From 52f29ac87fefb89153cd35205a006c860e9466f7 Mon Sep 17 00:00:00 2001
From: Ali Hassan <ali-hassan27@outlook.com>
Date: Sat, 4 Apr 2026 03:16:53 +0500
Subject: [PATCH 1/2] sqlite: add serialize() and deserialize()

Add database.serialize() and database.deserialize() methods to
DatabaseSync, wrapping the sqlite3_serialize and sqlite3_deserialize
C APIs. These allow extracting an in-memory database as a Uint8Array
and loading one back, enabling snapshots, cloning, and transfer of
databases without filesystem I/O.

Refs: https://github.com/nodejs/node/issues/62575
---
 doc/api/sqlite.md                      |  61 +++++
 src/node_sqlite.cc                     | 130 +++++++++++
 src/node_sqlite.h                      |   2 +
 test/parallel/test-sqlite-serialize.js | 305 +++++++++++++++++++++++++
 4 files changed, 498 insertions(+)
 create mode 100644 test/parallel/test-sqlite-serialize.js

diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 35bbebea16e158..22d1eae3653777 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -531,6 +531,64 @@ Opens the database specified in the `path` argument of the `DatabaseSync`
 constructor. This method should only be used when the database is not opened via
 the constructor. An exception is thrown if the database is already open.
 
+### `database.serialize([dbName])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `dbName` {string} Name of the database to serialize. This can be `'main'`
+  (the default primary database) or any other database that has been added with
+  [`ATTACH DATABASE`][]. **Default:** `'main'`.
+* Returns: {Uint8Array} A binary representation of the database.
+
+Serializes the database into a binary representation, returned as a
+`Uint8Array`. This is useful for saving, cloning, or transferring an in-memory
+database. This method is a wrapper around [`sqlite3_serialize()`][].
+
+```cjs
+const { DatabaseSync } = require('node:sqlite');
+
+const db = new DatabaseSync(':memory:');
+db.exec('CREATE TABLE t(key INTEGER PRIMARY KEY, value TEXT)');
+db.exec("INSERT INTO t VALUES (1, 'hello')");
+const buffer = db.serialize();
+console.log(buffer.length); // Prints the byte length of the database
+```
+
+### `database.deserialize(buffer[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `buffer` {Uint8Array} A binary representation of a database, such as the
+  output of [`database.serialize()`][].
+* `options` {Object} Optional configuration for the deserialization.
+  * `dbName` {string} Name of the database to deserialize into.
+    **Default:** `'main'`.
+
+Loads a serialized database into this connection, replacing the current
+database. The deserialized database is writable. Existing prepared statements
+are finalized before deserialization is attempted, even if the operation
+subsequently fails. This method is a wrapper around
+[`sqlite3_deserialize()`][].
+
+```cjs
+const { DatabaseSync } = require('node:sqlite');
+
+const original = new DatabaseSync(':memory:');
+original.exec('CREATE TABLE t(key INTEGER PRIMARY KEY, value TEXT)');
+original.exec("INSERT INTO t VALUES (1, 'hello')");
+const buffer = original.serialize();
+original.close();
+
+const clone = new DatabaseSync(':memory:');
+clone.deserialize(buffer);
+console.log(clone.prepare('SELECT value FROM t').get());
+// Prints: { value: 'hello' }
+```
+
 ### `database.prepare(sql[, options])`
 
 <!-- YAML
@@ -1545,6 +1603,7 @@ callback function to indicate what type of operation is being authorized.
 [`SQLTagStore`]: #class-sqltagstore
 [`database.applyChangeset()`]: #databaseapplychangesetchangeset-options
 [`database.createTagStore()`]: #databasecreatetagstoremaxsize
+[`database.serialize()`]: #databaseserializedbname
 [`database.setAuthorizer()`]: #databasesetauthorizercallback
 [`sqlite3_backup_finish()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupfinish
 [`sqlite3_backup_init()`]: https://www.sqlite.org/c3ref/backup_finish.html#sqlite3backupinit
@@ -1559,12 +1618,14 @@ callback function to indicate what type of operation is being authorized.
 [`sqlite3_create_function_v2()`]: https://www.sqlite.org/c3ref/create_function.html
 [`sqlite3_create_window_function()`]: https://www.sqlite.org/c3ref/create_function.html
 [`sqlite3_db_filename()`]: https://sqlite.org/c3ref/db_filename.html
+[`sqlite3_deserialize()`]: https://sqlite.org/c3ref/deserialize.html
 [`sqlite3_exec()`]: https://www.sqlite.org/c3ref/exec.html
 [`sqlite3_expanded_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
 [`sqlite3_get_autocommit()`]: https://sqlite.org/c3ref/get_autocommit.html
 [`sqlite3_last_insert_rowid()`]: https://www.sqlite.org/c3ref/last_insert_rowid.html
 [`sqlite3_load_extension()`]: https://www.sqlite.org/c3ref/load_extension.html
 [`sqlite3_prepare_v2()`]: https://www.sqlite.org/c3ref/prepare.html
+[`sqlite3_serialize()`]: https://sqlite.org/c3ref/serialize.html
 [`sqlite3_set_authorizer()`]: https://sqlite.org/c3ref/set_authorizer.html
 [`sqlite3_sql()`]: https://www.sqlite.org/c3ref/expanded_sql.html
 [`sqlite3changeset_apply()`]: https://www.sqlite.org/session/sqlite3changeset_apply.html
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 91b80b4fb44c26..932843e3508993 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -23,6 +23,7 @@ namespace sqlite {
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
+using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Boolean;
 using v8::ConstructorBehavior;
@@ -1719,6 +1720,133 @@ void DatabaseSync::Location(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
+  std::string db_name = "main";
+  if (!args[0]->IsUndefined()) {
+    if (!args[0]->IsString()) {
+      THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
+                                 "The \"dbName\" argument must be a string.");
+      return;
+    }
+    db_name = Utf8Value(env->isolate(), args[0].As<String>()).ToString();
+  }
+
+  sqlite3_int64 size = 0;
+  unsigned char* data =
+      sqlite3_serialize(db->connection_, db_name.c_str(), &size, 0);
+
+  if (data == nullptr) {
+    if (size == 0) {
+      Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), 0);
+      args.GetReturnValue().Set(Uint8Array::New(ab, 0, 0));
+      return;
+    }
+    THROW_ERR_SQLITE_ERROR(env->isolate(), db);
+    return;
+  }
+
+  // V8 sandbox forbids external backing stores so allocate inside the
+  // sandbox and copy. Without sandbox wrap the output directly using
+  // sqlite3_free as the destructor to avoid the copy.
+#ifdef V8_ENABLE_SANDBOX
+  auto free_data = OnScopeLeave([&] { sqlite3_free(data); });
+  auto store = ArrayBuffer::NewBackingStore(
+      env->isolate(),
+      size,
+      BackingStoreInitializationMode::kUninitialized,
+      BackingStoreOnFailureMode::kReturnNull);
+  if (!store) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return;
+  }
+  memcpy(store->Data(), data, size);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
+#else
+  auto store = ArrayBuffer::NewBackingStore(
+      data, size, [](void* ptr, size_t, void*) { sqlite3_free(ptr); }, nullptr);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
+#endif
+
+  args.GetReturnValue().Set(Uint8Array::New(ab, 0, size));
+}
+
+void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
+  if (!args[0]->IsUint8Array()) {
+    THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
+                               "The \"buffer\" argument must be a Uint8Array.");
+    return;
+  }
+
+  Local<Uint8Array> input = args[0].As<Uint8Array>();
+  size_t byte_length = input->ByteLength();
+
+  if (byte_length == 0) {
+    THROW_ERR_INVALID_ARG_VALUE(env,
+                                "The \"buffer\" argument must not be empty.");
+    return;
+  }
+
+  std::string db_name = "main";
+  if (args.Length() > 1 && !args[1]->IsUndefined()) {
+    if (!args[1]->IsObject()) {
+      THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
+                                 "The \"options\" argument must be an object.");
+      return;
+    }
+
+    Local<Object> options = args[1].As<Object>();
+    Local<String> db_name_key = FIXED_ONE_BYTE_STRING(env->isolate(), "dbName");
+    Local<Value> db_name_value;
+    if (!options->Get(env->context(), db_name_key).ToLocal(&db_name_value)) {
+      return;
+    }
+
+    if (!db_name_value->IsUndefined()) {
+      if (!db_name_value->IsString()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.dbName\" argument must be a string.");
+        return;
+      }
+      db_name =
+          Utf8Value(env->isolate(), db_name_value.As<String>()).ToString();
+    }
+  }
+
+  unsigned char* buf =
+      static_cast<unsigned char*>(sqlite3_malloc64(byte_length));
+  if (buf == nullptr) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return;
+  }
+
+  input->CopyContents(buf, byte_length);
+
+  db->FinalizeStatements();
+
+  int r = sqlite3_deserialize(
+      db->connection_,
+      db_name.c_str(),
+      buf,
+      byte_length,
+      byte_length,
+      SQLITE_DESERIALIZE_FREEONCLOSE | SQLITE_DESERIALIZE_RESIZEABLE);
+  if (r != SQLITE_OK) {
+    THROW_ERR_SQLITE_ERROR(env->isolate(), db);
+    return;
+  }
+}
+
 void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
   DatabaseSync* db;
   ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
@@ -3766,6 +3894,8 @@ static void Initialize(Local<Object> target,
       isolate, db_tmpl, "enableDefensive", DatabaseSync::EnableDefensive);
   SetProtoMethod(
       isolate, db_tmpl, "loadExtension", DatabaseSync::LoadExtension);
+  SetProtoMethod(isolate, db_tmpl, "serialize", DatabaseSync::Serialize);
+  SetProtoMethod(isolate, db_tmpl, "deserialize", DatabaseSync::Deserialize);
   SetProtoMethod(
       isolate, db_tmpl, "setAuthorizer", DatabaseSync::SetAuthorizer);
   SetSideEffectFreeGetter(isolate,
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 3ee79cc10ec562..201d34cd4ba83a 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -195,6 +195,8 @@ class DatabaseSync : public BaseObject {
   static void EnableDefensive(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void LimitsGetter(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void LoadExtension(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Serialize(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Deserialize(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetAuthorizer(const v8::FunctionCallbackInfo<v8::Value>& args);
   static int AuthorizerCallback(void* user_data,
                                 int action_code,
diff --git a/test/parallel/test-sqlite-serialize.js b/test/parallel/test-sqlite-serialize.js
new file mode 100644
index 00000000000000..77b9d9c5f483a3
--- /dev/null
+++ b/test/parallel/test-sqlite-serialize.js
@@ -0,0 +1,305 @@
+'use strict';
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const { DatabaseSync } = require('node:sqlite');
+const { suite, test } = require('node:test');
+
+suite('DatabaseSync.prototype.serialize()', () => {
+  test('returns a Uint8Array with the SQLite header', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const buf = db.serialize();
+    t.assert.ok(buf instanceof Uint8Array);
+    t.assert.ok(buf.length > 0);
+    const header = new TextDecoder().decode(buf.slice(0, 15));
+    t.assert.strictEqual(header, 'SQLite format 3');
+    db.close();
+  });
+
+  test('serializes an empty database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const buf = db.serialize();
+    t.assert.ok(buf instanceof Uint8Array);
+    t.assert.ok(buf.length > 0);
+    db.close();
+  });
+
+  test('serializes a database with data', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE t(id INTEGER PRIMARY KEY, name TEXT)');
+    db.exec("INSERT INTO t VALUES (1, 'hello')");
+    db.exec("INSERT INTO t VALUES (2, 'world')");
+    const buf = db.serialize();
+    t.assert.ok(buf.length > 0);
+    db.close();
+  });
+
+  test('throws if the database is not open', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+    t.assert.throws(() => {
+      db.serialize();
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /database is not open/,
+    });
+  });
+
+  test('throws if dbName is not a string', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.serialize(123);
+    }, {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "dbName" argument must be a string/,
+    });
+    db.close();
+  });
+
+  test('accepts a schema name argument', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const buf = db.serialize('main');
+    t.assert.ok(buf instanceof Uint8Array);
+    t.assert.ok(buf.length > 0);
+    db.close();
+  });
+
+  test('serializes an attached schema when dbName is provided', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec("ATTACH DATABASE ':memory:' AS aux");
+    db.exec('CREATE TABLE aux.t(value TEXT)');
+    db.exec("INSERT INTO aux.t VALUES ('from aux')");
+
+    const buf = db.serialize('aux');
+    db.close();
+
+    const clone = new DatabaseSync(':memory:');
+    clone.deserialize(buf);
+
+    const row = clone.prepare('SELECT value FROM t').get();
+    t.assert.strictEqual(row.value, 'from aux');
+    clone.close();
+  });
+});
+
+suite('DatabaseSync.prototype.deserialize()', () => {
+  test('loads a serialized database', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE t(id INTEGER PRIMARY KEY, name TEXT)');
+    db1.exec("INSERT INTO t VALUES (1, 'hello')");
+    db1.exec("INSERT INTO t VALUES (2, 'world')");
+    const buf = db1.serialize();
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.deserialize(buf);
+    const rows = db2.prepare('SELECT * FROM t ORDER BY id').all();
+    t.assert.strictEqual(rows.length, 2);
+    t.assert.strictEqual(rows[0].name, 'hello');
+    t.assert.strictEqual(rows[1].name, 'world');
+    db2.close();
+  });
+
+  test('replaces existing data in the connection', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE src(val TEXT)');
+    db1.exec("INSERT INTO src VALUES ('from source')");
+    const buf = db1.serialize();
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.exec('CREATE TABLE old(x INTEGER)');
+    db2.exec('INSERT INTO old VALUES (999)');
+    db2.deserialize(buf);
+
+    t.assert.throws(() => {
+      db2.prepare('SELECT * FROM old').all();
+    }, /no such table: old/);
+
+    const rows = db2.prepare('SELECT * FROM src').all();
+    t.assert.strictEqual(rows.length, 1);
+    t.assert.strictEqual(rows[0].val, 'from source');
+    db2.close();
+  });
+
+  test('finalizes existing prepared statements before replacing the database',
+       (t) => {
+         const db1 = new DatabaseSync(':memory:');
+         db1.exec('CREATE TABLE replacement(value TEXT)');
+         db1.exec("INSERT INTO replacement VALUES ('new')");
+         const buf = db1.serialize();
+         db1.close();
+
+         const db2 = new DatabaseSync(':memory:');
+         db2.exec('CREATE TABLE original(value TEXT)');
+         db2.exec("INSERT INTO original VALUES ('old')");
+         const stmt = db2.prepare('SELECT value FROM original');
+
+         t.assert.strictEqual(stmt.get().value, 'old');
+
+         db2.deserialize(buf);
+
+         t.assert.throws(() => {
+           stmt.get();
+         }, /statement has been finalized/);
+
+         const row = db2.prepare('SELECT value FROM replacement').get();
+         t.assert.strictEqual(row.value, 'new');
+         db2.close();
+       });
+
+  test('deserialized database is writable by default', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE t(id INTEGER PRIMARY KEY)');
+    const buf = db1.serialize();
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.deserialize(buf);
+    db2.exec('INSERT INTO t VALUES (1)');
+    const rows = db2.prepare('SELECT * FROM t').all();
+    t.assert.strictEqual(rows.length, 1);
+    db2.close();
+  });
+
+  test('round-trip serialize then deserialize preserves data', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE t(a TEXT, b REAL, c BLOB)');
+    db1.prepare('INSERT INTO t VALUES (?, ?, ?)').run(
+      'text', 3.14, new Uint8Array([1, 2, 3])
+    );
+    const buf = db1.serialize();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.deserialize(buf);
+    const row = db2.prepare('SELECT * FROM t').get();
+    t.assert.strictEqual(row.a, 'text');
+    t.assert.strictEqual(row.b, 3.14);
+    t.assert.deepStrictEqual(row.c, new Uint8Array([1, 2, 3]));
+    db1.close();
+    db2.close();
+  });
+
+  test('throws if the database is not open', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(0));
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /database is not open/,
+    });
+  });
+
+  test('throws if buffer argument is not a Uint8Array', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize('not a buffer');
+    }, {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "buffer" argument must be a Uint8Array/,
+    });
+    db.close();
+  });
+
+  test('throws if buffer is empty', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(0));
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /The "buffer" argument must not be empty/,
+    });
+    db.close();
+  });
+
+  test('throws if options is not an object', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(1), 'bad');
+    }, {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "options" argument must be an object/,
+    });
+    db.close();
+  });
+
+  test('throws if options.dbName is not a string', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(1), { dbName: 1 });
+    }, {
+      code: 'ERR_INVALID_ARG_TYPE',
+      message: /The "options\.dbName" argument must be a string/,
+    });
+    db.close();
+  });
+
+  test('accepts a Buffer as input', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE t(x INTEGER)');
+    db1.exec('INSERT INTO t VALUES (42)');
+    const buf = Buffer.from(db1.serialize());
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.deserialize(buf);
+    const row = db2.prepare('SELECT * FROM t').get();
+    t.assert.strictEqual(row.x, 42);
+    db2.close();
+  });
+
+  test('multiple deserialize calls on the same connection', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec('CREATE TABLE a(x)');
+    db1.exec("INSERT INTO a VALUES ('first')");
+    const buf1 = db1.serialize();
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.exec('CREATE TABLE b(x)');
+    db2.exec("INSERT INTO b VALUES ('second')");
+    const buf2 = db2.serialize();
+    db2.close();
+
+    const db3 = new DatabaseSync(':memory:');
+    db3.deserialize(buf1);
+    t.assert.strictEqual(
+      db3.prepare('SELECT x FROM a').get().x, 'first'
+    );
+
+    db3.deserialize(buf2);
+    t.assert.throws(() => {
+      db3.prepare('SELECT * FROM a').all();
+    }, /no such table: a/);
+    t.assert.strictEqual(
+      db3.prepare('SELECT x FROM b').get().x, 'second'
+    );
+    db3.close();
+  });
+
+  test('loads into an attached schema when options.dbName is provided', (t) => {
+    const db1 = new DatabaseSync(':memory:');
+    db1.exec("ATTACH DATABASE ':memory:' AS aux");
+    db1.exec('CREATE TABLE aux.t(value TEXT)');
+    db1.exec("INSERT INTO aux.t VALUES ('from aux')");
+    const buf = db1.serialize('aux');
+    db1.close();
+
+    const db2 = new DatabaseSync(':memory:');
+    db2.exec('CREATE TABLE main_t(value TEXT)');
+    db2.exec("INSERT INTO main_t VALUES ('from main')");
+    db2.exec("ATTACH DATABASE ':memory:' AS aux");
+
+    db2.deserialize(buf, { dbName: 'aux' });
+
+    t.assert.strictEqual(
+      db2.prepare('SELECT value FROM main_t').get().value,
+      'from main',
+    );
+    t.assert.strictEqual(
+      db2.prepare('SELECT value FROM aux.t').get().value,
+      'from aux',
+    );
+    db2.close();
+  });
+});

From f1cc0fe1e837294356133101ec4d4b4ed8368e92 Mon Sep 17 00:00:00 2001
From: Ali Hassan <ali-hassan27@outlook.com>
Date: Sat, 4 Apr 2026 13:02:39 +0500
Subject: [PATCH 2/2] add ownership comment to deserialize

---
 src/node_sqlite.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 932843e3508993..ae0fd7c85242ea 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -1823,6 +1823,9 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
+  // transfers ownership to SQLite, which calls sqlite3_free() on close.
+  // See: https://www.sqlite.org/c3ref/deserialize.html
   unsigned char* buf =
       static_cast<unsigned char*>(sqlite3_malloc64(byte_length));
   if (buf == nullptr) {