sqlite-utils 4.0: What Happens When Two AI Agents Review One Release

Simon Willison released sqlite-utils 4.0 this week — the 124th release of his Python CLI/library for manipulating SQLite databases, and the first major version bump since 3.0 shipped in November 2020. That alone is a story about maintaining a widely-used open-source tool for half a decade. The more interesting part, for anyone building with AI coding agents, is how he decided the release was actually ready to ship.

What's new in 4.0

• Database schema migrations — sqlite-utils absorbs the functionality of Willison's separate sqlite-migrate plugin into core. Migrations are plain Python functions wrapped in an @migrations() decorator, tracked in a new _sqlite_migrations table, and applied through a migrate CLI command or the sqlite_utils.Migrations Python API.
• Nested transactions via `db.atomic()` — a new context manager built on SQLite's savepoint mechanism, so code like with db.atomic(): db.table("dogs").insert({"id": 1, "name": "Cleo"}, pk="id") can be safely nested inside other transactions. Internal multi-step operations, like table.transform(), now use the same mechanism.
• Compound foreign keys — table.foreign_keys and related methods now support multi-column foreign key creation, transformation, and introspection, closing a long-standing gap for anyone modeling composite keys.

The breaking changes

The version bump isn't purely additive. Three changes require attention when upgrading from 3.x:

• db.query() now executes immediately and rejects non-returning statements — writes must go through db.execute() instead.
• CSV and TSV imports now detect column types by default, instead of importing everything as text.
• Upserts now use SQLite's native INSERT ... ON CONFLICT syntax rather than a hand-rolled equivalent.

The real test: two AI agents, one release, very different results

Before shipping, Willison used two AI coding agents as adversarial pre-release testers, working the codebase independently and in parallel: Claude Fable 5 inside Claude Code, and GPT-5.5 xhigh inside Codex Desktop. Their job was simply to try to break the new release.

The results weren't close. Fable 5 wrote 12 test scripts and came back with a report identifying 4 release blockers plus 10 additional issues. GPT-5.5 wrote 5 scripts and, in Willison's words, "didn't turn up anything particularly interesting." Same codebase, same goal, two very different yields — a useful reminder that model choice and how thoroughly an agent probes the surface area still matter more than most benchmark comparisons suggest.

Assistance from Claude Fable 5 (and to a lesser extent Opus 4.8 and GPT-5.5) gave me just the boost I needed to overcome inertia and make the most of the time I could afford to spend on this library.

— Simon Willison

Why it matters for builders

This is a small, concrete data point in a debate that's usually argued in the abstract: does running a second, independent AI agent against your own release catch things a single pass misses? Here, yes — decisively. It's also a workable pattern beyond one library: generate test scripts with an agent whose only job is to find blockers, treat its findings as a gate rather than a suggestion, and don't assume one model's silence means the code is clean. A quiet report from one agent and a loud one from another is a signal to keep digging, not to average the two.