chore(deps): bump modernc.org/sqlite to 1.60.1

[vincentkoc]

What Problem This Solves

Adopts the upstream fix for quadratic SQLite statement argument binding.

User Impact

Statements with many bound arguments use the driver's linear-time lookup; no Gitcrawl schema, configuration, or storage-format changes.

Why This Change Was Made

Bump modernc.org/sqlite from v1.60.0 to v1.60.1, retaining exactly modernc.org/libc v1.77.1. Only go.mod and go.sum change. Application production-source LOC: +0/-0.

Release is deferred until the final Crawlkit 0.16.8 consumer bump. This PR does not authorize or publish a release.

Evidence

• Base: 1bb090b38b4cc82c67c01762184b2a97455e58d0; head: f3cd86a42a35c65d6e3b29d56bb30e5652f9d64b.
• Verified sqlite source b122d0417c01508beb55158faedeb64a0c5bfd8a, published 2026-09-29T08:41:38Z, and libc source 9176651b0b6d3fb661a848553e5d608e47e2285e against the Go module cache and live upstream sqlite tag.
• Upstream sqlite go.mod is byte-identical across the two versions: Go >=1.26, libc exactly 1.77.1. Local effective Go and CI's go-version-file select 1.27.1.
• GOWORK=off go get modernc.org/sqlite@v1.60.1 followed by go mod tidy: only sqlite changes in go list -m all; go mod graph is identical after normalizing the sqlite version label. No transitive upgrades. Only the two sqlite checksum records change; the module-file checksum remains identical.
• Second GOWORK=off go mod tidy: no further diff. GOWORK=off go mod verify: passed (1.88s). git diff --check: passed.
• Fresh final-head autoreview: .agents/skills/autoreview/scripts/autoreview --mode branch --base 1bb090b38b4cc82c67c01762184b2a97455e58d0 --prompt <dependency-contract context> passed in 47.48s using the repo-default Codex reviewer at high reasoning; no actionable findings.
• GOWORK=off go test ./internal/store ./internal/portable ./internal/headlinemetrics ./internal/cli -count=1: passed (136.73s). Covers live-WAL online backup and cancellation cleanup, portable export/clone/refresh, open/migrations/read-only, and metrics writer serialization with concurrent readers. No tests added or changed.
• Native make check gates: all passed. Initial GOWORK=off make check completed tidy-check, then detected host gofmt 1.26.4 formatting drift in unchanged source. Prepended $(go env GOROOT)/bin and CI-pinned GoReleaser 2.18.2 to PATH; GOWORK=off make -o tidy-check check resumed the remaining gates without rerunning tidy (163.24s). Formatting, vet, vulnerability scan (none found), deadcode, full-suite atomic coverage (85.6%, floor 85%), build/CLI smoke, release-script fixtures, docs tests/link validation, and six-platform goreleaser release --snapshot --clean --skip=publish all passed. No unrelated source edits.
• ClawSweeper final-head review: no findings or before-merge requirements.
• Final-head hosted CI: passed Linux/macOS Go gates, Linux SIMD/scalar fallback, six-platform snapshot builds, Windows portable filesystem/build/smoke, and docs. Docker, CodeQL, and secret scans also passed. No manual CI dispatch or rerun.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 3, 2026, 1:23 AM ET / 05:23 UTC (Revision 2).

ClawSweeper review

What this changes

Updates Gitcrawl’s SQLite driver to 1.60.1 and refreshes its checksums to adopt faster statement argument binding.

Merge readiness

✅ Ready for maintainer review

The update remains useful: current main has SQLite 1.60.0, and the latest release has 1.59.0. The narrowly scoped patch has no actionable findings or additional merge requirements.

Priority: P2
Reviewed head: f3cd86a42a35c65d6e3b29d56bb30e5652f9d64b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, compatible dependency update with substantial reported validation and no actionable defects.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor proof gate does not apply to this MEMBER-authored PR. Reported database tests and CI supplement the inspected driver-binding change; no authority change or stored-data contract change requires additional proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor proof gate does not apply to this MEMBER-authored PR. Reported database tests and CI supplement the inspected driver-binding change; no authority change or stored-data contract change requires additional proof.
Evidence reviewed	8 items	Exact introduced scope: The pinned base-to-head diff changes only the SQLite version and two checksum records; libc remains 1.77.1 and Go remains 1.27.1. The module-file checksum is unchanged. Still necessary on main and release: Current main pins SQLite 1.60.0; v0.15.0 pins 1.59.0. The merged predecessor #228 supplies 1.60.0 rather than this patch update. Release inspection: Inspected the latest release's module manifest independently of the PR head; it uses SQLite 1.59.0 and libc 1.75.7.
Findings	None	None.
Security	None	None.

How this fits together

Gitcrawl stores synchronized GitHub archive data in SQLite and publishes portable database snapshots. The driver binds application query arguments before SQLite reads or writes that data.

flowchart LR
  A[GitHub archive data] --> B[Gitcrawl storage]
  B --> C[SQL statements and arguments]
  C --> D[SQLite driver binding]
  D --> E[Local archive database]
  E --> F[Queries and portable snapshots]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Adopt the compatible driver patch while retaining existing storage contracts and the separately planned release schedule.

Do we have a high-confidence way to reproduce the issue?

Not applicable to this dependency-maintenance PR; upstream source establishes the quadratic binding path and its replacement, but this review did not execute a Gitcrawl performance reproduction.

Is this the best way to solve the issue?

Yes. A patch-version update adopts the upstream repair without duplicating driver logic or changing Gitcrawl’s configuration or database schema.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 1bb090b38b4c.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded SQLite performance improvement without an established urgent Gitcrawl regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor proof gate does not apply to this MEMBER-authored PR. Reported database tests and CI supplement the inspected driver-binding change; no authority change or stored-data contract change requires additional proof.

Evidence

What I checked:

• Exact introduced scope: The pinned base-to-head diff changes only the SQLite version and two checksum records; libc remains 1.77.1 and Go remains 1.27.1. The module-file checksum is unchanged. (go.mod:16, f3cd86a42a35)
• Still necessary on main and release: Current main pins SQLite 1.60.0; v0.15.0 pins 1.59.0. The merged predecessor chore(deps): bump modernc.org/sqlite from 1.59.0 to 1.60.0 #228 supplies 1.60.0 rather than this patch update. (go.mod:16, 1bb090b38b4c)
• Release inspection: Inspected the latest release's module manifest independently of the PR head; it uses SQLite 1.59.0 and libc 1.75.7. (go.mod:16, e8448c176044)
• Dependency contract applies: Portable snapshots directly import modernc.org/sqlite and consume its Backup API. The version bump therefore warrants inspection of the driver's actual upstream delta and runtime requirements. (internal/portable/sqlite.go:17, f3cd86a42a35)
• Verified upstream patch: GitHub identifies this repository as the official mirror. Comparing 1.60.0 to 1.60.1 yields one commit changing only conn.go, binding tests, and the changelog. The binding implementation preserves the old scan fallback and first-match semantics; database engine, backup implementation, module requirements, and stored format are unchanged. The tag resolves to the stated source SHA. (conn.go:487, b122d0417c01)
• Upstream runtime requirements: The 1.60.1 manifest requires Go 1.26.0 and exactly libc 1.77.1, satisfied by Gitcrawl's unchanged pins. (go.mod:3, b122d0417c01)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-03T05:15:14.415Z sha f3cd86a :: needs maintainer review before merge. :: none