Using github.com/glebarez/go-sqlite instead of github.com/mattn/go-sqlite3 for eliminating cgo dependencies

[kamil5b]

Current State

Right now sql-migrate is using github.com/mattn/go-sqlite3 which have dependency towards cgo.
It build fine for consumer linux as I shown here:

kamil5b@PCKAMIL:~/npmw-sql-migrate$ go build -o ./bin/sql-migrate ./sql-migrate && ./bin/sql-migrate --help
Usage: sql-migrate [--version] [--help] <command> [<args>]

Available commands are:
    down      Undo a database migration
    new       Create a new migration
    redo      Reapply the last migration
    skip      Sets the database level to the most recent version available, without running the migrations
    status    Show migration status
    up        Migrates the database to the most recent version available

kamil5b@PCKAMIL:~/npmw-sql-migrate$ ./bin/sql-migrate status -config=test-integration/dbconfig.yml -env=sqlite
+---------------+-------------------------------------------+
|   MIGRATION   |                  APPLIED                  |
+---------------+-------------------------------------------+
| 1_initial.sql | 2026-01-05 17:10:21.844294144 +0700 +0700 |
| 2_record.sql  | no                                        |
+---------------+-------------------------------------------+

Problem

When build using CGO_ENABLED=0 for CI/CD and wanted for agnostic-OS. It become unusable (just for sqlite):

kamil5b@PCKAMIL:~/npmw-sql-migrate$ CGO_ENABLED=0 go build -o ./bin/sql-migrate ./sql-migrate && ./bin/sql-migrate --help
Usage: sql-migrate [--version] [--help] <command> [<args>]

Available commands are:
    down      Undo a database migration
    new       Create a new migration
    redo      Reapply the last migration
    skip      Sets the database level to the most recent version available, without running the migrations
    status    Show migration status
    up        Migrates the database to the most recent version available

kamil5b@PCKAMIL:~/npmw-sql-migrate$ ./bin/sql-migrate status -config=test-integration/dbconfig.yml -env=sqlite
Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work. This is a stub

Proposal

Solution

Change the package for sqlite from github.com/mattn/go-sqlite3 to github.com/glebarez/go-sqlite

kamil5b@PCKAMIL:~/npmw-sql-migrate$ CGO_ENABLED=0 go build -o ./bin/sql-migrate ./sql-migrate && ./bin/sql-migrate --help
Usage: sql-migrate [--version] [--help] <command> [<args>]

Available commands are:
    down      Undo a database migration
    new       Create a new migration
    redo      Reapply the last migration
    skip      Sets the database level to the most recent version available, without running the migrations
    status    Show migration status
    up        Migrates the database to the most recent version available

kamil5b@PCKAMIL:~/npmw-sql-migrate$ ./bin/sql-migrate status -config=test-integration/dbconfig.yml -env=sqlite
+---------------+-------------------------------------------+
|   MIGRATION   |                  APPLIED                  |
+---------------+-------------------------------------------+
| 1_initial.sql | 2026-01-05 17:10:21.844294144 +0700 +0700 |
| 2_record.sql  | no                                        |
+---------------+-------------------------------------------+

Benchmark

github.com/glebarez/go-sqlite is the fork of modernc/go-sqlite but with GORM compatibility.

Tl;dr: Scoring (from the sqlite-bench)

The best time in every test, shown in bold in the tables below individual graphs, is worth one point. The scorecard shows where and how many points were awarded to each benchmarked package.

Total score ties are ranked alphabetically. Please read those as one shared rank

This score is an ad hoc aggregate metric. Its usefulness is possibly at most in showing how the scores may evolve in time when new, improved versions of packages will get benchmarked

The time results for the particular OS and HW provide a more detailed info.

Total	Simple	Complex	Many	Large	Concurrent
modernc	121	16	15	42	2
mattn	72	15	16	5	36
ncruces	15	1	1	1	10

Disclaimer: The score and the ranking do not show how will any package perform in your particular application on a particular system. Additionally, empirically the scores fluctuate as much as about +/- 10 points. It's complicatd to better stabilize the results to be more precise and reliable. On some machines the tests run for many hours already with n = 2.