cloudflare · joshthoward · Aug 21, 2026 · Aug 21, 2026
@@ -4,29 +4,29 @@ module(name = "workerd")
 
 # sqlite3 is downloaded from sqlite.org (not GitHub), so it remains manual.
 # We have some patches that aren't included in BCR:
-# https://github.com/bazelbuild/bazel-central-registry/tree/main/modules/sqlite3/3.47.0/patches
+# https://github.com/bazelbuild/bazel-central-registry/tree/main/modules/sqlite3/3.53.3/patches
 bazel_dep(name = "sqlite3")
 archive_override(
     module_name = "sqlite3",
     build_file = "//:build/BUILD.sqlite3",
     patch_args = ["-p1"],
+    patch_tool = "patch",
     patches = [
         "//:patches/sqlite/0001-row-counts-plain.patch",
         "//:patches/sqlite/0002-macOS-missing-PATH-fix.patch",
         "//:patches/sqlite/0003-sqlite-complete-early-exit.patch",
-        "//:patches/sqlite/0004-invalid-wal-on-rollback-fix.patch",
-        "//:patches/sqlite/0005-authorizer-rename-to-destination-name.patch",
+        "//:patches/sqlite/0004-authorizer-rename-to-destination-name.patch",
     ],
     remote_file_integrity = {
-        "MODULE.bazel": "sha256-+H38CSP6DtMT+YPSy9lplRLcfBApkukY4vdX6lBjDfI=",
+        "MODULE.bazel": "sha256-y8b6x7BNbvOuFQxzh1vbyJ/1F/RP67Ho3gJUJU3wZeE=",
     },
     # Using build file from more recent version since it imports rules_cc properly
     remote_file_urls = {
-        "MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/sqlite3/3.51.2.bcr.1/MODULE.bazel"],
+        "MODULE.bazel": ["https://raw.githubusercontent.com/bazelbuild/bazel-central-registry/refs/heads/main/modules/sqlite3/3.53.3/MODULE.bazel"],
     },
-    sha256 = "f59c349bedb470203586a6b6d10adb35f2afefa49f91e55a672a36a09a8fedf7",
-    strip_prefix = "sqlite-src-3470000",
-    url = "https://sqlite.org/2024/sqlite-src-3470000.zip",
+    sha256 = "d18fa15aec74d8c17e1463f861095adc01b5ad190256acb4f91d22f0368d232b",
+    strip_prefix = "sqlite-src-3530400",
+    url = "https://sqlite.org/2026/sqlite-src-3530400.zip",
 )
 
 # rules_android/rules_go are not used by ourselves, but protobuf pulls in outdated versions that are

@@ -210,6 +210,32 @@ genrule(
 
 GENERATED_SOURCES += ["keywordhash.h"]
 
+# ========================================================================
+# Constructs ctime.c
+
+genrule(
+    name = "ctime_c",
+    srcs = [],
+    outs = ["ctime.c"],
+    cmd = "tclsh $(location tool/mkctimec.tcl) $(RULEDIR)/ctime.c",
+    tools = ["tool/mkctimec.tcl"],
+)
+
+GENERATED_SOURCES += ["ctime.c"]
+
+# ========================================================================
+# Constructs pragma.h
+
+genrule(
+    name = "pragma_h",
+    srcs = [],
+    outs = ["pragma.h"],
+    cmd = "tclsh $(location tool/mkpragmatab.tcl) $(RULEDIR)/pragma.h",
+    tools = ["tool/mkpragmatab.tcl"],
+)
+
+GENERATED_SOURCES += ["pragma.h"]
+
 # ========================================================================
 # Constructs sqlite3.h.
 

@@ -1,11 +1,11 @@
 diff -u5 -r sqlite-src-pristine/src/shell.c.in sqlite-src-modified/src/shell.c.in
---- sqlite-src-pristine/src/shell.c.in	2024-10-21 11:47:53
-+++ sqlite-src-modified/src/shell.c.in	2024-11-05 08:16:15
-@@ -3411,10 +3411,15 @@
-     sqlite3_fprintf(out,
+--- sqlite-src-pristine/src/shell.c.in	2026-08-19 19:37:52
++++ sqlite-src-modified/src/shell.c.in	2026-08-19 21:03:33
+@@ -2942,10 +2942,15 @@
+     cli_printf(out,
             "Number of times run:                 %d\n", iCur);
      iCur = sqlite3_stmt_status(pArg->pStmt, SQLITE_STMTSTATUS_MEMUSED, bReset);
-     sqlite3_fprintf(out,
+     cli_printf(out,
             "Memory used by prepared stmt:        %d\n", iCur);
 +
 +    iCur = sqlite3_stmt_status(pArg->pStmt, LIBSQL_STMTSTATUS_ROWS_READ, bReset);
@@ -18,9 +18,9 @@ diff -u5 -r sqlite-src-pristine/src/shell.c.in sqlite-src-modified/src/shell.c.i
    displayLinuxIoStats(pArg->out);
  #endif
 diff -u5 -r sqlite-src-pristine/src/sqlite.h.in sqlite-src-modified/src/sqlite.h.in
---- sqlite-src-pristine/src/sqlite.h.in	2024-10-21 11:47:53
-+++ sqlite-src-modified/src/sqlite.h.in	2024-11-05 08:13:50
-@@ -8907,20 +8907,32 @@
+--- sqlite-src-pristine/src/sqlite.h.in	2026-08-19 19:37:52
++++ sqlite-src-modified/src/sqlite.h.in	2026-08-19 21:02:27
+@@ -9298,20 +9298,32 @@
  ** used to store the prepared statement.  ^This value is not actually
  ** a counter, and so the resetFlg parameter to sqlite3_stmt_status()
  ** is ignored when the opcode is SQLITE_STMTSTATUS_MEMUSED.
@@ -54,9 +54,9 @@ diff -u5 -r sqlite-src-pristine/src/sqlite.h.in sqlite-src-modified/src/sqlite.h
  **
  ** The sqlite3_pcache type is opaque.  It is implemented by
 diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
---- sqlite-src-pristine/src/vdbe.c	2024-10-21 11:47:53
-+++ sqlite-src-modified/src/vdbe.c	2024-11-05 08:13:50
-@@ -3737,10 +3737,11 @@
+--- sqlite-src-pristine/src/vdbe.c	2026-08-19 19:37:52
++++ sqlite-src-modified/src/vdbe.c	2026-08-19 21:02:27
+@@ -3804,10 +3804,11 @@
    if( pOp->p3 ){
      nEntry = sqlite3BtreeRowCountEst(pCrsr);
    }else{
@@ -68,7 +68,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
    pOut = out2Prerelease(p, pOp);
    pOut->u.i = nEntry;
    goto check_for_interrupt;
-@@ -4900,10 +4901,11 @@
+@@ -4969,10 +4970,11 @@
      if( eqOnly && r.eqSeen==0 ){
        assert( res!=0 );
        goto seek_not_found;
@@ -80,7 +80,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
  #endif
    if( oc>=OP_SeekGE ){  assert( oc==OP_SeekGE || oc==OP_SeekGT );
      if( res<0 || (res==0 && oc==OP_SeekGT) ){
-@@ -5470,10 +5472,11 @@
+@@ -5539,10 +5541,11 @@
    pC->nullRow = 0;
    pC->cacheStatus = CACHE_STALE;
    pC->deferredMoveto = 0;
@@ -92,7 +92,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
      if( pOp->p2==0 ){
        rc = SQLITE_CORRUPT_BKPT;
      }else{
-@@ -5727,10 +5730,11 @@
+@@ -5796,10 +5799,11 @@
    }
    if( pOp->p5 & OPFLAG_ISNOOP ) break;
  #endif
@@ -104,7 +104,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
      if( pOp->p5 & OPFLAG_LASTROWID ) db->lastRowid = x.nKey;
    }
    assert( (pData->flags & (MEM_Blob|MEM_Str))!=0 || pData->n==0 );
-@@ -5920,10 +5924,11 @@
+@@ -5989,10 +5993,11 @@
    pC->seekResult = 0;
    if( rc ) goto abort_due_to_error;
 
@@ -116,7 +116,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
        db->xUpdateCallback(db->pUpdateArg, SQLITE_DELETE, zDb, pTab->zName,
            pC->movetoTarget);
        assert( pC->iDb>=0 );
-@@ -6207,10 +6212,11 @@
+@@ -6276,10 +6281,11 @@
    rc = sqlite3BtreeLast(pCrsr, &res);
    pC->nullRow = (u8)res;
    pC->deferredMoveto = 0;
@@ -128,7 +128,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
      if( res ) goto jump_to_p2;
    }
    break;
-@@ -6326,10 +6332,11 @@
+@@ -6395,10 +6401,11 @@
      pC->deferredMoveto = 0;
      pC->cacheStatus = CACHE_STALE;
    }
@@ -140,7 +140,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
      if( res ) goto jump_to_p2;
    }
    break;
-@@ -6431,10 +6438,11 @@
+@@ -6526,10 +6533,11 @@
    pC->cacheStatus = CACHE_STALE;
    VdbeBranchTaken(rc==SQLITE_OK,2);
    if( rc==SQLITE_OK ){
@@ -152,7 +152,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
  #endif
      goto jump_to_p2_and_check_for_interrupt;
    }
-@@ -6482,10 +6490,11 @@
+@@ -6577,10 +6585,11 @@
    assert( pC!=0 );
    assert( !isSorter(pC) );
    pIn2 = &aMem[pOp->p2];
@@ -164,7 +164,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
    rc = ExpandBlob(pIn2);
    if( rc ) goto abort_due_to_error;
    x.nKey = pIn2->n;
-@@ -6882,10 +6891,11 @@
+@@ -6983,10 +6992,11 @@
    assert( p->readOnly==0 );
    assert( DbMaskTest(p->btreeMask, pOp->p2) );
    rc = sqlite3BtreeClearTable(db->aDb[pOp->p2].pBt, (u32)pOp->p1, &nChange);
@@ -176,7 +176,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
        memAboutToChange(p, &aMem[pOp->p3]);
        aMem[pOp->p3].u.i += nChange;
      }
-@@ -8466,10 +8476,11 @@
+@@ -8630,10 +8640,11 @@
    ** some other method is next invoked on the save virtual table cursor.
    */
    rc = pModule->xNext(pCur->uc.pVCur);
@@ -188,7 +188,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
    if( !res ){
      /* If there is data, jump to P2 */
      goto jump_to_p2_and_check_for_interrupt;
-@@ -8587,10 +8598,11 @@
+@@ -8752,10 +8763,11 @@
          rc = SQLITE_OK;
        }else{
          p->errorAction = ((pOp->p5==OE_Replace) ? OE_Abort : pOp->p5);
@@ -201,9 +201,9 @@ diff -u5 -r sqlite-src-pristine/src/vdbe.c sqlite-src-modified/src/vdbe.c
    }
    break;
 diff -u5 -r sqlite-src-pristine/src/vdbeInt.h sqlite-src-modified/src/vdbeInt.h
---- sqlite-src-pristine/src/vdbeInt.h	2024-10-21 11:47:53
-+++ sqlite-src-modified/src/vdbeInt.h	2024-11-05 08:13:50
-@@ -496,10 +496,11 @@
+--- sqlite-src-pristine/src/vdbeInt.h	2026-08-19 19:37:52
++++ sqlite-src-modified/src/vdbeInt.h	2026-08-19 21:02:27
+@@ -508,10 +508,11 @@
    bft bIsReader:1;        /* True for statements that read */
    bft haveEqpOps:1;       /* Bytecode supports EXPLAIN QUERY PLAN */
    yDbMask btreeMask;      /* Bitmask of db->aDb[] entries referenced */
@@ -216,9 +216,9 @@ diff -u5 -r sqlite-src-pristine/src/vdbeInt.h sqlite-src-modified/src/vdbeInt.h
    DblquoteStr *pDblStr;   /* List of double-quoted string literals */
  #endif
 diff -u5 -r sqlite-src-pristine/src/vdbeapi.c sqlite-src-modified/src/vdbeapi.c
---- sqlite-src-pristine/src/vdbeapi.c	2024-10-21 11:47:53
-+++ sqlite-src-modified/src/vdbeapi.c	2024-11-05 08:13:50
-@@ -2072,11 +2072,11 @@
+--- sqlite-src-pristine/src/vdbeapi.c	2026-08-19 19:37:52
++++ sqlite-src-modified/src/vdbeapi.c	2026-08-19 21:02:27
+@@ -2112,11 +2112,11 @@
  int sqlite3_stmt_status(sqlite3_stmt *pStmt, int op, int resetFlag){
    Vdbe *pVdbe = (Vdbe*)pStmt;
    u32 v;
@@ -231,7 +231,7 @@ diff -u5 -r sqlite-src-pristine/src/vdbeapi.c sqlite-src-modified/src/vdbeapi.c
      return 0;
    }
  #endif
-@@ -2089,10 +2089,13 @@
+@@ -2129,10 +2129,13 @@
      db->lookaside.pEnd = db->lookaside.pStart;
      sqlite3VdbeDelete(pVdbe);
      db->pnBytesFreed = 0;

@@ -1,12 +1,12 @@
-diff --color -u5 -r sqlite-src-3440000-pristine/tool/mksqlite3c.tcl sqlite-src-3440000-modified/tool/mksqlite3c.tcl
---- sqlite-src-3440000-pristine/tool/mksqlite3c.tcl	2023-11-01 07:31:37
-+++ sqlite-src-3440000-modified/tool/mksqlite3c.tcl	2024-03-14 17:36:55
-@@ -84,11 +84,14 @@
+diff -u5 -r sqlite-src-pristine/tool/mksqlite3c.tcl sqlite-src-modified/tool/mksqlite3c.tcl
+--- sqlite-src-pristine/tool/mksqlite3c.tcl	2026-08-19 19:37:52
++++ sqlite-src-modified/tool/mksqlite3c.tcl	2026-08-19 21:06:55
+@@ -87,11 +87,14 @@
  set fname sqlite3.c
  if {$enable_recover} { set fname sqlite3r.c }
- set out [open $fname w]
+ set out [open $fname wb]
  # Force the output to use unix line endings, even on Windows.
- fconfigure $out -translation lf
+ fconfigure $out -translation binary
 -set today [clock format [clock seconds] -format "%Y-%m-%d %H:%M:%S UTC" -gmt 1]
 +# The command below results in "couldn't find HOME environment variable to
 +# expand path" errors on macOS CI runs. today is unused, so it is safe to

@@ -0,0 +1,128 @@
+--- sqlite-src-pristine/src/alter.c	2026-08-20 19:56:12
++++ sqlite-src-modified/src/alter.c	2026-08-20 19:57:57
+@@ -177,12 +177,13 @@
+     goto exit_rename_table;
+   }
+ #endif
+
+ #ifndef SQLITE_OMIT_AUTHORIZATION
+-  /* Invoke the authorization callback. */
+-  if( sqlite3AuthCheck(pParse, SQLITE_ALTER_TABLE, zDb, pTab->zName, 0) ){
++  /* Invoke the authorization callback. Pass the new table name as the 4th
++  ** argument so the authorizer can reject renames into reserved namespaces. */
++  if( sqlite3AuthCheck(pParse, SQLITE_ALTER_TABLE, zDb, pTab->zName, zName) ){
+     goto exit_rename_table;
+   }
+ #endif
+
+ #ifndef SQLITE_OMIT_VIRTUALTABLE
+--- sqlite-src-pristine/test/auth.test	2026-08-20 19:56:10
++++ sqlite-src-modified/test/auth.test	2026-08-20 20:00:21
+@@ -1780,11 +1780,11 @@
+       do_test auth-1.264 {
+         execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
+       } {t1x}
+       do_test auth-1.265 {
+         set authargs
+-      } {temp t1 {} {}}
++      } {temp t1 t1x {}}
+       do_test auth-1.266 {
+         proc auth {code arg1 arg2 arg3 arg4 args} {
+           if {$code=="SQLITE_ALTER_TABLE"} {
+             set ::authargs [list $arg1 $arg2 $arg3 $arg4]
+             return SQLITE_IGNORE
+@@ -1798,11 +1798,11 @@
+       do_test auth-1.267 {
+         execsql {SELECT name FROM temp.sqlite_master WHERE type='table'}
+       } {t1x}
+       do_test auth-1.268 {
+         set authargs
+-      } {temp t1x {} {}}
++      } {temp t1x t1 {}}
+       do_test auth-1.269 {
+         proc auth {code arg1 arg2 arg3 arg4 args} {
+           if {$code=="SQLITE_ALTER_TABLE"} {
+             set ::authargs [list $arg1 $arg2 $arg3 $arg4]
+             return SQLITE_DENY
+@@ -1817,11 +1817,11 @@
+         execsql {SELECT name FROM sqlite_temp_master WHERE type='table'}
+       } {t1x}
+
+       do_test auth-1.271 {
+         set authargs
+-      } {temp t1x {} {}}
++      } {temp t1x t1 {}}
+     } ;# ifcapable altertable
+
+   } else {
+     db authorizer {}
+     db eval {
+@@ -1849,11 +1849,11 @@
+ do_test auth-1.273 {
+   execsql {SELECT name FROM sqlite_master WHERE type='table'}
+ } {t2x}
+ do_test auth-1.274 {
+   set authargs
+-} {main t2 {} {}}
++} {main t2 t2x {}}
+ do_test auth-1.275 {
+   proc auth {code arg1 arg2 arg3 arg4 args} {
+     if {$code=="SQLITE_ALTER_TABLE"} {
+       set ::authargs [list $arg1 $arg2 $arg3 $arg4]
+       return SQLITE_IGNORE
+@@ -1867,11 +1867,11 @@
+ do_test auth-1.276 {
+   execsql {SELECT name FROM sqlite_master WHERE type='table'}
+ } {t2x}
+ do_test auth-1.277 {
+   set authargs
+-} {main t2x {} {}}
++} {main t2x t2 {}}
+ do_test auth-1.278 {
+   proc auth {code arg1 arg2 arg3 arg4 args} {
+     if {$code=="SQLITE_ALTER_TABLE"} {
+       set ::authargs [list $arg1 $arg2 $arg3 $arg4]
+       return SQLITE_DENY
+@@ -1885,11 +1885,11 @@
+ do_test auth-1.279 {
+   execsql {SELECT name FROM sqlite_master WHERE type='table'}
+ } {t2x}
+ do_test auth-1.280 {
+   set authargs
+-} {main t2x {} {}}
++} {main t2x t2 {}}
+ db authorizer {}
+ catchsql {ALTER TABLE t2x RENAME TO t2}
+
+ } ;# ifcapable altertable
+
+--- sqlite-src-pristine/test/alterauth.test	2026-08-20 19:56:10
++++ sqlite-src-modified/test/alterauth.test	2026-08-20 19:57:57
+@@ -34,11 +34,11 @@
+
+ do_test 1.1 {
+   set ::auth [list]
+   execsql { ALTER TABLE t1 RENAME TO t2 }
+   set ::auth
+-} {{SQLITE_ALTER_TABLE main t1 {} {}}}
++} {{SQLITE_ALTER_TABLE main t1 t2 {}}}
+
+ do_test 1.2 {
+   set ::auth [list]
+   execsql { ALTER TABLE t2 RENAME c TO ccc }
+   set ::auth
+--- sqlite-src-pristine/test/alterauth2.test	2026-08-20 19:56:11
++++ sqlite-src-modified/test/alterauth2.test	2026-08-20 20:00:31
+@@ -53,11 +53,11 @@
+ }
+
+ do_auth_test 1.1 {
+   ALTER TABLE t1 RENAME TO t2;
+ } {
+-    {SQLITE_ALTER_TABLE main t1 {} {}} 
++    {SQLITE_ALTER_TABLE main t1 t2 {}} 
+     {SQLITE_FUNCTION {} like {} {}} 
+   {SQLITE_FUNCTION {} sqlite_rename_table {} {}} 
+   {SQLITE_FUNCTION {} sqlite_rename_test {} {}} 
+     {SQLITE_FUNCTION {} substr {} {}} 
+     {SQLITE_READ sqlite_master name main {}}