Skip to content

0.8.3 - SQLite extensions & fuzz testing

Choose a tag to compare

@ocean ocean released this 30 Dec 06:15
· 349 commits to main since this release

v0.8.3 Release Notes

New Features

RANDOM ROWID Support (libSQL Extension)

  • Generate pseudorandom row IDs instead of sequential integers for security/privacy
  • Prevents ID enumeration attacks and leaking business metrics
  • Usage: create table(:sessions, options: [random_rowid: true])

SQLite Extension Loading

  • Load SQLite extensions dynamically via enable_extensions/2 and load_ext/3
  • Supports FTS5, JSON1, R-Tree, PCRE, and custom extensions
  • Security-first: disabled by default, must be explicitly enabled

Enhanced Statement Introspection

  • stmt_parameter_name/3 - Get named parameter names (:name, @name, $name)
  • reset_stmt/2 - Explicitly reset statements for efficient reuse
  • get_stmt_columns/2 - Get full column metadata (name, origin, declared type)

Remote Encryption Support

  • New remote_encryption_key option for Turso encrypted databases
  • Works alongside existing local encryption_key for end-to-end encryption

Quality & Testing

  • Added Credo, Dialyxir, and Sobelow for comprehensive Elixir code analysis
  • Property-based fuzz testing with StreamData (SQL injection, transactions, edge cases)
  • Rust fuzz testing infrastructure with cargo-fuzz
  • Ported key tests from Ecto.Adapters.SQL for compatibility verification
  • Modernised Rust code: std::sync::LazyLock, stricter Clippy lints

Fixes

  • SQL injection prevention in Pragma module table name validation
  • Dialyzer type error in disconnect/2 spec
  • Improved fuzz test stability for savepoints and binary data

Changelog: https://github.com/ocean/ecto_libsql/blob/main/CHANGELOG.md
Full Changelog: 0.8.1...0.8.3