SQLite 3.54.0 ships a CLI overhaul and new limits for untrusted SQL

SQLite version 3.54.0 is dated 9 October 2026. The news page and the download page match that version, and the release check-in is by drh at 15:46:58 UTC, comment “Version 3.54.0”, with the same source id. The draft changelog is still headed “SQLite Release 3.54.0 On 2026-10-15”, marked DRAFT, hashes pending.

The shell

Prompt strings may contain escape sequences that expand to session state. If SQLITE_PS1 or SQLITE_PS2 is set, that value initializes the prompt. The default prompt honors NO_COLOR.

Columnar modes show the column-name header even when a query returns no rows. .mode gains --rowcount on and --titles always. The notes say --titles always is now the default, and that the previous behavior returns with -titles on, written there with a single dash. --ifmt and --fpfmt are printf-style formats for integers and floating-point values.

.diskused, built on the optional diskused() function, takes the place of the stand-alone sqlite3_analyzer. The news page says this is the last release that will ship that program, and that it is deprecated. The 3.54.0 tool archives on the download page still include it.

A line that contains only go or / no longer ends a statement. Those endings were there for SQL Server and Oracle habits. They remain only if the shell is compiled with -DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR.

Planner, names, and new calls

An UPDATE on a table with expression indexes skips the index when the indexed value did not change. The planner also tightens expr OR TRUE and expr OR FALSE, ignores DISTINCT on the right-hand side of IN, and handles a UNION with LIMIT 1 with less time and memory. ALTER TABLE errors on adding, dropping, or renaming a column named ROWID, _ROWID_, or OID.

printf() and format() gain %J and %j, which render a string as a JSON string literal. %J adds the quotes. %j omits them. The printf page says both first appeared in 3.54.0.

sqlite3_result_str() returns a dynamic string from an SQL function. sqlite3_incomplete(), on the sqlite3_complete() page, reports whether input looks finished. The notes say the new prompt uses it.

Date and time functions gain end of month, end of year, and end of day (last millisecond of that period, from 3.54.0) and weekday -N, which moves backward. N must be from -6 to +6, and negative values start in this release.

Windows, and SQLite’s own timings

Windows builds now require Windows Vista (about 2007) or later. XP, earlier Windows, and Windows CE are dropped: the news post says the library will not compile there because non-recursive mutexes use Slim Reader/Writer locks, which XP does not have. The notes say Linux, Mac, BSD, and other Unix builds are unchanged.

SQLite’s own figure: about 4% faster on speedtest1, counting CPU cycles with valgrind on Linux x64, and about 7.5% faster than 3.51.0. The notes say that depends on workload, build options, CPU, compiler, and operating system.

What the news log says about AI-found bugs

The 3.54.0 item says the release includes “countless fixes for AI-discovered bugs.” The 3.53.4 entry, dated 24 July 2026 on the same news page, is the longer account:

There was a huge rush of AI-aided bug reporting shortly after the 3.53.0 release (2026-04-09), but lately the rate of bug reports has declined noticably, and the bugs that are being reported are increasingly insignificant. Could it be that the AI-bug avalanche is coming to an end, and that all of the bugs that AIs are able to find have now nearly all been found and fixed?

That entry calls 3.53.4 a patch “with fixes for (mostly) AI-discovered bugs,” and it suggested the next release might be 3.54.0, “with enhancements and new features.” (“noticably” is the page’s spelling.)

When the SQL comes from a model

Local-first tools and agent apps already store state in SQLite. For a connection that runs SQL the application did not write, SQLite’s limit page says run-time limits are for databases controlled by untrusted external sources, and it points at the authorizer “to further control untrusted SQL.” Applying that to model-generated statements is guidance for the application.

The authorizer now runs for SQL functions in DEFAULT clauses of CREATE TABLE, both when the CREATE TABLE is issued and when the default is used. It does not run while SQLite is only reading the schema to open a database. An authorizer that allows a named set of functions will see those defaults.

sqlite3_limit() gains SQLITE_LIMIT_SCHEMA and SQLITE_LIMIT_TRIGGER_STEPS: a cap on tables, indexes, triggers, and views, and a cap on SQL statements inside one trigger. The limits page says the default schema maximum, from 3.54.0, is 10 million, “far more than any reasonable schema needs.” It states no default for trigger steps. On a connection that accepts generated CREATE statements, set both lower and keep the authorizer on. A ceiling of ten million objects will not stop a runaway one.

Related reading: SQLite for a small AI app and one file as the default store.

Upgrade notes

Scripts that terminate SQL with a bare go or / line need a change, or -DSQLITE_SHELL_LEGACY_COMMAND_TERMINATOR at compile time. sqlite3_analyzer still ships and is deprecated in favor of .diskused. Windows older than Vista will not compile. Retest authorizers against DEFAULT functions, and lower the two new limits on any connection that runs generated SQL. The 4% and 7.5% figures are SQLite’s valgrind count, not a figure for your workload.