[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• turso.tech/database/tursogo: v0.8.2 → v0.8.3
• Indirect github.com/tursodatabase/turso-go-platform-libs: v0.8.2 → v0.8.3
• Reviewed head: 1e746b46b28f7acbb63b07fd3be859995568a85b

Security review

• Compared both exact Go module versions and native-source revisions. All four module/archive and go.mod checksum pairs match the public Go checksum database and this PR. No same-version checksum rewrites, new module sources, replace/toolchain/workspace changes, or unrelated graph churn.
• The Go implementation is byte-identical. Platform-libs changes seven shared libraries and their checksum sidecars; loader and build scripts are unchanged. All seven new binary SHA-256 digests also match the successful canonical upstream build logs, which build Turso source 607bff9fd0e547a25a97b3bf06e83bcc5d99d53c and publish module commit 17988775943f7fa5a9d98fdabbac19da2cd8c4fa.
• Native source changes are scoped MVCC, transaction, storage, sequence, and schema-replay correctness fixes with regression coverage. No third-party Cargo dependency changes, unexpected network/credential access, or execution hooks were found. Darwin ARM64 exports and linked system libraries are unchanged.
• OSV exact-version queries return no matches for either version of both modules; this is a correctness update rather than a confirmed advisory fix.

Compatibility verification

• make tidy — passed with no tracked diff.
• go mod verify in every workspace module — passed.
• make test — passed the complete workspace suite, including cross-driver Turso coverage and legacy transaction paths.
• make lint — passed across all workspace modules, with no tracked diff.
• make test/race TEST_DATABASE=sqlite — passed Turso, SQLite/libSQL, and legacy transaction coverage on Darwin ARM64 with Go 1.27.1.
• The initial full test attempt saturated the signal channel in TestJobScheduler/CustomizableInterval; the full rerun passes. Its source and 320-package test dependency graph are identical to the base and exclude Turso. An isolated 30-run base test also passes. This is documented as an intermittent test limitation, not a reproduced base failure.
• Existing CI also passes supported Go/Postgres matrices, SQLite race tests, CLI, generation, lint, and conformance checks.

Residual risk

• Prebuilt upstream native libraries were not independently rebuilt or signed-attestation verified. Existing build trust includes floating action/toolchain refs and Cargo builds without --locked; those properties are unchanged. Local native coverage is Darwin ARM64; CI covers Linux.