Release v2.1.0

No API changes. Build hardening, supply-chain verification, and one undefined-behavior fix.

Changed

• Compiler and linker hardening: POSIX builds now follow the OpenSSF hardening baseline — stack protector, _FORTIFY_SOURCE=2, format-string hardening, full RELRO, non-executable stack, and arch-gated control-flow integrity (Intel CET on x64, PAC/BTI on arm64). Windows ARM64 gains /Qspectre and /guard:signret, the backward-edge protection it previously lacked.
• Vendored SQLite integrity: the amalgamation sync now verifies the download against a SHA3-256 pinned in-tree and refuses to vendor a mismatch, instead of compiling whatever it fetched.

Fixed

• Empty changeset undefined behavior: session.changeset() / .patchset() on a session with no recorded changes called memcpy(NULL, NULL, 0), which is undefined behavior even at zero length. Results are unchanged (still a zero-length Uint8Array); the UB is gone. Surfaced by the new UndefinedBehaviorSanitizer pass in CI.

Commits

Full Changelog: v2.0.0...v2.1.0

Release v2.0.0

API compatible with node:sqlite from Node.js v26.4.0.

Added

• DatabaseSync.prototype.serialize([dbName]) and DatabaseSync.prototype.deserialize(buffer, [options]): Serialize a database to a Uint8Array and load one back, matching the node:sqlite APIs added in Node.js PR #59967. Wraps sqlite3_serialize / sqlite3_deserialize and finalizes any open prepared statements before replacing database content.

Changed

• BREAKING: Dropped support for Node.js 20 (end-of-life April 2026); @photostructure/sqlite now requires Node.js 22 or newer (package.json engines is >=22). This is why this release is 2.0.0 rather than a 1.x minor.
• SQLite 3.53.3: Updated from 3.53.0. Three patch releases (3.53.1–3.53.3), bug fixes only, no API impact (release notes).
• Upstream sync: Node.js v25.x-staging@ffa9b8f → v26.x-staging@c96c838. Beyond serialize()/deserialize(), upstream added a column-name caching path and a simdutf fast path for ASCII column text in StatementSync — both V8/internal-only optimizations with no N-API equivalent, so not ported. Subsequent node:sqlite bug fixes — closing the connection after a failed open(), changeset xFilter/callback-lifetime hardening, and reading the column count after the first step() in all() — are already covered by our port's structure and needed no change.
• Statement finalization on db.close(): Live StatementSync instances are now eagerly detached when their database closes, so further method calls throw ERR_INVALID_STATE with "statement has been finalized" (matching node:sqlite) instead of "Database connection is closed". Statement error messages were also normalized to lowercase "statement has been finalized" throughout.
• Build hardening (SQLITE_ENABLE_API_ARMOR): The bundled SQLite is now compiled with API armor, so misuse of the C API — for example by a loaded extension such as sqlite-vec — returns SQLITE_MISUSE instead of risking undefined behavior or a process abort the caller cannot catch. Negligible runtime cost; the public JavaScript API is unaffected.
• Callback reentrancy hardening: operations SQLite forbids from inside its own callbacks (notably close/deserialize, plus prepare/exec/step/serialize/setAuthorizer from an authorizer) now throw ERR_INVALID_STATE instead of corrupting connection state. Intentional divergence from node:sqlite (nodejs/node#63207).
• Config setters frozen mid-step: setReadBigInts, setReturnArrays, and the setAllow* parameter setters throw ERR_INVALID_STATE if called while the statement is executing.

Fixed

• Backup teardown stability: In-flight backup() operations are now safe when a Node environment is shutting down. Backup jobs avoid resolving/rejecting promises or routing expected SQLite failures through node-addon-api's async worker error path after teardown begins.
• Authorizer error identity: the exact value thrown by an authorizer callback (subclass, code, message, thrown primitives) now propagates unchanged through prepare/exec/step/serialize/deserialize/changeset/extension load, instead of being replaced by a generic error.
• TEXT with embedded NUL bytes: returned in full via byte-length conversion instead of being truncated at the first NUL.

Performance

• Faster multi-row reads: per-statement column-key caching, byte-length string conversion, per-column exception checks removed from the row builder, and a native iterator fast path for flat/raw modes.
• -fno-plt on Linux removes PLT indirection from Node-API calls in the hot path.

Internal

• Docs: bulk-read performance tradeoff documented honestly; Node 22 requirement propagated across docs and examples.
• Benchmark suite reworked for fair, reproducible driver comparison (deterministic workloads, median confidence intervals, per-scenario ratios, SVG charts) plus correlation-gated memory-leak detection.
• Dependencies: node-addon-api 8.9.0, TypeScript 6, ESLint 10, prettier 3.8.5, @types/node 26.
• CI: pinned-action updates (CodeQL, TruffleHog, OSV-Scanner, actions/checkout).

Commits

Full Changelog: v1.2.1...v2.0.0

Release v1.2.1

Full Changelog: v1.2.0...v1.2.1

Release v1.2.0

API compatible with node:sqlite from Node.js v25.9.0.

Changed

• SQLite 3.53.0: Updated from 3.52.0. Adds json_array_insert() / jsonb_array_insert() SQL functions, ALTER TABLE support for adding/removing NOT NULL and CHECK constraints, REINDEX EXPRESSIONS to rebuild expression indexes, VACUUM INTO reserve=N URI parameter, and new C APIs (sqlite3_str_truncate, sqlite3_str_free, sqlite3_carray_bind_v2, SQLITE_PREPARE_FROM_DDL, SQLITE_DBCONFIG_FP_DIGITS). Floating-point text conversion default changed from 15 to 17 significant digits. Full release notes.
• Upstream sync: Node.js v25.x-staging@ca2d6ea → ffa9b8f (includes content through Node.js v25.9.0). Upstream made a cosmetic lambda-capture fix in ApplyChangeset's filter callback; our port already used equivalent by-value captures.

Fixed

• Docs: corrected stale "DataView parameter binding is not currently supported" note; BLOB binding accepts TypedArray or DataView input and returns Uint8Array.

Internal

• Test sync: skip test-sqlite-serialize.js — Node.js DatabaseSync.prototype.serialize() / deserialize() APIs are not yet ported.

Full Changelog: v1.1.0...v1.2.0

Release v1.1.0

Full Changelog: v1.0.0...v1.1.0

Release v1.0.0

Promotion to v1.0.0 following API stabilization and 0.5.0 release.

API compatible with node:sqlite from Node.js v25.8.0.

Added

• db.limits property: Get and set SQLite limits (length, sqlLength, column, exprDepth, compoundSelect, vdbeOp, functionArg, attach, likePatternLength, variableNumber, triggerDepth) at runtime. Supports Infinity to reset to compile-time maximum. Also accepts limits option in DatabaseSync constructor.
• Statement iterator invalidation: Calling stmt.run(), stmt.get(), stmt.all(), or stmt.iterate() now invalidates any active iterator on the same statement, throwing ERR_INVALID_STATE

Changed

• SQLite 3.52.0: Updated from 3.51.2

Full Changelog: v0.5.0...v1.0.0

Release v0.5.0

Added

• Statement modes via enhance(): stmt.pluck(), stmt.raw(), stmt.expand() for better-sqlite3 compatibility
  • .pluck() returns only the first column value from queries
  • .raw() returns rows as arrays instead of objects
  • .expand() returns rows namespaced by table, correctly handling duplicate column names across JOINs
  • All three modes are mutually exclusive, matching better-sqlite3's toggle semantics
• stmt.database: Back-reference from prepared statements to their parent database instance
• EnhancedStatementMethods type: TypeScript interface for pluck(), raw(), expand(), and database

Commits

Full Changelog: v0.4.0...v0.5.0

Release v0.4.0

API compatible with node:sqlite from Node.js v25.6.1.

Added

• enhance() function: Adds better-sqlite3-style .pragma() and .transaction() methods to any compatible database instance
• isEnhanced() type guard: Check if a database has enhanced methods
• Transaction helper: Automatic BEGIN/COMMIT/ROLLBACK with savepoint support for nested transactions
• Pragma convenience method: Simple API for reading and setting SQLite pragmas with simple option
• Node.js test sync script: npm run sync:tests downloads and adapts upstream Node.js SQLite tests
• Percentile extension: SQLITE_ENABLE_PERCENTILE now enabled, adding percentile(), median(), percentile_cont(), percentile_disc() SQL functions (Node.js v25+)
• Prepare options: db.prepare(sql, options) now accepts per-statement options (readBigInts, returnArrays, allowBareNamedParameters, allowUnknownNamedParameters) to override database-level defaults. This is a Node.js v25+ feature; node:sqlite on v24 and earlier silently ignores these options.
• StatementColumnMetadata type: stmt.columns() now returns richer metadata including column, database, table, and type properties alongside name
• SQLite 3.51.2: Updated from 3.51.1

Changed

• BREAKING: Removed API extensions to achieve exact parity with node:sqlite:
  • Removed stmt.finalize() method (use database close for cleanup)
  • Removed stmt.finalized property
  • Removed stmt[Symbol.dispose] (still available on DatabaseSync and Session)
  • Removed db.backup() instance method (use standalone backup(db, path) function instead)
• BREAKING: Session.changeset() and Session.patchset() now return Uint8Array instead of Buffer to match node:sqlite API
• BREAKING: Defensive mode now defaults to true instead of false to match Node.js v25+ behavior. Use { defensive: false } to restore old behavior.

Fixed

• Alpine Linux / musl stability: Fixed native crashes by removing N-API reference cleanup from destructors that corrupted V8 JIT state
• Session lifecycle management: Fixed use-after-free, double-free, and mutex deadlock when databases are garbage collected before their sessions
• Worker thread stability: Added cleanup hooks and exception handling for worker thread termination
• Callback error preservation: applyChangeset() now preserves the original error message when JavaScript callbacks throw
• createTagStore() now throws errors with code: 'ERR_INVALID_STATE' property when database is closed, matching Node.js error format

Full Changelog: v0.3.0...v0.4.0

Release v0.3.0

• BREAKING: SQLTagStore.size changed from method to getter for Node.js API parity Node.js PR #60246
  • Before: sql.size()
  • After: sql.size

Full Changelog: v0.2.1...v0.3.0

Release v0.2.1

Added

• Windows ARM64 prebuilt binaries

Fixed

• Error message handling on Windows ARM64 (ABI compatibility)
• Error handling consistency across platforms

Full Changelog: v0.2.0...v0.2.1