diff --git a/go.mod b/go.mod
index a6a030eb6..c8537f915 100644
--- a/go.mod
+++ b/go.mod
@@ -62,7 +62,7 @@ require (
 	github.com/miekg/dns v1.1.62
 	github.com/minio/minio-go/v7 v7.0.81
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/ncruces/go-sqlite3 v0.21.2
+	github.com/ncruces/go-sqlite3 v0.21.3
 	github.com/oklog/ulid v1.3.1
 	github.com/prometheus/client_golang v1.20.5
 	github.com/spf13/cobra v1.8.1
diff --git a/go.sum b/go.sum
index 09c4f9565..3dca6a3ae 100644
--- a/go.sum
+++ b/go.sum
@@ -434,8 +434,8 @@ github.com/moul/http2curl v1.0.0 h1:dRMWoAtb+ePxMlLkrCbAqh4TlPHXvoGUSQ323/9Zahs=
 github.com/moul/http2curl v1.0.0/go.mod h1:8UbvGypXm98wA/IqH45anm5Y2Z6ep6O31QGOAZ3H0fQ=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/ncruces/go-sqlite3 v0.21.2 h1:X7Ao4BwtS9h308lFtZA/stkvrzEHvAdp8g4Gko7Ehjs=
-github.com/ncruces/go-sqlite3 v0.21.2/go.mod h1:zxMOaSG5kFYVFK4xQa0pdwIszqxqJ0W0BxBgwdrNjuA=
+github.com/ncruces/go-sqlite3 v0.21.3 h1:hHkfNQLcbnxPJZhC/RGw9SwP3bfkv/Y0xUHWsr1CdMQ=
+github.com/ncruces/go-sqlite3 v0.21.3/go.mod h1:zxMOaSG5kFYVFK4xQa0pdwIszqxqJ0W0BxBgwdrNjuA=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=
diff --git a/vendor/github.com/ncruces/go-sqlite3/driver/driver.go b/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
index b9bb03bb7..742f308af 100644
--- a/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
+++ b/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
@@ -274,6 +274,7 @@ func (n *connector) Connect(ctx context.Context) (res driver.Conn, err error) {
 //	if err != nil {
 //		log.Fatal(err)
 //	}
+//	defer conn.Close()
 //
 //	err = conn.Raw(func(driverConn any) error {
 //		conn := driverConn.(driver.Conn)
diff --git a/vendor/github.com/ncruces/go-sqlite3/driver/util.go b/vendor/github.com/ncruces/go-sqlite3/driver/util.go
index 033841157..987585576 100644
--- a/vendor/github.com/ncruces/go-sqlite3/driver/util.go
+++ b/vendor/github.com/ncruces/go-sqlite3/driver/util.go
@@ -12,3 +12,63 @@ func namedValues(args []driver.Value) []driver.NamedValue {
 	}
 	return named
 }
+
+func notWhitespace(sql string) bool {
+	const (
+		code = iota
+		slash
+		minus
+		ccomment
+		sqlcomment
+		endcomment
+	)
+
+	state := code
+	for _, b := range ([]byte)(sql) {
+		if b == 0 {
+			break
+		}
+
+		switch state {
+		case code:
+			switch b {
+			case '/':
+				state = slash
+			case '-':
+				state = minus
+			case ' ', ';', '\t', '\n', '\v', '\f', '\r':
+				continue
+			default:
+				return true
+			}
+		case slash:
+			if b != '*' {
+				return true
+			}
+			state = ccomment
+		case minus:
+			if b != '-' {
+				return true
+			}
+			state = sqlcomment
+		case ccomment:
+			if b == '*' {
+				state = endcomment
+			}
+		case sqlcomment:
+			if b == '\n' {
+				state = code
+			}
+		case endcomment:
+			switch b {
+			case '/':
+				state = code
+			case '*':
+				state = endcomment
+			default:
+				state = ccomment
+			}
+		}
+	}
+	return state == slash || state == minus
+}
diff --git a/vendor/github.com/ncruces/go-sqlite3/driver/whitespace.go b/vendor/github.com/ncruces/go-sqlite3/driver/whitespace.go
deleted file mode 100644
index 8f45706f5..000000000
--- a/vendor/github.com/ncruces/go-sqlite3/driver/whitespace.go
+++ /dev/null
@@ -1,61 +0,0 @@
-package driver
-
-func notWhitespace(sql string) bool {
-	const (
-		code = iota
-		slash
-		minus
-		ccomment
-		sqlcomment
-		endcomment
-	)
-
-	state := code
-	for _, b := range ([]byte)(sql) {
-		if b == 0 {
-			break
-		}
-
-		switch state {
-		case code:
-			switch b {
-			case '/':
-				state = slash
-			case '-':
-				state = minus
-			case ' ', ';', '\t', '\n', '\v', '\f', '\r':
-				continue
-			default:
-				return true
-			}
-		case slash:
-			if b != '*' {
-				return true
-			}
-			state = ccomment
-		case minus:
-			if b != '-' {
-				return true
-			}
-			state = sqlcomment
-		case ccomment:
-			if b == '*' {
-				state = endcomment
-			}
-		case sqlcomment:
-			if b == '\n' {
-				state = code
-			}
-		case endcomment:
-			switch b {
-			case '/':
-				state = code
-			case '*':
-				state = endcomment
-			default:
-				state = ccomment
-			}
-		}
-	}
-	return state == slash || state == minus
-}
diff --git a/vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_unix.go b/vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_unix.go
index 5d5ca3823..4ff056666 100644
--- a/vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_unix.go
+++ b/vendor/github.com/ncruces/go-sqlite3/internal/util/mmap_unix.go
@@ -39,13 +39,13 @@ func (s *mmapState) new(ctx context.Context, mod api.Module, size int32) *Mapped
 	// Save the newly allocated region.
 	ptr := uint32(stack[0])
 	buf := View(mod, ptr, uint64(size))
-	addr := unsafe.Pointer(&buf[0])
-	s.regions = append(s.regions, &MappedRegion{
+	res := &MappedRegion{
 		Ptr:  ptr,
-		addr: addr,
 		size: size,
-	})
-	return s.regions[len(s.regions)-1]
+		addr: unsafe.Pointer(&buf[0]),
+	}
+	s.regions = append(s.regions, res)
+	return res
 }
 
 type MappedRegion struct {
diff --git a/vendor/github.com/ncruces/go-sqlite3/sqlite.go b/vendor/github.com/ncruces/go-sqlite3/sqlite.go
index 2afe9971c..18a2c2a73 100644
--- a/vendor/github.com/ncruces/go-sqlite3/sqlite.go
+++ b/vendor/github.com/ncruces/go-sqlite3/sqlite.go
@@ -265,10 +265,11 @@ func (a *arena) mark() (reset func()) {
 	ptrs := len(a.ptrs)
 	next := a.next
 	return func() {
-		for _, ptr := range a.ptrs[ptrs:] {
+		rest := a.ptrs[ptrs:]
+		for _, ptr := range a.ptrs[:ptrs] {
 			a.sqlt.free(ptr)
 		}
-		a.ptrs = a.ptrs[:ptrs]
+		a.ptrs = rest
 		a.next = next
 	}
 }
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/lock.go b/vendor/github.com/ncruces/go-sqlite3/vfs/lock.go
index 8828662d4..b28d83230 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/lock.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/lock.go
@@ -20,12 +20,10 @@
 )
 
 func (f *vfsFile) Lock(lock LockLevel) error {
-	// Argument check. SQLite never explicitly requests a pending lock.
-	if lock != LOCK_SHARED && lock != LOCK_RESERVED && lock != LOCK_EXCLUSIVE {
-		panic(util.AssertErr())
-	}
-
 	switch {
+	case lock != LOCK_SHARED && lock != LOCK_RESERVED && lock != LOCK_EXCLUSIVE:
+		// Argument check. SQLite never explicitly requests a pending lock.
+		panic(util.AssertErr())
 	case f.lock < LOCK_NONE || f.lock > LOCK_EXCLUSIVE:
 		// Connection state check.
 		panic(util.AssertErr())
@@ -87,13 +85,12 @@ func (f *vfsFile) Lock(lock LockLevel) error {
 }
 
 func (f *vfsFile) Unlock(lock LockLevel) error {
-	// Argument check.
-	if lock != LOCK_NONE && lock != LOCK_SHARED {
+	switch {
+	case lock != LOCK_NONE && lock != LOCK_SHARED:
+		// Argument check.
 		panic(util.AssertErr())
-	}
-
-	// Connection state check.
-	if f.lock < LOCK_NONE || f.lock > LOCK_EXCLUSIVE {
+	case f.lock < LOCK_NONE || f.lock > LOCK_EXCLUSIVE:
+		// Connection state check.
 		panic(util.AssertErr())
 	}
 
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
index 10d6dbf61..5f4f5d108 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
@@ -22,7 +22,7 @@ type vfsShmParent struct {
 
 	refs int // +checklocks:vfsShmListMtx
 
-	lock [_SHM_NLOCK]int16 // +checklocks:Mutex
+	lock [_SHM_NLOCK]int8 // +checklocks:Mutex
 	sync.Mutex
 }
 
@@ -184,10 +184,22 @@ func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 		return rc
 	}
 
-	// Obtain/release the appropriate file lock.
+	// Obtain/release the appropriate file locks.
 	switch {
 	case flags&_SHM_UNLOCK != 0:
-		return osUnlock(s.File, _SHM_BASE+int64(offset), int64(n))
+		begin, end := offset, offset+n
+		for i := begin; i < end; i++ {
+			if s.vfsShmParent.lock[i] != 0 {
+				if i > begin {
+					rc |= osUnlock(s.File, _SHM_BASE+int64(begin), int64(i-begin))
+				}
+				begin = i + 1
+			}
+		}
+		if end > begin {
+			rc |= osUnlock(s.File, _SHM_BASE+int64(begin), int64(end-begin))
+		}
+		return rc
 	case flags&_SHM_SHARED != 0:
 		rc = osReadLock(s.File, _SHM_BASE+int64(offset), int64(n))
 	case flags&_SHM_EXCLUSIVE != 0:
@@ -196,7 +208,7 @@ func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 		panic(util.AssertErr())
 	}
 
-	// Release the local lock.
+	// Release the local lock we had acquired.
 	if rc != _OK {
 		s.shmMemLock(offset, n, flags^(_SHM_UNLOCK|_SHM_LOCK))
 	}
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_dotlk.go b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_dotlk.go
index 17fefe562..842bea8f5 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_dotlk.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_dotlk.go
@@ -18,7 +18,7 @@ type vfsShmParent struct {
 	shared [][_WALINDEX_PGSZ]byte
 	refs   int // +checklocks:vfsShmListMtx
 
-	lock [_SHM_NLOCK]int16 // +checklocks:Mutex
+	lock [_SHM_NLOCK]int8 // +checklocks:Mutex
 	sync.Mutex
 }
 
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_memlk.go b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_memlk.go
index 404019642..5c8071ebe 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_memlk.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_memlk.go
@@ -10,9 +10,6 @@ func (s *vfsShm) shmMemLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 	case flags&_SHM_UNLOCK != 0:
 		for i := offset; i < offset+n; i++ {
 			if s.lock[i] {
-				if s.vfsShmParent.lock[i] == 0 {
-					panic(util.AssertErr())
-				}
 				if s.vfsShmParent.lock[i] <= 0 {
 					s.vfsShmParent.lock[i] = 0
 				} else {
@@ -23,20 +20,21 @@ func (s *vfsShm) shmMemLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 		}
 	case flags&_SHM_SHARED != 0:
 		for i := offset; i < offset+n; i++ {
-			if s.lock[i] {
-				panic(util.AssertErr())
-			}
-			if s.vfsShmParent.lock[i]+1 <= 0 {
+			if !s.lock[i] &&
+				s.vfsShmParent.lock[i]+1 <= 0 {
 				return _BUSY
 			}
 		}
 		for i := offset; i < offset+n; i++ {
-			s.vfsShmParent.lock[i]++
-			s.lock[i] = true
+			if !s.lock[i] {
+				s.vfsShmParent.lock[i]++
+				s.lock[i] = true
+			}
 		}
 	case flags&_SHM_EXCLUSIVE != 0:
 		for i := offset; i < offset+n; i++ {
 			if s.lock[i] {
+				// SQLite never requests an exclusive lock that it already holds.
 				panic(util.AssertErr())
 			}
 			if s.vfsShmParent.lock[i] != 0 {
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_ofd.go b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_ofd.go
index d335a85fc..dd3611193 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_ofd.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_ofd.go
@@ -110,7 +110,12 @@ func (s *vfsShm) shmMap(ctx context.Context, mod api.Module, id, size int32, ext
 
 func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 	// Argument check.
-	if n <= 0 || offset < 0 || offset+n > _SHM_NLOCK {
+	switch {
+	case n <= 0:
+		panic(util.AssertErr())
+	case offset < 0 || offset+n > _SHM_NLOCK:
+		panic(util.AssertErr())
+	case n != 1 && flags&_SHM_EXCLUSIVE == 0:
 		panic(util.AssertErr())
 	}
 	switch flags {
@@ -123,9 +128,6 @@ func (s *vfsShm) shmLock(offset, n int32, flags _ShmFlag) _ErrorCode {
 	default:
 		panic(util.AssertErr())
 	}
-	if n != 1 && flags&_SHM_EXCLUSIVE == 0 {
-		panic(util.AssertErr())
-	}
 
 	var timeout time.Duration
 	if s.blocking {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e0aef8e18..5e0734f84 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -520,7 +520,7 @@ github.com/modern-go/reflect2
 # github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822
 ## explicit
 github.com/munnerz/goautoneg
-# github.com/ncruces/go-sqlite3 v0.21.2
+# github.com/ncruces/go-sqlite3 v0.21.3
 ## explicit; go 1.21
 github.com/ncruces/go-sqlite3
 github.com/ncruces/go-sqlite3/driver