chore: pin sqld test image to v0.24.33

AGENTS.md

@@ -55,7 +55,8 @@ libsql-java/
    - Maps SQLite dynamic typing to JDBC SQL types and translates Hrana error codes to `SQLException` hierarchies.
 
 4. **`libsql-itests`**:
-   - All tests run against containerized `sqld` (`ghcr.io/tursodatabase/libsql-server:latest`).
+   - All tests run against a pinned `sqld` image (`ghcr.io/tursodatabase/libsql-server:v0.24.33`).
+   - The pin lives in the root `pom.xml` as the `libsql.image` property, and Maven passes it to both the integration and conformance test JVMs. Override it with `-Dlibsql.image=...` only for a deliberate version bump.
    - Includes HikariCP connection pool churn tests and Toxiproxy network toxicity tests.
 
 ---

TESTCONTAINERS-USAGE.md

@@ -9,10 +9,17 @@ This document explains how Testcontainers is configured and utilized in this pro
 Testing a pure-Java JDBC driver for Turso requires verifying real SQLite behavior, lock contention, HTTP pipeline batons, and network edge cases over the wire. Rather than mocking HTTP endpoints, we run real `sqld` instances using Testcontainers.
 
 ### Container Image
-* **Image**: `ghcr.io/tursodatabase/libsql-server:latest`
+* **Image**: `ghcr.io/tursodatabase/libsql-server:v0.24.33`
 * **Exposed Port**: `8080` (HTTP and Hrana pipeline endpoint)
 
-The image can also be overridden via the system property `-Dlibsql.image=<custom_image>`.
+The image is pinned to a released `sqld` version so that `latest` cannot silently change
+the behavior under test. The pin is defined once in the root `pom.xml` as the
+`libsql.image` property, and Maven passes it to both the integration and conformance
+test JVMs. To test a different version, override the property:
+
+```bash
+./mvnw verify -Dlibsql.image=ghcr.io/tursodatabase/libsql-server:v0.24.33
+```
 
 ---
 
@@ -35,7 +42,8 @@ import java.time.Duration;
 @Testcontainers
 public abstract class SqldContainerBase {
 
-    private static final String LIBSQL_IMAGE = System.getProperty("libsql.image", "ghcr.io/tursodatabase/libsql-server:latest");
+    // Supplied by the root pom's libsql.image property via surefire/failsafe.
+    private static final String LIBSQL_IMAGE = System.getProperty("libsql.image");
     private static final int PORT = 8080;
 
     @Container
@@ -105,7 +113,7 @@ public class NetworkToxicityIntegrationIT {
 
     private static final Network NETWORK = Network.newNetwork();
 
-    private static final GenericContainer<?> LIBSQL = new GenericContainer<>("ghcr.io/tursodatabase/libsql-server:latest")
+    private static final GenericContainer<?> LIBSQL = new GenericContainer<>(SqldContainerBase.LIBSQL_IMAGE)
             .withNetwork(NETWORK)
             .withNetworkAliases("libsql-srv")
             .withExposedPorts(8080)

libsql-conformance/src/test/java/com/github/magnusp/libsql/conformance/XerialTestServer.java

@@ -22,10 +22,7 @@
 
 public final class XerialTestServer {
 
-    private static final String IMAGE =
-            System.getProperty(
-                    "libsql.image",
-                    "ghcr.io/tursodatabase/libsql-server@sha256:6dd3eb276d9d3604e4a48ac4a999a2e267814732d57d7e94c04ba71482333a67");
+    private static final String IMAGE = requireLibsqlImage();
     private static final int HTTP_PORT = 8080;
     private static final int ADMIN_PORT = 9090;
     private static final Duration REQUEST_TIMEOUT = Duration.ofSeconds(30);
@@ -52,6 +49,16 @@ public final class XerialTestServer {
 
     private XerialTestServer() {}
 
+    private static String requireLibsqlImage() {
+        String image = System.getProperty("libsql.image");
+        if (image == null || image.isBlank()) {
+            throw new IllegalStateException(
+                    "libsql.image is not set. Run the conformance tests with Maven so the"
+                            + " pinned sqld image from the root pom is used.");
+        }
+        return image;
+    }
+
     public static synchronized void start() {
         if (container != null) {
             return;

libsql-itests/src/test/java/com/github/magnusp/libsql/itest/NamespacePathIT.java

@@ -33,12 +33,11 @@
 @Testcontainers
 public class NamespacePathIT {
 
-    private static final String LIBSQL_IMAGE = System.getProperty("libsql.image", "ghcr.io/tursodatabase/libsql-server:latest");
     private static final int HTTP_PORT = 8080;
     private static final int ADMIN_PORT = 9090;
 
     @Container
-    public static final GenericContainer<?> SQLD_CONTAINER = new GenericContainer<>(LIBSQL_IMAGE)
+    public static final GenericContainer<?> SQLD_CONTAINER = new GenericContainer<>(SqldContainerBase.LIBSQL_IMAGE)
             .withExposedPorts(HTTP_PORT, ADMIN_PORT)
             .withCommand(
                     "sqld",

libsql-itests/src/test/java/com/github/magnusp/libsql/itest/NetworkToxicityIT.java

@@ -31,7 +31,8 @@ public class NetworkToxicityIT {
 
     private static final Network NETWORK = Network.newNetwork();
 
-    private static final GenericContainer<?> LIBSQL = new GenericContainer<>("ghcr.io/tursodatabase/libsql-server:latest")
+    private static final GenericContainer<?> LIBSQL =
+            new GenericContainer<>(SqldContainerBase.LIBSQL_IMAGE)
             .withNetwork(NETWORK)
             .withNetworkAliases("libsql-srv")
             .withExposedPorts(8080)

libsql-itests/src/test/java/com/github/magnusp/libsql/itest/SqldContainerBase.java

@@ -11,9 +11,19 @@
 @Testcontainers
 public abstract class SqldContainerBase {
 
-    private static final String LIBSQL_IMAGE = System.getProperty("libsql.image", "ghcr.io/tursodatabase/libsql-server:latest");
+    static final String LIBSQL_IMAGE = requireLibsqlImage();
     private static final int PORT = 8080;
 
+    private static String requireLibsqlImage() {
+        String image = System.getProperty("libsql.image");
+        if (image == null || image.isBlank()) {
+            throw new IllegalStateException(
+                    "libsql.image is not set. Run the integration tests with Maven so the"
+                            + " pinned sqld image from the root pom is used.");
+        }
+        return image;
+    }
+
     @Container
     public static final GenericContainer<?> LIBSQL_CONTAINER = new GenericContainer<>(LIBSQL_IMAGE)
             .withExposedPorts(PORT)

pom.xml

@@ -46,6 +46,8 @@
         <testcontainers.version>2.0.5</testcontainers.version>
         <hikaricp.version>7.1.0</hikaricp.version>
         <protobuf.version>4.36.1</protobuf.version>
+        <!-- Pinned sqld image for the integration and conformance suites. Bump deliberately. -->
+        <libsql.image>ghcr.io/tursodatabase/libsql-server:v0.24.33</libsql.image>
     </properties>
 
     <dependencyManagement>
@@ -137,11 +139,21 @@
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-surefire-plugin</artifactId>
                     <version>3.6.0</version>
+                    <configuration>
+                        <systemPropertyVariables>
+                            <libsql.image>${libsql.image}</libsql.image>
+                        </systemPropertyVariables>
+                    </configuration>
                 </plugin>
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-failsafe-plugin</artifactId>
                     <version>3.6.0</version>
+                    <configuration>
+                        <systemPropertyVariables>
+                            <libsql.image>${libsql.image}</libsql.image>
+                        </systemPropertyVariables>
+                    </configuration>
                     <executions>
                         <execution>
                             <goals>