agreed on it.}