sqlite: introduces RAII ownership for sqlite3_stmt

[araujogui]

If StatementSync::Create fails to allocate a JS object (OOM), the sqlite3_stmt prepared by sqlite3_prepare_v2 was leaked and a null pointer was silently inserted into db->statements_

[nodejs-github-bot]

Review requested:

• @nodejs/sqlite

[codecov]

Codecov Report

❌ Patch coverage is 93.44262% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.24%. Comparing base (f2ba101) to head (78e32bc).
⚠️ Report is 4 commits behind head on main.

Files with missing lines	Patch %	Lines
src/node_sqlite.cc	93.10%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62419      +/-   ##
==========================================
- Coverage   92.01%   90.24%   -1.77%     
==========================================
  Files         379      739     +360     
  Lines      170129   241673   +71544     
  Branches    26090    45542   +19452     
==========================================
+ Hits       156544   218106   +61562     
- Misses      13293    15110    +1817     
- Partials      292     8457    +8165     

Files with missing lines	Coverage Δ
src/node_sqlite.h	81.53% <100.00%> (ø)
src/node_sqlite.cc	80.73% <93.10%> (ø)

... and 487 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[louwers]

Can RAII be used instead?

[araujogui]

Can RAII be used instead?

Well, we could use std::unique_ptr<sqlite3_stmt, decltype(&sqlite3_finalize)>, but I feel the current way is good enough.

[araujogui]

@nodejs/sqlite Bump, I did a safety improvement by implementing RAII for sqlite3_stmt.

[Copilot]

Pull request overview

Fixes a resource-management bug in the SQLite sync binding where a prepared sqlite3_stmt could be leaked (and a nullptr inserted into db->statements_) when StatementSync::Create fails to allocate the JS wrapper object (e.g., OOM).

Changes:

• Introduces RAII ownership for sqlite3_stmt via StatementPtr (DeleteFnPtr + FinalizeStatement).
• Updates StatementSync to own the prepared statement with StatementPtr and uses .get() at call sites.
• Ensures DatabaseSync::Prepare returns early when StatementSync::Create fails, preventing nullptr insertion into db->statements_.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/node_sqlite.h	Adds FinalizeStatement + StatementPtr alias and updates StatementSync API/member to use RAII for sqlite3_stmt.
src/node_sqlite.cc	Transfers statement ownership with StatementPtr, resets via RAII, and guards against Create() failure to avoid leaks/null insertion.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.