Upgrade org.xerial:sqlite-jdbc 3.36.0.3 -> 3.53.2.0

[devin-ai-integration]

Summary

Upgrades the SQLite JDBC driver from a 2021 build to the current release. This is
a version-only change — the app never touches org.sqlite.* directly (all access
goes through Flyway, MyBatis and Hikari over plain JDBC), so no source migration
was required.

-implementation 'org.xerial:sqlite-jdbc:3.36.0.3'
+implementation 'org.xerial:sqlite-jdbc:3.53.2.0'

Version choice: 3.53.2.0 (published 2026-06-04) rather than the very latest
3.53.2.1 (published 2026-07-21, 6 days ago), to respect the "prefer a release
published at least 7 days ago" rule. 3.53.2.0 is compiled to Java 8 bytecode
(major version 52) and is therefore compatible with the Java 11 / Spring Boot
2.6.3 ceiling; no Boot or Flyway bump was needed.

BOM / ext override

None needed. Spring Boot's spring-boot-dependencies:2.6.3 BOM does not manage
org.xerial:sqlite-jdbc. The only competing pin comes transitively from the DGS
codegen platform ({prefer 3.31.1}), which the direct declaration wins over.

dependencyInsight evidence

./gradlew dependencyInsight --configuration runtimeClasspath --dependency org.xerial:sqlite-jdbc

org.xerial:sqlite-jdbc:3.53.2.0
   variant "runtime" [ org.gradle.status = release (not requested) ... ]
   Selection reasons:
      - Selected by rule
      - By constraint

org.xerial:sqlite-jdbc:3.53.2.0
\--- runtimeClasspath

org.xerial:sqlite-jdbc:{prefer 3.31.1} -> 3.53.2.0
\--- com.netflix.graphql.dgs:graphql-dgs-platform-dependencies:4.3.1
     \--- com.netflix.graphql.dgs.codegen:graphql-dgs-codegen-client-core:5.0.6
          \--- runtimeClasspath

testRuntimeClasspath resolves identically to 3.53.2.0. Single version on both
classpaths — no conflict-resolution downgrade, no split classpath.

API migration

No source changes needed. grep -rn "org.sqlite" src/ matches exactly one
line, the driver class name in src/main/resources/application.properties
(spring.datasource.driver-class-name=org.sqlite.JDBC), which is unchanged in
3.53.x. spring.datasource.url=jdbc:sqlite:dev.db (and jdbc:sqlite::memory:
for tests) and the clean / bootRun delete './dev.db' hooks contain nothing
version-specific. Only the version literal in build.gradle and the two stale
sqlite-jdbc references in the repo skill doc were touched.

Flyway compatibility (BOM-managed, not bumped)

Flyway stays at the Boot 2.6.3-managed 8.0.5. It detects the new engine
cleanly and applies both migrations — no version warning, no conflict, so there
is nothing to report against the "do not bump Flyway" constraint:

o.f.c.i.database.base.BaseDatabaseType : Database: jdbc:sqlite::memory: (SQLite 3.53)
o.f.c.i.database.base.BaseDatabaseType : Database: jdbc:sqlite:dev.db  (SQLite 3.53)
o.f.core.internal.command.DbMigrate    : Migrating schema "main" to version "1 - create tables"
o.f.core.internal.command.DbMigrate    : Migrating schema "main" to version "2 - seed data"
o.f.core.internal.command.DbMigrate    : Successfully applied 2 migrations to schema "main", now at version v2

Verification gate

JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64 ./gradlew clean test spotlessCheck -x jacocoTestCoverageVerification
(clean tree, JDK 11 — same JDK as CI)

	baseline on main @ 3037fa5	this branch
tests	68	68
failures	0	0
errors	0	0
skipped	0	0
spotlessCheck	green	green
result	BUILD SUCCESSFUL	BUILD SUCCESSFUL

Counts aggregated from build/test-results/test/*.xml on both runs. Runtime
smoke test beyond the gate: ./gradlew bootRun starts, recreates dev.db with
the new driver's native library, applies both Flyway migrations, and
GET /tags returns 200 with the seeded tag list.

Pre-existing on base, not addressed here

• jacocoTestCoverageVerification fails at 0.33 instruction coverage against the
  0.80 rule in build.gradle. Already red on untouched main; CI excludes the
  task (./gradlew clean test -x jacocoTestCoverageVerification) and so does the
  gate above. Threshold untouched, no tests added to game it.
• Selenium E2E tests (src/test/java/io/spring/selenium) run under the separate
  seleniumTest TestNG task and are excluded from the test task; out of scope.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/67b38181ed8440ce84806f6bf636bb99
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring