refactor: Migrated from github.com/mattn/go-sqlite3 to modernc.org/sqlite

.devcontainer/Dockerfile

@@ -5,7 +5,7 @@ ARG DEBIAN_FRONTEND=noninteractive
 USER root
 WORKDIR /root
 ENV HOME="/root"
-# TODO: Remove after GitHub issue #113 is done. Also remove build-essential from the apt-get install command below too.
+# Need to set CGO_ENABLED=1 to enable race detection in the tests. This is required for the tests to run correctly.
 ENV CGO_ENABLED=1
 
 RUN apt-get update && apt-get install -y \

.github/workflows/ci.yml

@@ -25,11 +25,6 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Install C dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
-
       - name: Build
         run: make build
 
@@ -48,11 +43,6 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Install C dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
-
       - name: Run tests
         run: make test
 
@@ -112,11 +102,6 @@ jobs:
           cache: true
           cache-dependency-path: go.sum
 
-      - name: Install C dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y build-essential
-
       - name: Run go vet
         run: make vet
 

Dockerfile

@@ -3,7 +3,7 @@
 # -------------------
 FROM golang:1.26.4-alpine AS builder
 
-RUN apk add --no-cache git ca-certificates build-base
+RUN apk add --no-cache git ca-certificates
 
 WORKDIR /app
 
@@ -12,7 +12,7 @@ RUN go mod download
 
 COPY . ./
 
-RUN CGO_ENABLED=1 GOOS=linux go build \
+RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags="-s -w" \
     -o server ./cmd/main.go
 

Makefile

@@ -3,7 +3,7 @@ APP_NAME=authula
 BINARY_PATH=./tmp/$(APP_NAME)
 MIGRATE_CONFIG?=./config.toml
 MIGRATE_ARGS?=
-MIGRATE_CMD=CGO_ENABLED=1 go run ./cmd/migrate
+MIGRATE_CMD=CGO_ENABLED=0 go run ./cmd/migrate
 OPENAPI_EXPORT_BINARY=./tmp/openapi-export
 
 .PHONY: help build build-exe run dev test clean install setup
@@ -19,30 +19,31 @@ help: # Display this help screen
 # Build commands`
 build: # Build the package (library)
 	@echo "Building $(APP_NAME) package..."
-	@go build ./...
+	@CGO_ENABLED=0 go build ./...
 	@echo "Build complete!"
 
 build-exe: # Build the binary executable
 	@echo "Building $(APP_NAME) binary..."
 	@mkdir -p ./tmp
 	@rm -rf ./tmp/$(APP_NAME)
-	@go build -o $(BINARY_PATH) ./cmd/main.go
+	@CGO_ENABLED=0 go build -o $(BINARY_PATH) ./cmd/main.go
 	@echo "Binary built: $(BINARY_PATH)"
 
 run: # Run the application
 	@rm -f ./tmp/$(APP_NAME)
-	@CGO_ENABLED=1 go run ./cmd/main.go
+	@CGO_ENABLED=0 go run ./cmd/main.go
 
 dev: # Run the application with live reloading using air
 	@rm -f ./tmp/$(APP_NAME)
-	@CGO_ENABLED=1 ./bin/air --build.cmd "go build -o ./tmp/$(APP_NAME) ./cmd/main.go" --build.entrypoint "./tmp/$(APP_NAME)"
+	@CGO_ENABLED=0 ./bin/air --build.cmd "go build -o ./tmp/$(APP_NAME) ./cmd/main.go" --build.entrypoint "./tmp/$(APP_NAME)"
 
 openapi-export:
 	@echo "Exporting OpenAPI spec..."
-	@go run ./cmd/openapi/ $(ARGS)
+	@CGO_ENABLED=0 go run ./cmd/openapi/ $(ARGS)
 	@echo "Done!"
 
 # Test commands
+# CGO_ENABLED=1 is required by the race detector, not by any dependency of the build.
 test: # Run all tests
 	@echo "Running tests..."
 	@CGO_ENABLED=1 go test -race -v ./...

core/repositories/bun_session_repository_test.go

@@ -7,16 +7,17 @@ import (
 	"testing"
 	"time"
 
-	_ "github.com/mattn/go-sqlite3"
 	"github.com/uptrace/bun"
 	"github.com/uptrace/bun/dialect/sqlitedialect"
+	_ "modernc.org/sqlite"
 
+	"github.com/Authula/authula/internal/sqlitedsn"
 	"github.com/Authula/authula/models"
 )
 
 // Helper function to create an in-memory SQLite database for testing
 func newTestSessionDB(t *testing.T) bun.IDB {
-	sqldb, err := sql.Open("sqlite3", ":memory:")
+	sqldb, err := sql.Open("sqlite", sqlitedsn.Build(":memory:"))
 	if err != nil {
 		t.Fatalf("failed to create test database: %v", err)
 	}

go.mod

@@ -22,7 +22,6 @@ require (
 	github.com/lestrrat-go/jwx/v3 v3.1.1
 	github.com/lib/pq v1.12.3
 	github.com/lmittmann/tint v1.2.0
-	github.com/mattn/go-sqlite3 v1.14.44
 	github.com/redis/go-redis/v9 v9.22.0
 	github.com/resend/resend-go/v4 v4.3.0
 	github.com/spf13/cobra v1.10.2
@@ -40,7 +39,7 @@ require (
 	github.com/wneessen/go-mail v0.8.1
 	golang.org/x/crypto v0.57.0
 	golang.org/x/oauth2 v0.37.0
-	modernc.org/sqlite v1.51.0
+	modernc.org/sqlite v1.58.0
 	zombiezen.com/go/sqlite v1.4.2
 )
 
@@ -161,7 +160,7 @@ require (
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	modernc.org/libc v1.72.5 // indirect
+	modernc.org/libc v1.75.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
+	modernc.org/memory v1.12.1 // indirect
 )

go.sum

@@ -127,8 +127,8 @@ github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -222,8 +222,6 @@ github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
 github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
-github.com/mattn/go-sqlite3 v1.14.44 h1:3VSe+xafpbzsLbdr2AWlAZk9yRHiBhTBakioXaCKTF8=
-github.com/mattn/go-sqlite3 v1.14.44/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
 github.com/mdelapenya/tlscert v0.2.0 h1:7H81W6Z/4weDvZBNOfQte5GpIMo0lGYEeWbkGp5LJHI=
 github.com/mdelapenya/tlscert v0.2.0/go.mod h1:O4njj3ELLnJjGdkN7M/vIVCpZ+Cf0L6muqOG4tLSl8o=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -460,30 +458,30 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
-modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
-modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.2 h1:mxsy2FdrB6+qG3NfXefz1AmWv0ehOSDO4jxgxd7h9yo=
-modernc.org/ccgo/v4 v4.34.2/go.mod h1:1L7us56+kAKu04p25EATpmBBvhbcqqZ85ibqWVwVgog=
+modernc.org/cc/v4 v4.29.2 h1:h6+9ciCnPKutf4I03CvheAvDLX7+IHlqR6Iy6J+cgd8=
+modernc.org/cc/v4 v4.29.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.35.0 h1:F+TUsmw09QxLzmi3aeYYGxjAXarmZaKgj3mKQHNaA8w=
+modernc.org/ccgo/v4 v4.35.0/go.mod h1:qrVGs9S3Sr2Ztcg9ve+kTAYMp5a3YvWjo+SoN06kJ5I=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
-modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.5 h1:m2OGx9Ser1VvTS4Z9ZJlWs+CBMxutLaTiAWkNz+NB9U=
-modernc.org/libc v1.72.5/go.mod h1:np0N7KDJ7eUtMZmOqVZNldrZyG+DHLl2B5pg8Hbar3U=
+modernc.org/libc v1.75.6 h1:yKk8qo+Di4gkmvRboK8ocCqH22FiUCR6jRy2OwtCRus=
+modernc.org/libc v1.75.6/go.mod h1:bO5o2ztHxBb2rjz0PgdHN0sSMw57CgxGFLZ3Qd/QpVQ=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.51.0 h1:aH/MMSoayAIhozZ7uJbVTT9QO/VhzBf0J9tymmmuC/U=
-modernc.org/sqlite v1.51.0/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
+modernc.org/sqlite v1.58.0 h1:38u40/bwkfM7f0Myhosl+SEMltSDxnGdQf8o6Kjmys0=
+modernc.org/sqlite v1.58.0/go.mod h1:rsD2CckafgObKC4DhBlGBf+RiHxkc3hINGt1Xw32tVY=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/bootstrap/database.go

@@ -10,7 +10,7 @@ import (
 
 	_ "github.com/go-sql-driver/mysql"
 	_ "github.com/lib/pq"
-	_ "github.com/mattn/go-sqlite3"
+	_ "modernc.org/sqlite"
 
 	"github.com/uptrace/bun"
 	"github.com/uptrace/bun/dialect/mysqldialect"
@@ -19,6 +19,7 @@ import (
 	"github.com/uptrace/bun/extra/bundebug"
 
 	"github.com/Authula/authula/env"
+	"github.com/Authula/authula/internal/sqlitedsn"
 	"github.com/Authula/authula/models"
 )
 
@@ -65,7 +66,7 @@ func InitDatabase(opts DatabaseOptions, logger models.Logger, logLevel string) (
 			}
 		}
 
-		sqlDB, err = sql.Open("sqlite3", databaseURL)
+		sqlDB, err = sql.Open("sqlite", sqlitedsn.Build(databaseURL))
 		if err != nil {
 			return nil, err
 		}

internal/sqlitedsn/sqlitedsn.go

@@ -0,0 +1,73 @@
+// Package sqlitedsn builds SQLite connection strings carrying the defaults
+// Authula relies on, so that every SQLite connection - application or test -
+// behaves the same way.
+package sqlitedsn
+
+import (
+	"net/url"
+	"strings"
+)
+
+// Query parameters understood by the modernc.org/sqlite driver. Each default
+// also lists the driver's alias for the same setting so a caller supplied
+// alias is not silently duplicated.
+const (
+	busyTimeoutParam = "_busy_timeout"
+	busyTimeoutAlias = "_timeout"
+	timezoneParam    = "_timezone"
+)
+
+// The driver applies no busy timeout of its own, so a pooled writer that finds
+// the database locked fails immediately with SQLITE_BUSY instead of waiting.
+const defaultBusyTimeout = "5000"
+
+// Timestamps are scanned with time.Parse, which resolves a zero UTC offset to
+// the process local zone. Pinning the connection to UTC keeps scanned values
+// in the zone they were written in, regardless of where the process runs.
+const defaultTimezone = "UTC"
+
+var defaults = []struct {
+	param string
+	alias string
+	value string
+}{
+	{param: busyTimeoutParam, alias: busyTimeoutAlias, value: defaultBusyTimeout},
+	{param: timezoneParam, value: defaultTimezone},
+}
+
+// Build turns a SQLite target - a file path, ":memory:", or an existing "file:"
+// URI with or without query parameters - into a DSN with Authula's defaults
+// applied. Parameters already present in the target are left untouched, so a
+// caller can always override a default.
+func Build(target string) string {
+	base, query, _ := strings.Cut(target, "?")
+
+	params, err := url.ParseQuery(query)
+	if err != nil {
+		// An unparsable query is the caller's to fix; rewriting it here would
+		// only obscure the driver's error.
+		return target
+	}
+
+	for _, d := range defaults {
+		if params.Has(d.param) || (d.alias != "" && params.Has(d.alias)) {
+			continue
+		}
+		params.Set(d.param, d.value)
+	}
+
+	return uri(base) + "?" + params.Encode()
+}
+
+// uri renders base as a SQLite "file:" URI. Only the characters that would
+// otherwise terminate or misdelimit the path need escaping; escaping the rest
+// would break URIs such as "file::memory:".
+func uri(base string) string {
+	if strings.HasPrefix(base, "file:") {
+		return base
+	}
+
+	replacer := strings.NewReplacer("%", "%25", "#", "%23")
+
+	return "file:" + replacer.Replace(base)
+}