[0.9.1] - 2026-05-07

Fixed

Upsert ON CONFLICT DO UPDATE SQL Generation - Fixed two bugs that caused "near ?: syntax error" on any INSERT ... ON CONFLICT DO UPDATE query, breaking all upsert operations including Ash Framework's upsert? actions. (Thanks @AlanMcCann for PR #95!)
- Missing :identifier expression handler: Ecto generates ON CONFLICT UPDATE clauses using {:identifier, _, ["column_name"]} fragment expressions. Without a matching expr/3 clause these fell through to the catch-all, producing invalid SQL such as SET "col" = EXCLUDED.?.
- Bare ? parameter placeholders: SQLite requires numbered positional parameters (?1, ?2, …) when a statement contains multiple parameter groups (INSERT values + ON CONFLICT UPDATE). The adapter now uses numbered parameters throughout, consistent with the ecto_sqlite3 adapter.
- IN clause with bound list parameters was also left using bare ? placeholders. The IN (?, ?, ?) handler now generates IN (?1, ?2, ?3) with correct start-index offsets, matching the numbering scheme used everywhere else.
- Empty IN list edge case (where: field in ^[]) is handled explicitly with IN (SELECT NULL WHERE 1=0) since SQLite rejects IN ().
PRAGMA Statement Routing - PRAGMA statements are now correctly routed through the query() path rather than the execute path, fixing incorrect behaviour when reading PRAGMA values (e.g. PRAGMA journal_mode, PRAGMA synchronous) via the Ecto adapter.

Upstream Status Notice - Added a note to the README and Hex documentation about Turso’s transition away from libSQL toward their new Turso library (a full SQLite rewrite in Rust). ecto_libsql will continue to receive bug fixes and security updates; see the README for more context.
Dependency Updates - Bumped db_connection 2.9.0 → 2.10.0, ecto 3.13.5 → 3.13.6, jason 1.4.4 → 1.4.5, rustler 0.37.3 → 0.37.4, libsql crates 0.9.29 → 0.9.30, plus various transitive Rust dependency updates.
CI Toolchain - Replaced erlef/setup-beam with mise for Elixir/OTP version management; updated to current Elixir/OTP versions; applied zizmor GitHub Actions security hardening.

Acknowledged three additional rustls-webpki 0.102.x advisories (RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104) in cargo deny - all are transitive via libsql’s pinned rustls 0.22.x dependency and cannot be resolved until libsql updates upstream.

Full Changelog: 0.9.0...0.9.1