diff --git a/go.mod b/go.mod
index 1d78b0700..0846e0375 100644
--- a/go.mod
+++ b/go.mod
@@ -45,7 +45,7 @@ require (
 	github.com/miekg/dns v1.1.61
 	github.com/minio/minio-go/v7 v7.0.71
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/ncruces/go-sqlite3 v0.16.2
+	github.com/ncruces/go-sqlite3 v0.16.3
 	github.com/oklog/ulid v1.3.1
 	github.com/prometheus/client_golang v1.19.1
 	github.com/spf13/cobra v1.8.1
diff --git a/go.sum b/go.sum
index d87b9a721..6d0bfa0c0 100644
--- a/go.sum
+++ b/go.sum
@@ -441,8 +441,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/moul/http2curl v1.0.0 h1:dRMWoAtb+ePxMlLkrCbAqh4TlPHXvoGUSQ323/9Zahs=
 github.com/moul/http2curl v1.0.0/go.mod h1:8UbvGypXm98wA/IqH45anm5Y2Z6ep6O31QGOAZ3H0fQ=
-github.com/ncruces/go-sqlite3 v0.16.2 h1:HesVRr0BC6QSGSEQfEXOntFWS9wd4Z8ms4nJzfUv4Rg=
-github.com/ncruces/go-sqlite3 v0.16.2/go.mod h1:wkUIvOrAjFQnefVlivJfcowKUcfMHs4mvLfhVanzHHI=
+github.com/ncruces/go-sqlite3 v0.16.3 h1:Ky0denOdmAGOoCE6lQlw6GCJNMD8gTikNWe8rpu+Gjc=
+github.com/ncruces/go-sqlite3 v0.16.3/go.mod h1:sAU/vQwBmZ2hq5BlW/KTzqRFizL43bv2JQoBLgXhcMI=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
 github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/ncruces/julianday v1.0.0 h1:fH0OKwa7NWvniGQtxdJRxAgkBMolni2BjDHaWTxqt7M=
diff --git a/vendor/github.com/ncruces/go-sqlite3/README.md b/vendor/github.com/ncruces/go-sqlite3/README.md
index c31414724..25b2ccbe4 100644
--- a/vendor/github.com/ncruces/go-sqlite3/README.md
+++ b/vendor/github.com/ncruces/go-sqlite3/README.md
@@ -33,6 +33,8 @@ Go, wazero and [`x/sys`](https://pkg.go.dev/golang.org/x/sys) are the _only_ run
   provides the [`array`](https://sqlite.org/carray.html) table-valued function.
 - [`github.com/ncruces/go-sqlite3/ext/blobio`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/ext/blobio)
   simplifies [incremental BLOB I/O](https://sqlite.org/c3ref/blob_open.html).
+- [`github.com/ncruces/go-sqlite3/ext/bloom`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/ext/bloom)
+  provides a [Bloom filter](https://github.com/nalgeon/sqlean/issues/27#issuecomment-1002267134) virtual table.
 - [`github.com/ncruces/go-sqlite3/ext/csv`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/ext/csv)
   reads [comma-separated values](https://sqlite.org/csv.html).
 - [`github.com/ncruces/go-sqlite3/ext/fileio`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/ext/fileio)
@@ -51,12 +53,12 @@ Go, wazero and [`x/sys`](https://pkg.go.dev/golang.org/x/sys) are the _only_ run
   provides [Unicode aware](https://sqlite.org/src/dir/ext/icu) functions.
 - [`github.com/ncruces/go-sqlite3/ext/zorder`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/ext/zorder)
   maps multidimensional data to one dimension.
+- [`github.com/ncruces/go-sqlite3/vfs/adiantum`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/adiantum)
+  wraps a VFS to offer encryption at rest.
 - [`github.com/ncruces/go-sqlite3/vfs/memdb`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/memdb)
   implements an in-memory VFS.
 - [`github.com/ncruces/go-sqlite3/vfs/readervfs`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/readervfs)
   implements a VFS for immutable databases.
-- [`github.com/ncruces/go-sqlite3/vfs/adiantum`](https://pkg.go.dev/github.com/ncruces/go-sqlite3/vfs/adiantum)
-  wraps a VFS to offer encryption at rest.
 
 ### Advanced features
 
diff --git a/vendor/github.com/ncruces/go-sqlite3/driver/driver.go b/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
index b496f76ec..e7863b1b8 100644
--- a/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
+++ b/vendor/github.com/ncruces/go-sqlite3/driver/driver.go
@@ -229,6 +229,7 @@ func (c *conn) Raw() *sqlite3.Conn {
 	return c.Conn
 }
 
+// Deprecated: use BeginTx instead.
 func (c *conn) Begin() (driver.Tx, error) {
 	return c.BeginTx(context.Background(), driver.TxOptions{})
 }
@@ -301,7 +302,7 @@ func (c *conn) PrepareContext(ctx context.Context, query string) (driver.Stmt, e
 		s.Close()
 		return nil, util.TailErr
 	}
-	return &stmt{Stmt: s, tmRead: c.tmRead, tmWrite: c.tmWrite}, nil
+	return &stmt{Stmt: s, tmRead: c.tmRead, tmWrite: c.tmWrite, inputs: -2}, nil
 }
 
 func (c *conn) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Result, error) {
@@ -335,6 +336,7 @@ type stmt struct {
 	*sqlite3.Stmt
 	tmWrite sqlite3.TimeFormat
 	tmRead  sqlite3.TimeFormat
+	inputs  int
 }
 
 var (
@@ -345,12 +347,17 @@ var (
 )
 
 func (s *stmt) NumInput() int {
+	if s.inputs >= -1 {
+		return s.inputs
+	}
 	n := s.Stmt.BindCount()
 	for i := 1; i <= n; i++ {
 		if s.Stmt.BindName(i) != "" {
+			s.inputs = -1
 			return -1
 		}
 	}
+	s.inputs = n
 	return n
 }
 
@@ -389,12 +396,7 @@ func (s *stmt) QueryContext(ctx context.Context, args []driver.NamedValue) (driv
 	return &rows{ctx: ctx, stmt: s}, nil
 }
 
-func (s *stmt) setupBindings(args []driver.NamedValue) error {
-	err := s.Stmt.ClearBindings()
-	if err != nil {
-		return err
-	}
-
+func (s *stmt) setupBindings(args []driver.NamedValue) (err error) {
 	var ids [3]int
 	for _, arg := range args {
 		ids := ids[:0]
@@ -558,19 +560,20 @@ func (r *rows) Next(dest []driver.Value) error {
 	return err
 }
 
-func (r *rows) decodeTime(i int, v any) (_ time.Time, _ bool) {
+func (r *rows) decodeTime(i int, v any) (_ time.Time, ok bool) {
 	if r.tmRead == sqlite3.TimeFormatDefault {
-		return
-	}
-	switch r.declType(i) {
-	case "DATE", "TIME", "DATETIME", "TIMESTAMP":
-		// maybe
-	default:
+		// handled by maybeTime
 		return
 	}
 	switch v.(type) {
 	case int64, float64, string:
-		// maybe
+		// could be a time value
+	default:
+		return
+	}
+	switch r.declType(i) {
+	case "DATE", "TIME", "DATETIME", "TIMESTAMP":
+		// could be a time value
 	default:
 		return
 	}
diff --git a/vendor/github.com/ncruces/go-sqlite3/embed/README.md b/vendor/github.com/ncruces/go-sqlite3/embed/README.md
index 400fe870a..0156f0176 100644
--- a/vendor/github.com/ncruces/go-sqlite3/embed/README.md
+++ b/vendor/github.com/ncruces/go-sqlite3/embed/README.md
@@ -24,4 +24,7 @@ See the [configuration options](../sqlite3/sqlite_cfg.h),
 and [patches](../sqlite3) applied.
 
 Built using [`wasi-sdk`](https://github.com/WebAssembly/wasi-sdk),
-and [`binaryen`](https://github.com/WebAssembly/binaryen).
\ No newline at end of file
+and [`binaryen`](https://github.com/WebAssembly/binaryen).
+
+The build is easily reproducible, and verifiable, using
+[Artifact Attestations](https://github.com/ncruces/go-sqlite3/attestations).
\ No newline at end of file
diff --git a/vendor/github.com/ncruces/go-sqlite3/embed/sqlite3.wasm b/vendor/github.com/ncruces/go-sqlite3/embed/sqlite3.wasm
index 2689f773a..8dfc7da0c 100644
Binary files a/vendor/github.com/ncruces/go-sqlite3/embed/sqlite3.wasm and b/vendor/github.com/ncruces/go-sqlite3/embed/sqlite3.wasm differ
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/const.go b/vendor/github.com/ncruces/go-sqlite3/vfs/const.go
index f7217af96..2fc934f33 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/const.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/const.go
@@ -51,6 +51,7 @@ const (
 	_IOERR_BEGIN_ATOMIC      _ErrorCode = util.IOERR_BEGIN_ATOMIC
 	_IOERR_COMMIT_ATOMIC     _ErrorCode = util.IOERR_COMMIT_ATOMIC
 	_IOERR_ROLLBACK_ATOMIC   _ErrorCode = util.IOERR_ROLLBACK_ATOMIC
+	_BUSY_SNAPSHOT           _ErrorCode = util.BUSY_SNAPSHOT
 	_CANTOPEN_FULLPATH       _ErrorCode = util.CANTOPEN_FULLPATH
 	_CANTOPEN_ISDIR          _ErrorCode = util.CANTOPEN_ISDIR
 	_READONLY_CANTINIT       _ErrorCode = util.READONLY_CANTINIT
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/memdb/README.md b/vendor/github.com/ncruces/go-sqlite3/vfs/memdb/README.md
index 193e29d98..2e2611bf8 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/memdb/README.md
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/memdb/README.md
@@ -1,4 +1,4 @@
-# Go `"memdb"` SQLite VFS
+# Go `memdb` SQLite VFS
 
 This package implements the [`"memdb"`](https://sqlite.org/src/doc/tip/src/memdb.c)
 SQLite VFS in pure Go.
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/os_bsd.go b/vendor/github.com/ncruces/go-sqlite3/vfs/os_bsd.go
index 48ac5c9c9..9f3c99daf 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/os_bsd.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/os_bsd.go
@@ -29,5 +29,12 @@ func osReadLock(file *os.File, _ /*start*/, _ /*len*/ int64, _ /*timeout*/ time.
 }
 
 func osWriteLock(file *os.File, _ /*start*/, _ /*len*/ int64, _ /*timeout*/ time.Duration) _ErrorCode {
-	return osLock(file, unix.LOCK_EX|unix.LOCK_NB, _IOERR_LOCK)
+	rc := osLock(file, unix.LOCK_EX|unix.LOCK_NB, _IOERR_LOCK)
+	if rc == _BUSY {
+		// The documentation states the lock is upgraded by releasing the previous lock,
+		// then acquiring the new lock.
+		// This is a race, so return BUSY_SNAPSHOT to ensure the transaction is aborted.
+		return _BUSY_SNAPSHOT
+	}
+	return rc
 }
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/os_unix_lock.go b/vendor/github.com/ncruces/go-sqlite3/vfs/os_unix_lock.go
index d04c1f6a0..85a7b0fc0 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/os_unix_lock.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/os_unix_lock.go
@@ -48,7 +48,7 @@ func osDowngradeLock(file *os.File, state LockLevel) _ErrorCode {
 			// In theory, the downgrade to a SHARED cannot fail because another
 			// process is holding an incompatible lock. If it does, this
 			// indicates that the other process is not following the locking
-			// protocol. If this happens, return _IOERR_RDLOCK. Returning
+			// protocol. If this happens, return IOERR_RDLOCK. Returning
 			// BUSY would confuse the upper layer.
 			return _IOERR_RDLOCK
 		}
diff --git a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
index 8c2abee81..ffeb3e0a0 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vfs/shm_bsd.go
@@ -128,10 +128,11 @@ func (s *vfsShm) shmOpen() (rc _ErrorCode) {
 	}
 
 	// Lock and truncate the file, if not readonly.
+	// The lock is only released by closing the file.
 	if s.readOnly {
 		rc = _READONLY_CANTINIT
 	} else {
-		if rc := osWriteLock(f, 0, 0, 0); rc != _OK {
+		if rc := osLock(f, unix.LOCK_EX|unix.LOCK_NB, _IOERR_LOCK); rc != _OK {
 			return rc
 		}
 		if err := f.Truncate(0); err != nil {
diff --git a/vendor/github.com/ncruces/go-sqlite3/vtab.go b/vendor/github.com/ncruces/go-sqlite3/vtab.go
index a330c98ff..7c19330bb 100644
--- a/vendor/github.com/ncruces/go-sqlite3/vtab.go
+++ b/vendor/github.com/ncruces/go-sqlite3/vtab.go
@@ -16,14 +16,15 @@ func CreateModule[T VTab](db *Conn, name string, create, connect VTabConstructor
 	var flags int
 
 	const (
-		VTAB_CREATOR     = 0x01
-		VTAB_DESTROYER   = 0x02
-		VTAB_UPDATER     = 0x04
-		VTAB_RENAMER     = 0x08
-		VTAB_OVERLOADER  = 0x10
-		VTAB_CHECKER     = 0x20
-		VTAB_TXN         = 0x40
-		VTAB_SAVEPOINTER = 0x80
+		VTAB_CREATOR     = 0x001
+		VTAB_DESTROYER   = 0x002
+		VTAB_UPDATER     = 0x004
+		VTAB_RENAMER     = 0x008
+		VTAB_OVERLOADER  = 0x010
+		VTAB_CHECKER     = 0x020
+		VTAB_TXN         = 0x040
+		VTAB_SAVEPOINTER = 0x080
+		VTAB_SHADOWTABS  = 0x100
 	)
 
 	if create != nil {
@@ -52,6 +53,9 @@ func CreateModule[T VTab](db *Conn, name string, create, connect VTabConstructor
 	if implements[VTabSavepointer](vtab) {
 		flags |= VTAB_SAVEPOINTER
 	}
+	if implements[VTabShadowTabler](vtab) {
+		flags |= VTAB_SHADOWTABS
+	}
 
 	defer db.arena.mark()()
 	namePtr := db.arena.string(name)
@@ -174,6 +178,17 @@ type VTabOverloader interface {
 	FindFunction(arg int, name string) (ScalarFunction, IndexConstraintOp)
 }
 
+// A VTabShadowTabler allows a virtual table to protect the content
+// of shadow tables from being corrupted by hostile SQL.
+//
+// Implementing this interface signals that a virtual table named
+// "mumble" reserves all table names starting with "mumble_".
+type VTabShadowTabler interface {
+	VTab
+	// https://sqlite.org/vtab.html#the_xshadowname_method
+	ShadowTables()
+}
+
 // A VTabChecker allows a virtual table to report errors
 // to the PRAGMA integrity_check and PRAGMA quick_check commands.
 //
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 94157fa66..1ede93c2c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -516,7 +516,7 @@ github.com/modern-go/concurrent
 # github.com/modern-go/reflect2 v1.0.2
 ## explicit; go 1.12
 github.com/modern-go/reflect2
-# github.com/ncruces/go-sqlite3 v0.16.2
+# github.com/ncruces/go-sqlite3 v0.16.3
 ## explicit; go 1.21
 github.com/ncruces/go-sqlite3
 github.com/ncruces/go-sqlite3/driver