chore(deps): bump sqlite3vfs upstream

[corylanou]

Description

Bumps github.com/psanford/sqlite3vfs from v0.0.0-20251127171934-4e34e03a991a to upstream commit f9180fa2acc9, resolved as v0.0.0-20260519004904-f9180fa2acc9.

Upstream has no tag at this commit. The PR also enforces and documents SQLite 3.31.0 as the minimum runtime version for the loadable VFS extension.

Motivation and Context

Upstream commit f9180fa2acc9 adds URI opener support, so Litestream can consume the upstream implementation targeted by item 1 of #1355.

SQLite runtime compatibility

The upstream implementation calls uriParamsFromC(name) before its URIOpener interface check. That function immediately calls s3vfsURIKey(), which unconditionally dereferences the loadable-extension table's sqlite3_uri_key entry for every non-null VFS open. The default VFS wrapper also implements OpenURI, so the interface check does not gate access to this API.

SQLite added sqlite3_uri_key() in 3.31.0. With SQLite 3.30.1, opening through the bumped VFS reproduced a SIGBUS at uriParamsFromC -> s3vfsURIKey. The extension entrypoint now checks sqlite3_libversion_number() before registering the VFS and returns a normal load error for older runtimes.

• Upstream implementation: psanford/sqlite3vfs@f9180fa
• SQLite 3.31.0 release notes: https://sqlite.org/changes.html#version_3_31_0

Scope

In scope:

• Update the upstream sqlite3vfs dependency
• Tidy module metadata
• Reject SQLite runtimes older than 3.31.0 before VFS registration
• Document the minimum SQLite runtime version
• Verify the VFS-tagged test suite

Not in scope:

• Changes to PR feat(vfs): thread-safe config registry for per-database VFS configuration #1157 or its branch
• Removing that branch's fork replacement
• Adapting that branch to the upstream opener API

Those are item 2 of #1355 and remain a separate follow-up.

How Has This Been Tested?

• go test -tags vfs -race ./cmd/litestream-vfs — pass
• make vfs — pass
• SQLite 3.30.1 before the guard — reproducible SIGBUS at uriParamsFromC -> s3vfsURIKey
• SQLite 3.30.1 after the guard — clean load failure: litestream VFS requires SQLite 3.31.0 or later (found 3.30.1)
• SQLite 3.31.0 after the guard — extension loads successfully and reports SQLite 3.31.0
• go test -tags vfs -race ./cmd/litestream-vfs -run '^TestVFS_SortingLargeResultSet$' -count=1 — pass after one full-package rerun timed out in this existing test
• go mod verify — pass
• pre-commit run --all-files — pass
• go test -tags vfs -race ./... — all packages except the root package pass; the root package does not compile because VFS-only mocks in vfs_test.go are missing the existing ReplicaClient.SetLogger method. The identical failure reproduces on pristine origin/main with go test -tags vfs -race ..

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project (go fmt, go vet)
• I have tested my changes (go test ./...)
• I have updated the documentation accordingly

Related to #1355 (item 1).

[github-actions]

PR Build Metrics

✅ All clear — no issues detected

Check	Status	Summary
Binary size	✅	36.95 MB (0.0 KB / 0.00%)
Dependencies	ℹ️	1 added, 1 removed
Vulnerabilities	✅	None detected
Go toolchain	✅	1.25.12 (latest)
Module graph	✅	1240 edges (0)

Binary Size

	Size	Change
Base (c96c0f4)	36.95 MB
PR (8a64016)	36.95 MB	0.0 KB (0.00%)

Dependency Changes

Added:

• github.com/psanford/sqlite3vfs v0.0.0-20260519004904-f9180fa2acc9 // direct

Removed:

• github.com/psanford/sqlite3vfs v0.0.0-20251127171934-4e34e03a991a // direct

govulncheck Output

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

Build Info

Metric	Value
Build time	1s
Go version	go1.25.12
Commit	8a64016

History (1 previous)

Commit	Updated	Status	Summary
fa436e5	2026-07-10 20:10 UTC	✅	36.95 MB (0.0 KB / 0.00%)

---

_{🤖 Updated on each push.}