diff --git a/duckdb-ffi.cabal b/duckdb-ffi.cabal
--- a/duckdb-ffi.cabal
+++ b/duckdb-ffi.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.4
 name:               duckdb-ffi
-version:            0.1.4.1
+version:            1.4.1.1
 author:             Matthias Pall Gissurarson
 maintainer:         mpg@mpg.is
 category:           Database
diff --git a/src/Database/DuckDB/FFI/AggregateFunctions.hs b/src/Database/DuckDB/FFI/AggregateFunctions.hs
--- a/src/Database/DuckDB/FFI/AggregateFunctions.hs
+++ b/src/Database/DuckDB/FFI/AggregateFunctions.hs
@@ -28,11 +28,11 @@
 
 Returns The aggregate function object.
 -}
-foreign import ccall unsafe "duckdb_create_aggregate_function"
+foreign import ccall safe "duckdb_create_aggregate_function"
     c_duckdb_create_aggregate_function :: IO DuckDBAggregateFunction
 
 -- | Destroys the given aggregate function object.
-foreign import ccall unsafe "duckdb_destroy_aggregate_function"
+foreign import ccall safe "duckdb_destroy_aggregate_function"
     c_duckdb_destroy_aggregate_function :: Ptr DuckDBAggregateFunction -> IO ()
 
 {- | Sets the name of the given aggregate function.
@@ -41,7 +41,7 @@
 * @aggregate_function@: The aggregate function
 * @name@: The name of the aggregate function
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_name"
+foreign import ccall safe "duckdb_aggregate_function_set_name"
     c_duckdb_aggregate_function_set_name :: DuckDBAggregateFunction -> CString -> IO ()
 
 {- | Adds a parameter to the aggregate function.
@@ -50,7 +50,7 @@
 * @aggregate_function@: The aggregate function.
 * @type@: The parameter type. Cannot contain INVALID.
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_add_parameter"
+foreign import ccall safe "duckdb_aggregate_function_add_parameter"
     c_duckdb_aggregate_function_add_parameter :: DuckDBAggregateFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the return type of the aggregate function.
@@ -59,7 +59,7 @@
 * @aggregate_function@: The aggregate function.
 * @type@: The return type. Cannot contain INVALID or ANY.
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_return_type"
+foreign import ccall safe "duckdb_aggregate_function_set_return_type"
     c_duckdb_aggregate_function_set_return_type :: DuckDBAggregateFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the main functions of the aggregate function.
@@ -72,7 +72,7 @@
 * @combine@: combine states
 * @finalize@: finalize states
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_functions"
+foreign import ccall safe "duckdb_aggregate_function_set_functions"
     c_duckdb_aggregate_function_set_functions :: DuckDBAggregateFunction -> DuckDBAggregateStateSizeFun -> DuckDBAggregateInitFun -> DuckDBAggregateUpdateFun -> DuckDBAggregateCombineFun -> DuckDBAggregateFinalizeFun -> IO ()
 
 {- | Sets the state destructor callback of the aggregate function (optional)
@@ -81,7 +81,7 @@
 * @aggregate_function@: The aggregate function
 * @destroy@: state destroy callback
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_destructor"
+foreign import ccall safe "duckdb_aggregate_function_set_destructor"
     c_duckdb_aggregate_function_set_destructor :: DuckDBAggregateFunction -> DuckDBAggregateDestroyFun -> IO ()
 
 {- | Register the aggregate function object within the given connection.
@@ -96,7 +96,7 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_aggregate_function"
+foreign import ccall safe "duckdb_register_aggregate_function"
     c_duckdb_register_aggregate_function :: DuckDBConnection -> DuckDBAggregateFunction -> IO DuckDBState
 
 {- | Sets the NULL handling of the aggregate function to SPECIAL_HANDLING.
@@ -104,7 +104,7 @@
 Parameters:
 * @aggregate_function@: The aggregate function
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_special_handling"
+foreign import ccall safe "duckdb_aggregate_function_set_special_handling"
     c_duckdb_aggregate_function_set_special_handling :: DuckDBAggregateFunction -> IO ()
 
 {- | Assigns extra information to the scalar function that can be fetched during
@@ -116,7 +116,7 @@
 * @destroy@: The callback that will be called to destroy the extra information
   (if any)
 -}
-foreign import ccall unsafe "duckdb_aggregate_function_set_extra_info"
+foreign import ccall safe "duckdb_aggregate_function_set_extra_info"
     c_duckdb_aggregate_function_set_extra_info :: DuckDBAggregateFunction -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Retrieves the extra info of the function as set in
@@ -127,7 +127,7 @@
 
 Returns The extra info
 -}
-foreign import ccall safe "duckdb_aggregate_function_get_extra_info"
+foreign import ccall "duckdb_aggregate_function_get_extra_info"
     c_duckdb_aggregate_function_get_extra_info :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Report that an error has occurred while executing the aggregate function.
@@ -136,7 +136,7 @@
 * @info@: The info object
 * @error@: The error message
 -}
-foreign import ccall safe "duckdb_aggregate_function_set_error"
+foreign import ccall "duckdb_aggregate_function_set_error"
     c_duckdb_aggregate_function_set_error :: DuckDBFunctionInfo -> CString -> IO ()
 
 {- | Creates a new empty aggregate function set.
@@ -146,11 +146,11 @@
 
 Returns The aggregate function set object.
 -}
-foreign import ccall unsafe "duckdb_create_aggregate_function_set"
+foreign import ccall safe "duckdb_create_aggregate_function_set"
     c_duckdb_create_aggregate_function_set :: CString -> IO DuckDBAggregateFunctionSet
 
 -- | Destroys the given aggregate function set object.
-foreign import ccall unsafe "duckdb_destroy_aggregate_function_set"
+foreign import ccall safe "duckdb_destroy_aggregate_function_set"
     c_duckdb_destroy_aggregate_function_set :: Ptr DuckDBAggregateFunctionSet -> IO ()
 
 {- | Adds the aggregate function as a new overload to the aggregate function set.
@@ -162,7 +162,7 @@
 * @set@: The aggregate function set
 * @function@: The function to add
 -}
-foreign import ccall unsafe "duckdb_add_aggregate_function_to_set"
+foreign import ccall safe "duckdb_add_aggregate_function_to_set"
     c_duckdb_add_aggregate_function_to_set :: DuckDBAggregateFunctionSet -> DuckDBAggregateFunction -> IO DuckDBState
 
 {- | Register the aggregate function set within the given connection.
@@ -178,5 +178,5 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_aggregate_function_set"
+foreign import ccall safe "duckdb_register_aggregate_function_set"
     c_duckdb_register_aggregate_function_set :: DuckDBConnection -> DuckDBAggregateFunctionSet -> IO DuckDBState
diff --git a/src/Database/DuckDB/FFI/Appender.hs b/src/Database/DuckDB/FFI/Appender.hs
--- a/src/Database/DuckDB/FFI/Appender.hs
+++ b/src/Database/DuckDB/FFI/Appender.hs
@@ -60,7 +60,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_create"
+foreign import ccall "duckdb_appender_create"
     c_duckdb_appender_create :: DuckDBConnection -> CString -> CString -> Ptr DuckDBAppender -> IO DuckDBState
 
 {- | Creates an appender object.
@@ -78,7 +78,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_create_ext"
+foreign import ccall "duckdb_appender_create_ext"
     c_duckdb_appender_create_ext :: DuckDBConnection -> CString -> CString -> CString -> Ptr DuckDBAppender -> IO DuckDBState
 
 {- | Creates an appender object that executes the given query with any data
@@ -100,7 +100,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_create_query"
+foreign import ccall "duckdb_appender_create_query"
     c_duckdb_appender_create_query :: DuckDBConnection -> CString -> DuckDBIdx -> Ptr DuckDBLogicalType -> CString -> Ptr CString -> Ptr DuckDBAppender -> IO DuckDBState
 
 {- | Returns the number of columns that belong to the appender. If there is no
@@ -111,7 +111,7 @@
 
 Returns The number of columns in the data chunks.
 -}
-foreign import ccall safe "duckdb_appender_column_count"
+foreign import ccall "duckdb_appender_column_count"
     c_duckdb_appender_column_count :: DuckDBAppender -> IO DuckDBIdx
 
 {- | Returns the type of the column at the specified index. This is either a type
@@ -126,7 +126,7 @@
 
 Returns The @duckdb_logical_type@ of the column.
 -}
-foreign import ccall safe "duckdb_appender_column_type"
+foreign import ccall "duckdb_appender_column_type"
     c_duckdb_appender_column_type :: DuckDBAppender -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -143,7 +143,7 @@
 
 Returns The error message, or @nullptr@ if there is none.
 -}
-foreign import ccall safe "duckdb_appender_error"
+foreign import ccall "duckdb_appender_error"
     c_duckdb_appender_error :: DuckDBAppender -> IO CString
 
 {- | Returns the error data associated with the appender. Must be destroyed with
@@ -154,7 +154,7 @@
 
 Returns The error data.
 -}
-foreign import ccall safe "duckdb_appender_error_data"
+foreign import ccall "duckdb_appender_error_data"
     c_duckdb_appender_error_data :: DuckDBAppender -> IO DuckDBErrorData
 
 {- | Flush the appender to the table, forcing the cache of the appender to be
@@ -169,7 +169,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_flush"
+foreign import ccall "duckdb_appender_flush"
     c_duckdb_appender_flush :: DuckDBAppender -> IO DuckDBState
 
 {- | Closes the appender by flushing all intermediate states and closing it for
@@ -183,7 +183,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_close"
+foreign import ccall "duckdb_appender_close"
     c_duckdb_appender_close :: DuckDBAppender -> IO DuckDBState
 
 {- | Closes the appender by flushing all intermediate states to the table and
@@ -200,7 +200,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_destroy"
+foreign import ccall "duckdb_appender_destroy"
     c_duckdb_appender_destroy :: Ptr DuckDBAppender -> IO DuckDBState
 
 {- | Appends a column to the active column list of the appender. Immediately
@@ -215,7 +215,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_add_column"
+foreign import ccall "duckdb_appender_add_column"
     c_duckdb_appender_add_column :: DuckDBAppender -> CString -> IO DuckDBState
 
 {- | Removes all columns from the active column list of the appender, resetting the
@@ -227,13 +227,13 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_clear_columns"
+foreign import ccall "duckdb_appender_clear_columns"
     c_duckdb_appender_clear_columns :: DuckDBAppender -> IO DuckDBState
 
 {- | A nop function, provided for backwards compatibility reasons. Does nothing.
 Only @duckdb_appender_end_row@ is required.
 -}
-foreign import ccall safe "duckdb_appender_begin_row"
+foreign import ccall "duckdb_appender_begin_row"
     c_duckdb_appender_begin_row :: DuckDBAppender -> IO DuckDBState
 
 {- | Finish the current row of appends. After end_row is called, the next row can
@@ -244,13 +244,13 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_appender_end_row"
+foreign import ccall "duckdb_appender_end_row"
     c_duckdb_appender_end_row :: DuckDBAppender -> IO DuckDBState
 
 {- | Append a DEFAULT value (NULL if DEFAULT not available for column) to the
 appender.
 -}
-foreign import ccall safe "duckdb_append_default"
+foreign import ccall "duckdb_append_default"
     c_duckdb_append_default :: DuckDBAppender -> IO DuckDBState
 
 {- | Append a DEFAULT value, at the specified row and column, (NULL if DEFAULT not
@@ -266,27 +266,27 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_append_default_to_chunk"
+foreign import ccall "duckdb_append_default_to_chunk"
     c_duckdb_append_default_to_chunk :: DuckDBAppender -> DuckDBDataChunk -> DuckDBIdx -> DuckDBIdx -> IO DuckDBState
 
 -- | Append a bool value to the appender.
-foreign import ccall safe "duckdb_append_bool"
+foreign import ccall "duckdb_append_bool"
     c_duckdb_append_bool :: DuckDBAppender -> CBool -> IO DuckDBState
 
 -- | Append an int8_t value to the appender.
-foreign import ccall safe "duckdb_append_int8"
+foreign import ccall "duckdb_append_int8"
     c_duckdb_append_int8 :: DuckDBAppender -> Int8 -> IO DuckDBState
 
 -- | Append an int16_t value to the appender.
-foreign import ccall safe "duckdb_append_int16"
+foreign import ccall "duckdb_append_int16"
     c_duckdb_append_int16 :: DuckDBAppender -> Int16 -> IO DuckDBState
 
 -- | Append an int32_t value to the appender.
-foreign import ccall safe "duckdb_append_int32"
+foreign import ccall "duckdb_append_int32"
     c_duckdb_append_int32 :: DuckDBAppender -> Int32 -> IO DuckDBState
 
 -- | Append an int64_t value to the appender.
-foreign import ccall safe "duckdb_append_int64"
+foreign import ccall "duckdb_append_int64"
     c_duckdb_append_int64 :: DuckDBAppender -> Int64 -> IO DuckDBState
 
 {- | Append a duckdb_hugeint value to the appender.
@@ -294,23 +294,23 @@
 These bindings call the wrapper symbol @wrapped_duckdb_append_hugeint@
 but mirror the DuckDB C API semantics of @duckdb_append_hugeint@.
 -}
-foreign import ccall safe "wrapped_duckdb_append_hugeint"
+foreign import ccall "wrapped_duckdb_append_hugeint"
     c_duckdb_append_hugeint :: DuckDBAppender -> Ptr DuckDBHugeInt -> IO DuckDBState
 
 -- | Append a uint8_t value to the appender.
-foreign import ccall safe "duckdb_append_uint8"
+foreign import ccall "duckdb_append_uint8"
     c_duckdb_append_uint8 :: DuckDBAppender -> Word8 -> IO DuckDBState
 
 -- | Append a uint16_t value to the appender.
-foreign import ccall safe "duckdb_append_uint16"
+foreign import ccall "duckdb_append_uint16"
     c_duckdb_append_uint16 :: DuckDBAppender -> Word16 -> IO DuckDBState
 
 -- | Append a uint32_t value to the appender.
-foreign import ccall safe "duckdb_append_uint32"
+foreign import ccall "duckdb_append_uint32"
     c_duckdb_append_uint32 :: DuckDBAppender -> Word32 -> IO DuckDBState
 
 -- | Append a uint64_t value to the appender.
-foreign import ccall safe "duckdb_append_uint64"
+foreign import ccall "duckdb_append_uint64"
     c_duckdb_append_uint64 :: DuckDBAppender -> Word64 -> IO DuckDBState
 
 {- | Append a duckdb_uhugeint value to the appender.
@@ -318,27 +318,27 @@
 These bindings call the wrapper symbol @wrapped_duckdb_append_uhugeint@
 but mirror the DuckDB C API semantics of @duckdb_append_uhugeint@.
 -}
-foreign import ccall safe "wrapped_duckdb_append_uhugeint"
+foreign import ccall "wrapped_duckdb_append_uhugeint"
     c_duckdb_append_uhugeint :: DuckDBAppender -> Ptr DuckDBUHugeInt -> IO DuckDBState
 
 -- | Append a float value to the appender.
-foreign import ccall safe "duckdb_append_float"
+foreign import ccall "duckdb_append_float"
     c_duckdb_append_float :: DuckDBAppender -> CFloat -> IO DuckDBState
 
 -- | Append a double value to the appender.
-foreign import ccall safe "duckdb_append_double"
+foreign import ccall "duckdb_append_double"
     c_duckdb_append_double :: DuckDBAppender -> CDouble -> IO DuckDBState
 
 -- | Append a duckdb_date value to the appender.
-foreign import ccall safe "duckdb_append_date"
+foreign import ccall "duckdb_append_date"
     c_duckdb_append_date :: DuckDBAppender -> DuckDBDate -> IO DuckDBState
 
 -- | Append a duckdb_time value to the appender.
-foreign import ccall safe "duckdb_append_time"
+foreign import ccall "duckdb_append_time"
     c_duckdb_append_time :: DuckDBAppender -> DuckDBTime -> IO DuckDBState
 
 -- | Append a duckdb_timestamp value to the appender.
-foreign import ccall safe "duckdb_append_timestamp"
+foreign import ccall "duckdb_append_timestamp"
     c_duckdb_append_timestamp :: DuckDBAppender -> DuckDBTimestamp -> IO DuckDBState
 
 {- | Append a duckdb_interval value to the appender.
@@ -346,27 +346,27 @@
 These bindings call the wrapper symbol @wrapped_duckdb_append_interval@
 but mirror the DuckDB C API semantics of @duckdb_append_interval@.
 -}
-foreign import ccall safe "wrapped_duckdb_append_interval"
+foreign import ccall "wrapped_duckdb_append_interval"
     c_duckdb_append_interval :: DuckDBAppender -> Ptr DuckDBInterval -> IO DuckDBState
 
 -- | Append a varchar value to the appender.
-foreign import ccall safe "duckdb_append_varchar"
+foreign import ccall "duckdb_append_varchar"
     c_duckdb_append_varchar :: DuckDBAppender -> CString -> IO DuckDBState
 
 -- | Append a varchar value to the appender.
-foreign import ccall safe "duckdb_append_varchar_length"
+foreign import ccall "duckdb_append_varchar_length"
     c_duckdb_append_varchar_length :: DuckDBAppender -> CString -> DuckDBIdx -> IO DuckDBState
 
 -- | Append a blob value to the appender.
-foreign import ccall safe "duckdb_append_blob"
+foreign import ccall "duckdb_append_blob"
     c_duckdb_append_blob :: DuckDBAppender -> Ptr () -> DuckDBIdx -> IO DuckDBState
 
 -- | Append a NULL value to the appender (of any type).
-foreign import ccall safe "duckdb_append_null"
+foreign import ccall "duckdb_append_null"
     c_duckdb_append_null :: DuckDBAppender -> IO DuckDBState
 
 -- | Append a duckdb_value to the appender.
-foreign import ccall safe "duckdb_append_value"
+foreign import ccall "duckdb_append_value"
     c_duckdb_append_value :: DuckDBAppender -> DuckDBValue -> IO DuckDBState
 
 {- | Appends a pre-filled data chunk to the specified appender. Attempts casting,
@@ -378,5 +378,5 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_append_data_chunk"
+foreign import ccall "duckdb_append_data_chunk"
     c_duckdb_append_data_chunk :: DuckDBAppender -> DuckDBDataChunk -> IO DuckDBState
diff --git a/src/Database/DuckDB/FFI/Arrow.hs b/src/Database/DuckDB/FFI/Arrow.hs
--- a/src/Database/DuckDB/FFI/Arrow.hs
+++ b/src/Database/DuckDB/FFI/Arrow.hs
@@ -43,7 +43,7 @@
 
 Returns The error data. Must be destroyed with @duckdb_destroy_error_data@.
 -}
-foreign import ccall unsafe "duckdb_to_arrow_schema"
+foreign import ccall safe "duckdb_to_arrow_schema"
     c_duckdb_to_arrow_schema :: DuckDBArrowOptions -> Ptr DuckDBLogicalType -> Ptr CString -> DuckDBIdx -> Ptr ArrowSchema -> IO DuckDBErrorData
 
 {- | Transforms a DuckDB data chunk into an Arrow array.
@@ -56,7 +56,7 @@
 
 Returns The error data. Must be destroyed with @duckdb_destroy_error_data@.
 -}
-foreign import ccall unsafe "duckdb_data_chunk_to_arrow"
+foreign import ccall safe "duckdb_data_chunk_to_arrow"
     c_duckdb_data_chunk_to_arrow :: DuckDBArrowOptions -> DuckDBDataChunk -> Ptr ArrowArray -> IO DuckDBErrorData
 
 {- | Transforms an Arrow Schema into a DuckDB Schema.
@@ -70,7 +70,7 @@
 
 Returns The error data. Must be destroyed with @duckdb_destroy_error_data@.
 -}
-foreign import ccall unsafe "duckdb_schema_from_arrow"
+foreign import ccall safe "duckdb_schema_from_arrow"
     c_duckdb_schema_from_arrow :: DuckDBConnection -> Ptr ArrowSchema -> Ptr DuckDBArrowConvertedSchema -> IO DuckDBErrorData
 
 {- | Transforms an Arrow array into a DuckDB data chunk. The data chunk will retain
@@ -88,7 +88,7 @@
 
 Returns The error data. Must be destroyed with @duckdb_destroy_error_data@.
 -}
-foreign import ccall unsafe "duckdb_data_chunk_from_arrow"
+foreign import ccall safe "duckdb_data_chunk_from_arrow"
     c_duckdb_data_chunk_from_arrow :: DuckDBConnection -> Ptr ArrowArray -> DuckDBArrowConvertedSchema -> Ptr DuckDBDataChunk -> IO DuckDBErrorData
 
 {- | Destroys the arrow converted schema and de-allocates all memory allocated for
@@ -97,7 +97,7 @@
 Parameters:
 * @arrow_converted_schema@: The arrow converted schema to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_arrow_converted_schema"
+foreign import ccall safe "duckdb_destroy_arrow_converted_schema"
     c_duckdb_destroy_arrow_converted_schema :: Ptr DuckDBArrowConvertedSchema -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -119,7 +119,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_query_arrow"
+foreign import ccall "duckdb_query_arrow"
     c_duckdb_query_arrow :: DuckDBConnection -> CString -> Ptr DuckDBArrow -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -134,7 +134,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_query_arrow_schema"
+foreign import ccall safe "duckdb_query_arrow_schema"
     c_duckdb_query_arrow_schema :: DuckDBArrow -> Ptr DuckDBArrowSchema -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -149,7 +149,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_prepared_arrow_schema"
+foreign import ccall safe "duckdb_prepared_arrow_schema"
     c_duckdb_prepared_arrow_schema :: DuckDBPreparedStatement -> Ptr DuckDBArrowSchema -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -167,7 +167,7 @@
 @wrapped_duckdb_result_arrow_array@ but mirror the DuckDB C API semantics of
 @duckdb_result_arrow_array@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_arrow_array"
+foreign import ccall safe "wrapped_duckdb_result_arrow_array"
     c_duckdb_result_arrow_array :: Ptr DuckDBResult -> DuckDBDataChunk -> Ptr DuckDBArrowArray -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -186,7 +186,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_query_arrow_array"
+foreign import ccall "duckdb_query_arrow_array"
     c_duckdb_query_arrow_array :: DuckDBArrow -> Ptr DuckDBArrowArray -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -199,7 +199,7 @@
 
 Returns The number of columns present in the result object.
 -}
-foreign import ccall unsafe "duckdb_arrow_column_count"
+foreign import ccall safe "duckdb_arrow_column_count"
     c_duckdb_arrow_column_count :: DuckDBArrow -> IO DuckDBIdx
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -212,7 +212,7 @@
 
 Returns The number of rows present in the result object.
 -}
-foreign import ccall unsafe "duckdb_arrow_row_count"
+foreign import ccall safe "duckdb_arrow_row_count"
     c_duckdb_arrow_row_count :: DuckDBArrow -> IO DuckDBIdx
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -227,7 +227,7 @@
 
 Returns The number of rows changed.
 -}
-foreign import ccall unsafe "duckdb_arrow_rows_changed"
+foreign import ccall safe "duckdb_arrow_rows_changed"
     c_duckdb_arrow_rows_changed :: DuckDBArrow -> IO DuckDBIdx
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -244,7 +244,7 @@
 
 Returns The error of the result.
 -}
-foreign import ccall unsafe "duckdb_query_arrow_error"
+foreign import ccall safe "duckdb_query_arrow_error"
     c_duckdb_query_arrow_error :: DuckDBArrow -> IO CString
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -255,7 +255,7 @@
 Parameters:
 * @result@: The result to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_arrow"
+foreign import ccall safe "duckdb_destroy_arrow"
     c_duckdb_destroy_arrow :: Ptr DuckDBArrow -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -266,7 +266,7 @@
 Parameters:
 * @stream_p@: The arrow array stream to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_arrow_stream"
+foreign import ccall safe "duckdb_destroy_arrow_stream"
     c_duckdb_destroy_arrow_stream :: Ptr DuckDBArrowStream -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -283,7 +283,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_execute_prepared_arrow"
+foreign import ccall "duckdb_execute_prepared_arrow"
     c_duckdb_execute_prepared_arrow :: DuckDBPreparedStatement -> Ptr DuckDBArrow -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -298,7 +298,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_arrow_scan"
+foreign import ccall "duckdb_arrow_scan"
     c_duckdb_arrow_scan :: DuckDBConnection -> CString -> DuckDBArrowStream -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -318,25 +318,25 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_arrow_array_scan"
+foreign import ccall "duckdb_arrow_array_scan"
     c_duckdb_arrow_array_scan :: DuckDBConnection -> CString -> DuckDBArrowSchema -> DuckDBArrowArray -> Ptr DuckDBArrowStream -> IO DuckDBState
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_schema_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_schema_internal_ptr"
     c_duckdb_arrow_schema_internal_ptr :: DuckDBArrowSchema -> IO (Ptr ())
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_schema_clear_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_schema_clear_internal_ptr"
     c_duckdb_arrow_schema_clear_internal_ptr :: DuckDBArrowSchema -> IO ()
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_array_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_array_internal_ptr"
     c_duckdb_arrow_array_internal_ptr :: DuckDBArrowArray -> IO (Ptr ())
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_array_clear_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_array_clear_internal_ptr"
     c_duckdb_arrow_array_clear_internal_ptr :: DuckDBArrowArray -> IO ()
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_stream_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_stream_internal_ptr"
     c_duckdb_arrow_stream_internal_ptr :: DuckDBArrowStream -> IO (Ptr ())
 
-foreign import ccall unsafe "wrapped_duckdb_arrow_stream_clear_internal_ptr"
+foreign import ccall safe "wrapped_duckdb_arrow_stream_clear_internal_ptr"
     c_duckdb_arrow_stream_clear_internal_ptr :: DuckDBArrowStream -> IO ()
 
 {- | Read the @internal_ptr@ field of a deprecated Arrow schema wrapper.
diff --git a/src/Database/DuckDB/FFI/BindValues.hs b/src/Database/DuckDB/FFI/BindValues.hs
--- a/src/Database/DuckDB/FFI/BindValues.hs
+++ b/src/Database/DuckDB/FFI/BindValues.hs
@@ -34,33 +34,33 @@
 import Foreign.Ptr (Ptr)
 
 -- | Binds a value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_value"
+foreign import ccall safe "duckdb_bind_value"
     c_duckdb_bind_value :: DuckDBPreparedStatement -> DuckDBIdx -> DuckDBValue -> IO DuckDBState
 
 {- | Retrieve the index of the parameter for the prepared statement, identified by
 name
 -}
-foreign import ccall unsafe "duckdb_bind_parameter_index"
+foreign import ccall safe "duckdb_bind_parameter_index"
     c_duckdb_bind_parameter_index :: DuckDBPreparedStatement -> Ptr DuckDBIdx -> CString -> IO DuckDBState
 
 -- | Binds a bool value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_boolean"
+foreign import ccall safe "duckdb_bind_boolean"
     c_duckdb_bind_boolean :: DuckDBPreparedStatement -> DuckDBIdx -> CBool -> IO DuckDBState
 
 -- | Binds an int8_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_int8"
+foreign import ccall safe "duckdb_bind_int8"
     c_duckdb_bind_int8 :: DuckDBPreparedStatement -> DuckDBIdx -> Int8 -> IO DuckDBState
 
 -- | Binds an int16_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_int16"
+foreign import ccall safe "duckdb_bind_int16"
     c_duckdb_bind_int16 :: DuckDBPreparedStatement -> DuckDBIdx -> Int16 -> IO DuckDBState
 
 -- | Binds an int32_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_int32"
+foreign import ccall safe "duckdb_bind_int32"
     c_duckdb_bind_int32 :: DuckDBPreparedStatement -> DuckDBIdx -> Int32 -> IO DuckDBState
 
 -- | Binds an int64_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_int64"
+foreign import ccall safe "duckdb_bind_int64"
     c_duckdb_bind_int64 :: DuckDBPreparedStatement -> DuckDBIdx -> Int64 -> IO DuckDBState
 
 {- | Binds a duckdb_hugeint value to the prepared statement at the specified index.
@@ -68,7 +68,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_bind_hugeint@
 but mirror the DuckDB C API semantics of @duckdb_bind_hugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_bind_hugeint"
+foreign import ccall safe "wrapped_duckdb_bind_hugeint"
     c_duckdb_bind_hugeint :: DuckDBPreparedStatement -> DuckDBIdx -> Ptr DuckDBHugeInt -> IO DuckDBState
 
 {- | Binds a duckdb_uhugeint value to the prepared statement at the specified
@@ -77,7 +77,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_bind_uhugeint@
 but mirror the DuckDB C API semantics of @duckdb_bind_uhugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_bind_uhugeint"
+foreign import ccall safe "wrapped_duckdb_bind_uhugeint"
     c_duckdb_bind_uhugeint :: DuckDBPreparedStatement -> DuckDBIdx -> Ptr DuckDBUHugeInt -> IO DuckDBState
 
 {- | Binds a duckdb_decimal value to the prepared statement at the specified index.
@@ -85,51 +85,51 @@
 These bindings call the wrapper symbol @wrapped_duckdb_bind_decimal@
 but mirror the DuckDB C API semantics of @duckdb_bind_decimal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_bind_decimal"
+foreign import ccall safe "wrapped_duckdb_bind_decimal"
     c_duckdb_bind_decimal :: DuckDBPreparedStatement -> DuckDBIdx -> Ptr DuckDBDecimal -> IO DuckDBState
 
 -- | Binds a uint8_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_uint8"
+foreign import ccall safe "duckdb_bind_uint8"
     c_duckdb_bind_uint8 :: DuckDBPreparedStatement -> DuckDBIdx -> Word8 -> IO DuckDBState
 
 -- | Binds a uint16_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_uint16"
+foreign import ccall safe "duckdb_bind_uint16"
     c_duckdb_bind_uint16 :: DuckDBPreparedStatement -> DuckDBIdx -> Word16 -> IO DuckDBState
 
 -- | Binds a uint32_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_uint32"
+foreign import ccall safe "duckdb_bind_uint32"
     c_duckdb_bind_uint32 :: DuckDBPreparedStatement -> DuckDBIdx -> Word32 -> IO DuckDBState
 
 -- | Binds a uint64_t value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_uint64"
+foreign import ccall safe "duckdb_bind_uint64"
     c_duckdb_bind_uint64 :: DuckDBPreparedStatement -> DuckDBIdx -> Word64 -> IO DuckDBState
 
 -- | Binds a float value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_float"
+foreign import ccall safe "duckdb_bind_float"
     c_duckdb_bind_float :: DuckDBPreparedStatement -> DuckDBIdx -> CFloat -> IO DuckDBState
 
 -- | Binds a double value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_double"
+foreign import ccall safe "duckdb_bind_double"
     c_duckdb_bind_double :: DuckDBPreparedStatement -> DuckDBIdx -> CDouble -> IO DuckDBState
 
 -- | Binds a duckdb_date value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_date"
+foreign import ccall safe "duckdb_bind_date"
     c_duckdb_bind_date :: DuckDBPreparedStatement -> DuckDBIdx -> DuckDBDate -> IO DuckDBState
 
 -- | Binds a duckdb_time value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_time"
+foreign import ccall safe "duckdb_bind_time"
     c_duckdb_bind_time :: DuckDBPreparedStatement -> DuckDBIdx -> DuckDBTime -> IO DuckDBState
 
 {- | Binds a duckdb_timestamp value to the prepared statement at the specified
 index.
 -}
-foreign import ccall unsafe "duckdb_bind_timestamp"
+foreign import ccall safe "duckdb_bind_timestamp"
     c_duckdb_bind_timestamp :: DuckDBPreparedStatement -> DuckDBIdx -> DuckDBTimestamp -> IO DuckDBState
 
 {- | Binds a duckdb_timestamp value to the prepared statement at the specified
 index.
 -}
-foreign import ccall unsafe "duckdb_bind_timestamp_tz"
+foreign import ccall safe "duckdb_bind_timestamp_tz"
     c_duckdb_bind_timestamp_tz :: DuckDBPreparedStatement -> DuckDBIdx -> DuckDBTimestamp -> IO DuckDBState
 
 {- | Binds a duckdb_interval value to the prepared statement at the specified
@@ -138,23 +138,23 @@
 These bindings call the wrapper symbol @wrapped_duckdb_bind_interval@
 but mirror the DuckDB C API semantics of @duckdb_bind_interval@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_bind_interval"
+foreign import ccall safe "wrapped_duckdb_bind_interval"
     c_duckdb_bind_interval :: DuckDBPreparedStatement -> DuckDBIdx -> Ptr DuckDBInterval -> IO DuckDBState
 
 {- | Binds a null-terminated varchar value to the prepared statement at the
 specified index.
 -}
-foreign import ccall unsafe "duckdb_bind_varchar"
+foreign import ccall safe "duckdb_bind_varchar"
     c_duckdb_bind_varchar :: DuckDBPreparedStatement -> DuckDBIdx -> CString -> IO DuckDBState
 
 -- | Binds a varchar value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_varchar_length"
+foreign import ccall safe "duckdb_bind_varchar_length"
     c_duckdb_bind_varchar_length :: DuckDBPreparedStatement -> DuckDBIdx -> CString -> DuckDBIdx -> IO DuckDBState
 
 -- | Binds a blob value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_blob"
+foreign import ccall safe "duckdb_bind_blob"
     c_duckdb_bind_blob :: DuckDBPreparedStatement -> DuckDBIdx -> Ptr () -> DuckDBIdx -> IO DuckDBState
 
 -- | Binds a NULL value to the prepared statement at the specified index.
-foreign import ccall unsafe "duckdb_bind_null"
+foreign import ccall safe "duckdb_bind_null"
     c_duckdb_bind_null :: DuckDBPreparedStatement -> DuckDBIdx -> IO DuckDBState
diff --git a/src/Database/DuckDB/FFI/CastFunctions.hs b/src/Database/DuckDB/FFI/CastFunctions.hs
--- a/src/Database/DuckDB/FFI/CastFunctions.hs
+++ b/src/Database/DuckDB/FFI/CastFunctions.hs
@@ -23,7 +23,7 @@
 
 Returns The cast function object.
 -}
-foreign import ccall unsafe "duckdb_create_cast_function"
+foreign import ccall safe "duckdb_create_cast_function"
     c_duckdb_create_cast_function :: IO DuckDBCastFunction
 
 {- | Sets the source type of the cast function.
@@ -32,7 +32,7 @@
 * @cast_function@: The cast function object.
 * @source_type@: The source type to set.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_source_type"
+foreign import ccall safe "duckdb_cast_function_set_source_type"
     c_duckdb_cast_function_set_source_type :: DuckDBCastFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the target type of the cast function.
@@ -41,7 +41,7 @@
 * @cast_function@: The cast function object.
 * @target_type@: The target type to set.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_target_type"
+foreign import ccall safe "duckdb_cast_function_set_target_type"
     c_duckdb_cast_function_set_target_type :: DuckDBCastFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the "cost" of implicitly casting the source type to the target type using
@@ -51,7 +51,7 @@
 * @cast_function@: The cast function object.
 * @cost@: The cost to set.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_implicit_cast_cost"
+foreign import ccall safe "duckdb_cast_function_set_implicit_cast_cost"
     c_duckdb_cast_function_set_implicit_cast_cost :: DuckDBCastFunction -> Int64 -> IO ()
 
 {- | Sets the actual cast function to use.
@@ -60,7 +60,7 @@
 * @cast_function@: The cast function object.
 * @function@: The function to set.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_function"
+foreign import ccall safe "duckdb_cast_function_set_function"
     c_duckdb_cast_function_set_function :: DuckDBCastFunction -> DuckDBCastFunctionFun -> IO ()
 
 {- | Assigns extra information to the cast function that can be fetched during
@@ -71,7 +71,7 @@
 * @destroy@: The callback that will be called to destroy the extra information
   (if any)
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_extra_info"
+foreign import ccall safe "duckdb_cast_function_set_extra_info"
     c_duckdb_cast_function_set_extra_info :: DuckDBCastFunction -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Retrieves the extra info of the function as set in
@@ -82,7 +82,7 @@
 
 Returns The extra info.
 -}
-foreign import ccall unsafe "duckdb_cast_function_get_extra_info"
+foreign import ccall safe "duckdb_cast_function_get_extra_info"
     c_duckdb_cast_function_get_extra_info :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Get the cast execution mode from the given function info.
@@ -92,7 +92,7 @@
 
 Returns The cast mode.
 -}
-foreign import ccall unsafe "duckdb_cast_function_get_cast_mode"
+foreign import ccall safe "duckdb_cast_function_get_cast_mode"
     c_duckdb_cast_function_get_cast_mode :: DuckDBFunctionInfo -> IO DuckDBCastMode
 
 {- | Report that an error has occurred while executing the cast function.
@@ -101,7 +101,7 @@
 * @info@: The info object.
 * @error@: The error message.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_error"
+foreign import ccall safe "duckdb_cast_function_set_error"
     c_duckdb_cast_function_set_error :: DuckDBFunctionInfo -> CString -> IO ()
 
 {- | Report that an error has occurred while executing the cast function, setting
@@ -113,7 +113,7 @@
 * @row@: The index of the row within the output vector to set to NULL.
 * @output@: The output vector.
 -}
-foreign import ccall unsafe "duckdb_cast_function_set_row_error"
+foreign import ccall safe "duckdb_cast_function_set_row_error"
     c_duckdb_cast_function_set_row_error :: DuckDBFunctionInfo -> CString -> DuckDBIdx -> DuckDBVector -> IO ()
 
 {- | Registers a cast function within the given connection.
@@ -124,7 +124,7 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_cast_function"
+foreign import ccall safe "duckdb_register_cast_function"
     c_duckdb_register_cast_function :: DuckDBConnection -> DuckDBCastFunction -> IO DuckDBState
 
 {- | Destroys the cast function object.
@@ -132,5 +132,5 @@
 Parameters:
 * @cast_function@: The cast function object.
 -}
-foreign import ccall unsafe "duckdb_destroy_cast_function"
+foreign import ccall safe "duckdb_destroy_cast_function"
     c_duckdb_destroy_cast_function :: Ptr DuckDBCastFunction -> IO ()
diff --git a/src/Database/DuckDB/FFI/Configuration.hs b/src/Database/DuckDB/FFI/Configuration.hs
--- a/src/Database/DuckDB/FFI/Configuration.hs
+++ b/src/Database/DuckDB/FFI/Configuration.hs
@@ -25,7 +25,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_create_config"
+foreign import ccall safe "duckdb_create_config"
     c_duckdb_create_config :: Ptr DuckDBConfig -> IO DuckDBState
 
 {- | This returns the total amount of configuration options available for usage
@@ -36,7 +36,7 @@
 
 Returns The amount of config options available.
 -}
-foreign import ccall unsafe "duckdb_config_count"
+foreign import ccall safe "duckdb_config_count"
     c_duckdb_config_count :: IO CSize
 
 {- | Obtains a human-readable name and description of a specific configuration
@@ -53,7 +53,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_get_config_flag"
+foreign import ccall safe "duckdb_get_config_flag"
     c_duckdb_get_config_flag :: CSize -> Ptr CString -> Ptr CString -> IO DuckDBState
 
 {- | Sets the specified option for the specified configuration. The configuration
@@ -72,7 +72,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_set_config"
+foreign import ccall safe "duckdb_set_config"
     c_duckdb_set_config :: DuckDBConfig -> CString -> CString -> IO DuckDBState
 
 {- | Destroys the specified configuration object and de-allocates all memory
@@ -81,5 +81,5 @@
 Parameters:
 * @config@: The configuration object to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_config"
+foreign import ccall safe "duckdb_destroy_config"
     c_duckdb_destroy_config :: Ptr DuckDBConfig -> IO ()
diff --git a/src/Database/DuckDB/FFI/DataChunk.hs b/src/Database/DuckDB/FFI/DataChunk.hs
--- a/src/Database/DuckDB/FFI/DataChunk.hs
+++ b/src/Database/DuckDB/FFI/DataChunk.hs
@@ -21,7 +21,7 @@
 
 Returns The data chunk.
 -}
-foreign import ccall unsafe "duckdb_create_data_chunk"
+foreign import ccall safe "duckdb_create_data_chunk"
     c_duckdb_create_data_chunk :: Ptr DuckDBLogicalType -> DuckDBIdx -> IO DuckDBDataChunk
 
 {- | Destroys the data chunk and de-allocates all memory allocated for that chunk.
@@ -29,7 +29,7 @@
 Parameters:
 * @chunk@: The data chunk to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_data_chunk"
+foreign import ccall safe "duckdb_destroy_data_chunk"
     c_duckdb_destroy_data_chunk :: Ptr DuckDBDataChunk -> IO ()
 
 {- | Resets a data chunk, clearing the validity masks and setting the cardinality
@@ -40,7 +40,7 @@
 Parameters:
 * @chunk@: The data chunk to reset.
 -}
-foreign import ccall unsafe "duckdb_data_chunk_reset"
+foreign import ccall safe "duckdb_data_chunk_reset"
     c_duckdb_data_chunk_reset :: DuckDBDataChunk -> IO ()
 
 {- | Retrieves the number of columns in a data chunk.
@@ -50,7 +50,7 @@
 
 Returns The number of columns in the data chunk
 -}
-foreign import ccall unsafe "duckdb_data_chunk_get_column_count"
+foreign import ccall safe "duckdb_data_chunk_get_column_count"
     c_duckdb_data_chunk_get_column_count :: DuckDBDataChunk -> IO DuckDBIdx
 
 {- | Retrieves the vector at the specified column index in the data chunk.
@@ -63,7 +63,7 @@
 
 Returns The vector
 -}
-foreign import ccall unsafe "duckdb_data_chunk_get_vector"
+foreign import ccall safe "duckdb_data_chunk_get_vector"
     c_duckdb_data_chunk_get_vector :: DuckDBDataChunk -> DuckDBIdx -> IO DuckDBVector
 
 {- | Retrieves the current number of tuples in a data chunk.
@@ -73,7 +73,7 @@
 
 Returns The number of tuples in the data chunk
 -}
-foreign import ccall unsafe "duckdb_data_chunk_get_size"
+foreign import ccall safe "duckdb_data_chunk_get_size"
     c_duckdb_data_chunk_get_size :: DuckDBDataChunk -> IO DuckDBIdx
 
 {- | Sets the current number of tuples in a data chunk.
@@ -82,5 +82,5 @@
 * @chunk@: The data chunk to set the size in
 * @size@: The number of tuples in the data chunk
 -}
-foreign import ccall unsafe "duckdb_data_chunk_set_size"
+foreign import ccall safe "duckdb_data_chunk_set_size"
     c_duckdb_data_chunk_set_size :: DuckDBDataChunk -> DuckDBIdx -> IO ()
diff --git a/src/Database/DuckDB/FFI/ErrorData.hs b/src/Database/DuckDB/FFI/ErrorData.hs
--- a/src/Database/DuckDB/FFI/ErrorData.hs
+++ b/src/Database/DuckDB/FFI/ErrorData.hs
@@ -19,7 +19,7 @@
 
 Returns The error data.
 -}
-foreign import ccall unsafe "duckdb_create_error_data"
+foreign import ccall safe "duckdb_create_error_data"
     c_duckdb_create_error_data :: DuckDBErrorType -> CString -> IO DuckDBErrorData
 
 {- | Destroys the error data and deallocates its memory.
@@ -27,7 +27,7 @@
 Parameters:
 * @error_data@: The error data to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_error_data"
+foreign import ccall safe "duckdb_destroy_error_data"
     c_duckdb_destroy_error_data :: Ptr DuckDBErrorData -> IO ()
 
 {- | Returns the duckdb_error_type of the error data.
@@ -37,7 +37,7 @@
 
 Returns The error type.
 -}
-foreign import ccall unsafe "duckdb_error_data_error_type"
+foreign import ccall safe "duckdb_error_data_error_type"
     c_duckdb_error_data_error_type :: DuckDBErrorData -> IO DuckDBErrorType
 
 {- | Returns the error message of the error data. Must not be freed.
@@ -47,7 +47,7 @@
 
 Returns The error message.
 -}
-foreign import ccall unsafe "duckdb_error_data_message"
+foreign import ccall safe "duckdb_error_data_message"
     c_duckdb_error_data_message :: DuckDBErrorData -> IO CString
 
 {- | Returns whether the error data contains an error or not.
@@ -57,5 +57,5 @@
 
 Returns True, if the error data contains an exception, else false.
 -}
-foreign import ccall unsafe "duckdb_error_data_has_error"
+foreign import ccall safe "duckdb_error_data_has_error"
     c_duckdb_error_data_has_error :: DuckDBErrorData -> IO CBool
diff --git a/src/Database/DuckDB/FFI/ExecutePrepared.hs b/src/Database/DuckDB/FFI/ExecutePrepared.hs
--- a/src/Database/DuckDB/FFI/ExecutePrepared.hs
+++ b/src/Database/DuckDB/FFI/ExecutePrepared.hs
@@ -21,7 +21,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_execute_prepared"
+foreign import ccall "duckdb_execute_prepared"
     c_duckdb_execute_prepared :: DuckDBPreparedStatement -> Ptr DuckDBResult -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -42,5 +42,5 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_execute_prepared_streaming"
+foreign import ccall "duckdb_execute_prepared_streaming"
     c_duckdb_execute_prepared_streaming :: DuckDBPreparedStatement -> Ptr DuckDBResult -> IO DuckDBState
diff --git a/src/Database/DuckDB/FFI/Expression.hs b/src/Database/DuckDB/FFI/Expression.hs
--- a/src/Database/DuckDB/FFI/Expression.hs
+++ b/src/Database/DuckDB/FFI/Expression.hs
@@ -14,7 +14,7 @@
 Parameters:
 * @expr@: A pointer to the expression.
 -}
-foreign import ccall unsafe "duckdb_destroy_expression"
+foreign import ccall safe "duckdb_destroy_expression"
     c_duckdb_destroy_expression :: Ptr DuckDBExpression -> IO ()
 
 {- | Returns the return type of an expression.
@@ -24,7 +24,7 @@
 
 Returns The return type. Must be destroyed with @duckdb_destroy_logical_type@.
 -}
-foreign import ccall unsafe "duckdb_expression_return_type"
+foreign import ccall safe "duckdb_expression_return_type"
     c_duckdb_expression_return_type :: DuckDBExpression -> IO DuckDBLogicalType
 
 {- | Returns whether the expression is foldable into a value or not.
@@ -34,7 +34,7 @@
 
 Returns True, if the expression is foldable, else false.
 -}
-foreign import ccall unsafe "duckdb_expression_is_foldable"
+foreign import ccall safe "duckdb_expression_is_foldable"
     c_duckdb_expression_is_foldable :: DuckDBExpression -> IO CBool
 
 {- | Folds an expression creating a folded value.
@@ -47,5 +47,5 @@
 
 Returns The error data. Must be destroyed with @duckdb_destroy_error_data@.
 -}
-foreign import ccall safe "duckdb_expression_fold"
+foreign import ccall "duckdb_expression_fold"
     c_duckdb_expression_fold :: DuckDBClientContext -> DuckDBExpression -> Ptr DuckDBValue -> IO DuckDBErrorData
diff --git a/src/Database/DuckDB/FFI/ExtractStatements.hs b/src/Database/DuckDB/FFI/ExtractStatements.hs
--- a/src/Database/DuckDB/FFI/ExtractStatements.hs
+++ b/src/Database/DuckDB/FFI/ExtractStatements.hs
@@ -25,7 +25,7 @@
 
 Returns The number of extracted statements or 0 on failure.
 -}
-foreign import ccall safe "duckdb_extract_statements"
+foreign import ccall "duckdb_extract_statements"
     c_duckdb_extract_statements :: DuckDBConnection -> CString -> Ptr DuckDBExtractedStatements -> IO DuckDBIdx
 
 {- | Prepare an extracted statement. Note that after calling
@@ -43,7 +43,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_prepare_extracted_statement"
+foreign import ccall "duckdb_prepare_extracted_statement"
     c_duckdb_prepare_extracted_statement :: DuckDBConnection -> DuckDBExtractedStatements -> DuckDBIdx -> Ptr DuckDBPreparedStatement -> IO DuckDBState
 
 {- | Returns the error message contained within the extracted statements. The
@@ -55,7 +55,7 @@
 
 Returns The error of the extracted statements.
 -}
-foreign import ccall unsafe "duckdb_extract_statements_error"
+foreign import ccall safe "duckdb_extract_statements_error"
     c_duckdb_extract_statements_error :: DuckDBExtractedStatements -> IO CString
 
 {- | De-allocates all memory allocated for the extracted statements.
@@ -63,5 +63,5 @@
 Parameters:
 * @extracted_statements@: The extracted statements to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_extracted"
+foreign import ccall safe "duckdb_destroy_extracted"
     c_duckdb_destroy_extracted :: Ptr DuckDBExtractedStatements -> IO ()
diff --git a/src/Database/DuckDB/FFI/Helpers.hs b/src/Database/DuckDB/FFI/Helpers.hs
--- a/src/Database/DuckDB/FFI/Helpers.hs
+++ b/src/Database/DuckDB/FFI/Helpers.hs
@@ -41,7 +41,7 @@
 
 Returns A pointer to the allocated memory region.
 -}
-foreign import ccall unsafe "duckdb_malloc"
+foreign import ccall safe "duckdb_malloc"
     c_duckdb_malloc :: CSize -> IO (Ptr ())
 
 {- | Free a value returned from @duckdb_malloc@, @duckdb_value_varchar@,
@@ -50,7 +50,7 @@
 Parameters:
 * @ptr@: The memory region to de-allocate.
 -}
-foreign import ccall unsafe "duckdb_free"
+foreign import ccall safe "duckdb_free"
     c_duckdb_free :: Ptr () -> IO ()
 
 {- | The internal vector size used by DuckDB. This is the amount of tuples that
@@ -58,7 +58,7 @@
 
 Returns The vector size.
 -}
-foreign import ccall unsafe "duckdb_vector_size"
+foreign import ccall safe "duckdb_vector_size"
     c_duckdb_vector_size :: IO DuckDBIdx
 
 {- | Whether or not the duckdb_string_t value is inlined. This means that the data
@@ -68,7 +68,7 @@
 @wrapped_duckdb_string_is_inlined@ but mirror the DuckDB C API semantics of
 @duckdb_string_is_inlined@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_string_is_inlined"
+foreign import ccall safe "wrapped_duckdb_string_is_inlined"
     c_duckdb_string_is_inlined :: Ptr DuckDBStringT -> IO CBool
 
 {- | Get the string length of a string_t
@@ -81,7 +81,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_string_t_length@
 but mirror the DuckDB C API semantics of @duckdb_string_t_length@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_string_t_length"
+foreign import ccall safe "wrapped_duckdb_string_t_length"
     c_duckdb_string_t_length :: Ptr DuckDBStringT -> IO Word32
 
 {- | Get a pointer to the string data of a string_t
@@ -91,7 +91,7 @@
 
 Returns The pointer.
 -}
-foreign import ccall unsafe "duckdb_string_t_data"
+foreign import ccall safe "duckdb_string_t_data"
     c_duckdb_string_t_data :: Ptr DuckDBStringT -> IO CString
 
 {- | Decompose a @duckdb_date@ object into year, month and date (stored as
@@ -105,7 +105,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_from_date@ but
 mirror the DuckDB C API semantics of @duckdb_from_date@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_from_date"
+foreign import ccall safe "wrapped_duckdb_from_date"
     c_duckdb_from_date :: DuckDBDate -> Ptr DuckDBDateStruct -> IO ()
 
 {- | Re-compose a @duckdb_date@ from year, month and date (@duckdb_date_struct@).
@@ -118,7 +118,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_to_date@ but
 mirror the DuckDB C API semantics of @duckdb_to_date@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_to_date"
+foreign import ccall safe "wrapped_duckdb_to_date"
     c_duckdb_to_date :: Ptr DuckDBDateStruct -> IO DuckDBDate
 
 {- | Test a @duckdb_date@ to see if it is a finite value.
@@ -128,7 +128,7 @@
 
 Returns True if the date is finite, false if it is ±infinity.
 -}
-foreign import ccall unsafe "duckdb_is_finite_date"
+foreign import ccall safe "duckdb_is_finite_date"
     c_duckdb_is_finite_date :: DuckDBDate -> IO CBool
 
 {- | Decompose a @duckdb_time@ object into hour, minute, second and microsecond
@@ -142,7 +142,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_from_time@ but
 mirror the DuckDB C API semantics of @duckdb_from_time@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_from_time"
+foreign import ccall safe "wrapped_duckdb_from_time"
     c_duckdb_from_time :: DuckDBTime -> Ptr DuckDBTimeStruct -> IO ()
 
 {- | Create a @duckdb_time_tz@ object from micros and a timezone offset.
@@ -153,7 +153,7 @@
 
 Returns The @duckdb_time_tz@ element.
 -}
-foreign import ccall unsafe "duckdb_create_time_tz"
+foreign import ccall safe "duckdb_create_time_tz"
     c_duckdb_create_time_tz :: Int64 -> Int32 -> IO DuckDBTimeTz
 
 {- | Decompose a TIME_TZ objects into micros and a timezone offset.
@@ -167,7 +167,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_from_time_tz@
 but mirror the DuckDB C API semantics of @duckdb_from_time_tz@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_from_time_tz"
+foreign import ccall safe "wrapped_duckdb_from_time_tz"
     c_duckdb_from_time_tz :: DuckDBTimeTz -> Ptr DuckDBTimeTzStruct -> IO ()
 
 {- | Re-compose a @duckdb_time@ from hour, minute, second and microsecond
@@ -181,7 +181,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_to_time@ but
 mirror the DuckDB C API semantics of @duckdb_to_time@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_to_time"
+foreign import ccall safe "wrapped_duckdb_to_time"
     c_duckdb_to_time :: Ptr DuckDBTimeStruct -> IO DuckDBTime
 
 {- | Decompose a @duckdb_timestamp@ object into a @duckdb_timestamp_struct@.
@@ -194,7 +194,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_from_timestamp@
 but mirror the DuckDB C API semantics of @duckdb_from_timestamp@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_from_timestamp"
+foreign import ccall safe "wrapped_duckdb_from_timestamp"
     c_duckdb_from_timestamp :: DuckDBTimestamp -> Ptr DuckDBTimestampStruct -> IO ()
 
 {- | Re-compose a @duckdb_timestamp@ from a duckdb_timestamp_struct.
@@ -207,7 +207,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_to_timestamp@
 but mirror the DuckDB C API semantics of @duckdb_to_timestamp@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_to_timestamp"
+foreign import ccall safe "wrapped_duckdb_to_timestamp"
     c_duckdb_to_timestamp :: Ptr DuckDBTimestampStruct -> IO DuckDBTimestamp
 
 {- | Test a @duckdb_timestamp@ to see if it is a finite value.
@@ -218,7 +218,7 @@
 
 Returns True if the timestamp is finite, false if it is ±infinity.
 -}
-foreign import ccall unsafe "duckdb_is_finite_timestamp"
+foreign import ccall safe "duckdb_is_finite_timestamp"
     c_duckdb_is_finite_timestamp :: DuckDBTimestamp -> IO CBool
 
 {- | Test a @duckdb_timestamp_s@ to see if it is a finite value.
@@ -229,7 +229,7 @@
 
 Returns True if the timestamp is finite, false if it is ±infinity.
 -}
-foreign import ccall unsafe "duckdb_is_finite_timestamp_s"
+foreign import ccall safe "duckdb_is_finite_timestamp_s"
     c_duckdb_is_finite_timestamp_s :: DuckDBTimestampS -> IO CBool
 
 {- | Test a @duckdb_timestamp_ms@ to see if it is a finite value.
@@ -240,7 +240,7 @@
 
 Returns True if the timestamp is finite, false if it is ±infinity.
 -}
-foreign import ccall unsafe "duckdb_is_finite_timestamp_ms"
+foreign import ccall safe "duckdb_is_finite_timestamp_ms"
     c_duckdb_is_finite_timestamp_ms :: DuckDBTimestampMs -> IO CBool
 
 {- | Test a @duckdb_timestamp_ns@ to see if it is a finite value.
@@ -251,7 +251,7 @@
 
 Returns True if the timestamp is finite, false if it is ±infinity.
 -}
-foreign import ccall unsafe "duckdb_is_finite_timestamp_ns"
+foreign import ccall safe "duckdb_is_finite_timestamp_ns"
     c_duckdb_is_finite_timestamp_ns :: DuckDBTimestampNs -> IO CBool
 
 {- | Converts a duckdb_hugeint object (as obtained from a @DUCKDB_TYPE_HUGEINT@
@@ -266,7 +266,7 @@
 @wrapped_duckdb_hugeint_to_double@ but mirror the DuckDB C API semantics of
 @duckdb_hugeint_to_double@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_hugeint_to_double"
+foreign import ccall safe "wrapped_duckdb_hugeint_to_double"
     c_duckdb_hugeint_to_double :: Ptr DuckDBHugeInt -> IO CDouble
 
 {- | Converts a double value to a duckdb_hugeint object.
@@ -283,7 +283,7 @@
 @wrapped_duckdb_double_to_hugeint@ but mirror the DuckDB C API semantics of
 @duckdb_double_to_hugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_double_to_hugeint"
+foreign import ccall safe "wrapped_duckdb_double_to_hugeint"
     c_duckdb_double_to_hugeint :: CDouble -> Ptr DuckDBHugeInt -> IO ()
 
 {- | Converts a duckdb_uhugeint object (as obtained from a @DUCKDB_TYPE_UHUGEINT@
@@ -298,7 +298,7 @@
 @wrapped_duckdb_uhugeint_to_double@ but mirror the DuckDB C API semantics of
 @duckdb_uhugeint_to_double@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_uhugeint_to_double"
+foreign import ccall safe "wrapped_duckdb_uhugeint_to_double"
     c_duckdb_uhugeint_to_double :: Ptr DuckDBUHugeInt -> IO CDouble
 
 {- | Converts a double value to a duckdb_uhugeint object.
@@ -315,7 +315,7 @@
 @wrapped_duckdb_double_to_uhugeint@ but mirror the DuckDB C API semantics of
 @duckdb_double_to_uhugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_double_to_uhugeint"
+foreign import ccall safe "wrapped_duckdb_double_to_uhugeint"
     c_duckdb_double_to_uhugeint :: CDouble -> Ptr DuckDBUHugeInt -> IO ()
 
 {- | Converts a double value to a duckdb_decimal object.
@@ -332,7 +332,7 @@
 @wrapped_duckdb_double_to_decimal@ but mirror the DuckDB C API semantics of
 @duckdb_double_to_decimal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_double_to_decimal"
+foreign import ccall safe "wrapped_duckdb_double_to_decimal"
     c_duckdb_double_to_decimal :: CDouble -> Word8 -> Word8 -> Ptr DuckDBDecimal -> IO ()
 
 {- | Converts a duckdb_decimal object (as obtained from a @DUCKDB_TYPE_DECIMAL@
@@ -347,5 +347,5 @@
 @wrapped_duckdb_decimal_to_double@ but mirror the DuckDB C API semantics of
 @duckdb_decimal_to_double@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_decimal_to_double"
+foreign import ccall safe "wrapped_duckdb_decimal_to_double"
     c_duckdb_decimal_to_double :: Ptr DuckDBDecimal -> IO CDouble
diff --git a/src/Database/DuckDB/FFI/LogicalTypes.hs b/src/Database/DuckDB/FFI/LogicalTypes.hs
--- a/src/Database/DuckDB/FFI/LogicalTypes.hs
+++ b/src/Database/DuckDB/FFI/LogicalTypes.hs
@@ -50,7 +50,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_logical_type"
+foreign import ccall safe "duckdb_create_logical_type"
     c_duckdb_create_logical_type :: DuckDBType -> IO DuckDBLogicalType
 
 {- | Returns the alias of a duckdb_logical_type, if set, else @nullptr@. The result
@@ -61,7 +61,7 @@
 
 Returns The alias or @nullptr@
 -}
-foreign import ccall unsafe "duckdb_logical_type_get_alias"
+foreign import ccall safe "duckdb_logical_type_get_alias"
     c_duckdb_logical_type_get_alias :: DuckDBLogicalType -> IO CString
 
 {- | Sets the alias of a duckdb_logical_type.
@@ -70,7 +70,7 @@
 * @type@: The logical type
 * @alias@: The alias to set
 -}
-foreign import ccall unsafe "duckdb_logical_type_set_alias"
+foreign import ccall safe "duckdb_logical_type_set_alias"
     c_duckdb_logical_type_set_alias :: DuckDBLogicalType -> CString -> IO ()
 
 {- | Creates a LIST type from its child type. The return type must be destroyed
@@ -81,7 +81,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_list_type"
+foreign import ccall safe "duckdb_create_list_type"
     c_duckdb_create_list_type :: DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Creates an ARRAY type from its child type. The return type must be destroyed
@@ -93,7 +93,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_array_type"
+foreign import ccall safe "duckdb_create_array_type"
     c_duckdb_create_array_type :: DuckDBLogicalType -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Creates a MAP type from its key type and value type. The return type must be
@@ -105,7 +105,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_map_type"
+foreign import ccall safe "duckdb_create_map_type"
     c_duckdb_create_map_type :: DuckDBLogicalType -> DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Creates a UNION type from the passed arrays. The return type must be destroyed
@@ -118,7 +118,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_union_type"
+foreign import ccall safe "duckdb_create_union_type"
     c_duckdb_create_union_type :: Ptr DuckDBLogicalType -> Ptr CString -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Creates a STRUCT type based on the member types and names. The resulting type
@@ -131,7 +131,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_struct_type"
+foreign import ccall safe "duckdb_create_struct_type"
     c_duckdb_create_struct_type :: Ptr DuckDBLogicalType -> Ptr CString -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Creates an ENUM type from the passed member name array. The resulting type
@@ -143,7 +143,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_enum_type"
+foreign import ccall safe "duckdb_create_enum_type"
     c_duckdb_create_enum_type :: Ptr CString -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Creates a DECIMAL type with the specified width and scale. The resulting type
@@ -155,7 +155,7 @@
 
 Returns The logical type.
 -}
-foreign import ccall unsafe "duckdb_create_decimal_type"
+foreign import ccall safe "duckdb_create_decimal_type"
     c_duckdb_create_decimal_type :: Word8 -> Word8 -> IO DuckDBLogicalType
 
 {- | Retrieves the enum @duckdb_type@ of a @duckdb_logical_type@.
@@ -165,7 +165,7 @@
 
 Returns The @duckdb_type@ id.
 -}
-foreign import ccall unsafe "duckdb_get_type_id"
+foreign import ccall safe "duckdb_get_type_id"
     c_duckdb_get_type_id :: DuckDBLogicalType -> IO DuckDBType
 
 {- | Retrieves the width of a decimal type.
@@ -175,7 +175,7 @@
 
 Returns The width of the decimal type
 -}
-foreign import ccall unsafe "duckdb_decimal_width"
+foreign import ccall safe "duckdb_decimal_width"
     c_duckdb_decimal_width :: DuckDBLogicalType -> IO Word8
 
 {- | Retrieves the scale of a decimal type.
@@ -185,7 +185,7 @@
 
 Returns The scale of the decimal type
 -}
-foreign import ccall unsafe "duckdb_decimal_scale"
+foreign import ccall safe "duckdb_decimal_scale"
     c_duckdb_decimal_scale :: DuckDBLogicalType -> IO Word8
 
 {- | Retrieves the internal storage type of a decimal type.
@@ -195,7 +195,7 @@
 
 Returns The internal type of the decimal type
 -}
-foreign import ccall unsafe "duckdb_decimal_internal_type"
+foreign import ccall safe "duckdb_decimal_internal_type"
     c_duckdb_decimal_internal_type :: DuckDBLogicalType -> IO DuckDBType
 
 {- | Retrieves the internal storage type of an enum type.
@@ -205,7 +205,7 @@
 
 Returns The internal type of the enum type
 -}
-foreign import ccall unsafe "duckdb_enum_internal_type"
+foreign import ccall safe "duckdb_enum_internal_type"
     c_duckdb_enum_internal_type :: DuckDBLogicalType -> IO DuckDBType
 
 {- | Retrieves the dictionary size of the enum type.
@@ -215,7 +215,7 @@
 
 Returns The dictionary size of the enum type
 -}
-foreign import ccall unsafe "duckdb_enum_dictionary_size"
+foreign import ccall safe "duckdb_enum_dictionary_size"
     c_duckdb_enum_dictionary_size :: DuckDBLogicalType -> IO Word32
 
 {- | Retrieves the dictionary value at the specified position from the enum.
@@ -228,7 +228,7 @@
 
 Returns The string value of the enum type. Must be freed with @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_enum_dictionary_value"
+foreign import ccall safe "duckdb_enum_dictionary_value"
     c_duckdb_enum_dictionary_value :: DuckDBLogicalType -> DuckDBIdx -> IO CString
 
 {- | Retrieves the child type of the given LIST type. Also accepts MAP types. The
@@ -239,7 +239,7 @@
 
 Returns The child type of the LIST or MAP type.
 -}
-foreign import ccall unsafe "duckdb_list_type_child_type"
+foreign import ccall safe "duckdb_list_type_child_type"
     c_duckdb_list_type_child_type :: DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Retrieves the child type of the given ARRAY type.
@@ -251,7 +251,7 @@
 
 Returns The child type of the ARRAY type.
 -}
-foreign import ccall unsafe "duckdb_array_type_child_type"
+foreign import ccall safe "duckdb_array_type_child_type"
     c_duckdb_array_type_child_type :: DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Retrieves the array size of the given array type.
@@ -261,7 +261,7 @@
 
 Returns The fixed number of elements the values of this array type can store.
 -}
-foreign import ccall unsafe "duckdb_array_type_array_size"
+foreign import ccall safe "duckdb_array_type_array_size"
     c_duckdb_array_type_array_size :: DuckDBLogicalType -> IO DuckDBIdx
 
 {- | Retrieves the key type of the given map type.
@@ -274,7 +274,7 @@
 Returns The key type of the map type. Must be destroyed with
 @duckdb_destroy_logical_type@.
 -}
-foreign import ccall unsafe "duckdb_map_type_key_type"
+foreign import ccall safe "duckdb_map_type_key_type"
     c_duckdb_map_type_key_type :: DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Retrieves the value type of the given map type.
@@ -287,7 +287,7 @@
 Returns The value type of the map type. Must be destroyed with
 @duckdb_destroy_logical_type@.
 -}
-foreign import ccall unsafe "duckdb_map_type_value_type"
+foreign import ccall safe "duckdb_map_type_value_type"
     c_duckdb_map_type_value_type :: DuckDBLogicalType -> IO DuckDBLogicalType
 
 {- | Returns the number of children of a struct type.
@@ -297,7 +297,7 @@
 
 Returns The number of children of a struct type.
 -}
-foreign import ccall unsafe "duckdb_struct_type_child_count"
+foreign import ccall safe "duckdb_struct_type_child_count"
     c_duckdb_struct_type_child_count :: DuckDBLogicalType -> IO DuckDBIdx
 
 {- | Retrieves the name of the struct child.
@@ -310,7 +310,7 @@
 
 Returns The name of the struct type. Must be freed with @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_struct_type_child_name"
+foreign import ccall safe "duckdb_struct_type_child_name"
     c_duckdb_struct_type_child_name :: DuckDBLogicalType -> DuckDBIdx -> IO CString
 
 {- | Retrieves the child type of the given struct type at the specified index.
@@ -324,7 +324,7 @@
 Returns The child type of the struct type. Must be destroyed with
 @duckdb_destroy_logical_type@.
 -}
-foreign import ccall unsafe "duckdb_struct_type_child_type"
+foreign import ccall safe "duckdb_struct_type_child_type"
     c_duckdb_struct_type_child_type :: DuckDBLogicalType -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Returns the number of members that the union type has.
@@ -334,7 +334,7 @@
 
 Returns The number of members of a union type.
 -}
-foreign import ccall unsafe "duckdb_union_type_member_count"
+foreign import ccall safe "duckdb_union_type_member_count"
     c_duckdb_union_type_member_count :: DuckDBLogicalType -> IO DuckDBIdx
 
 {- | Retrieves the name of the union member.
@@ -347,7 +347,7 @@
 
 Returns The name of the union member. Must be freed with @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_union_type_member_name"
+foreign import ccall safe "duckdb_union_type_member_name"
     c_duckdb_union_type_member_name :: DuckDBLogicalType -> DuckDBIdx -> IO CString
 
 {- | Retrieves the child type of the given union member at the specified index.
@@ -361,7 +361,7 @@
 Returns The child type of the union member. Must be destroyed with
 @duckdb_destroy_logical_type@.
 -}
-foreign import ccall unsafe "duckdb_union_type_member_type"
+foreign import ccall safe "duckdb_union_type_member_type"
     c_duckdb_union_type_member_type :: DuckDBLogicalType -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Destroys the logical type and de-allocates all memory allocated for that type.
@@ -369,7 +369,7 @@
 Parameters:
 * @type@: The logical type to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_logical_type"
+foreign import ccall safe "duckdb_destroy_logical_type"
     c_duckdb_destroy_logical_type :: Ptr DuckDBLogicalType -> IO ()
 
 {- | Registers a custom type within the given connection. The type must have an
@@ -381,5 +381,5 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_logical_type"
+foreign import ccall safe "duckdb_register_logical_type"
     c_duckdb_register_logical_type :: DuckDBConnection -> DuckDBLogicalType -> DuckDBCreateTypeInfo -> IO DuckDBState
diff --git a/src/Database/DuckDB/FFI/OpenConnect.hs b/src/Database/DuckDB/FFI/OpenConnect.hs
--- a/src/Database/DuckDB/FFI/OpenConnect.hs
+++ b/src/Database/DuckDB/FFI/OpenConnect.hs
@@ -29,7 +29,7 @@
 
 Returns The database instance cache.
 -}
-foreign import ccall unsafe "duckdb_create_instance_cache"
+foreign import ccall safe "duckdb_create_instance_cache"
     c_duckdb_create_instance_cache :: IO DuckDBInstanceCache
 
 {- | Creates a new database instance in the instance cache, or retrieves an
@@ -48,7 +48,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_get_or_create_from_cache"
+foreign import ccall "duckdb_get_or_create_from_cache"
     c_duckdb_get_or_create_from_cache :: DuckDBInstanceCache -> CString -> Ptr DuckDBDatabase -> DuckDBConfig -> Ptr CString -> IO DuckDBState
 
 {- | Destroys an existing database instance cache and de-allocates its memory.
@@ -56,7 +56,7 @@
 Parameters:
 * @instance_cache@: The instance cache to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_instance_cache"
+foreign import ccall safe "duckdb_destroy_instance_cache"
     c_duckdb_destroy_instance_cache :: Ptr DuckDBInstanceCache -> IO ()
 
 {- | Creates a new database or opens an existing database file stored at the given
@@ -70,7 +70,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_open"
+foreign import ccall "duckdb_open"
     c_duckdb_open :: CString -> Ptr DuckDBDatabase -> IO DuckDBState
 
 {- | Extended version of duckdb_open. Creates a new database or opens an existing
@@ -88,7 +88,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_open_ext"
+foreign import ccall "duckdb_open_ext"
     c_duckdb_open_ext :: CString -> Ptr DuckDBDatabase -> DuckDBConfig -> Ptr CString -> IO DuckDBState
 
 {- | Closes the specified database and de-allocates all memory allocated for that
@@ -101,7 +101,7 @@
 Parameters:
 * @database@: The database object to shut down.
 -}
-foreign import ccall safe "duckdb_close"
+foreign import ccall "duckdb_close"
     c_duckdb_close :: Ptr DuckDBDatabase -> IO ()
 
 {- | Opens a connection to a database. Connections are required to query the
@@ -114,7 +114,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_connect"
+foreign import ccall "duckdb_connect"
     c_duckdb_connect :: DuckDBDatabase -> Ptr DuckDBConnection -> IO DuckDBState
 
 {- | Interrupt running query
@@ -122,7 +122,7 @@
 Parameters:
 * @connection@: The connection to interrupt
 -}
-foreign import ccall unsafe "duckdb_interrupt"
+foreign import ccall safe "duckdb_interrupt"
     c_duckdb_interrupt :: DuckDBConnection -> IO ()
 
 {- | Get progress of the running query
@@ -135,7 +135,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_query_progress@
 but mirror the DuckDB C API semantics of @duckdb_query_progress@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_query_progress"
+foreign import ccall safe "wrapped_duckdb_query_progress"
     c_duckdb_query_progress :: DuckDBConnection -> Ptr DuckDBQueryProgress -> IO ()
 
 {- | Closes the specified connection and de-allocates all memory allocated for that
@@ -144,7 +144,7 @@
 Parameters:
 * @connection@: The connection to close.
 -}
-foreign import ccall safe "duckdb_disconnect"
+foreign import ccall "duckdb_disconnect"
     c_duckdb_disconnect :: Ptr DuckDBConnection -> IO ()
 
 {- | Retrieves the client context of the connection.
@@ -154,7 +154,7 @@
 * @out_context@: The client context of the connection. Must be destroyed with
   @duckdb_destroy_client_context@.
 -}
-foreign import ccall unsafe "duckdb_connection_get_client_context"
+foreign import ccall safe "duckdb_connection_get_client_context"
     c_duckdb_connection_get_client_context :: DuckDBConnection -> Ptr DuckDBClientContext -> IO ()
 
 {- | Retrieves the arrow options of the connection.
@@ -162,7 +162,7 @@
 Parameters:
 * @connection@: The connection.
 -}
-foreign import ccall unsafe "duckdb_connection_get_arrow_options"
+foreign import ccall safe "duckdb_connection_get_arrow_options"
     c_duckdb_connection_get_arrow_options :: DuckDBConnection -> Ptr DuckDBArrowOptions -> IO ()
 
 {- | Returns the connection id of the client context.
@@ -172,7 +172,7 @@
 
 Returns The connection id of the client context.
 -}
-foreign import ccall unsafe "duckdb_client_context_get_connection_id"
+foreign import ccall safe "duckdb_client_context_get_connection_id"
     c_duckdb_client_context_get_connection_id :: DuckDBClientContext -> IO DuckDBIdx
 
 {- | Destroys the client context and deallocates its memory.
@@ -180,7 +180,7 @@
 Parameters:
 * @context@: The client context to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_client_context"
+foreign import ccall safe "duckdb_destroy_client_context"
     c_duckdb_destroy_client_context :: Ptr DuckDBClientContext -> IO ()
 
 {- | Destroys the arrow options and deallocates its memory.
@@ -188,7 +188,7 @@
 Parameters:
 * @arrow_options@: The arrow options to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_arrow_options"
+foreign import ccall safe "duckdb_destroy_arrow_options"
     c_duckdb_destroy_arrow_options :: Ptr DuckDBArrowOptions -> IO ()
 
 {- | Returns the version of the linked DuckDB, with a version postfix for dev
@@ -197,7 +197,7 @@
 Usually used for developing C extensions that must return this for a
 compatibility check.
 -}
-foreign import ccall unsafe "duckdb_library_version"
+foreign import ccall safe "duckdb_library_version"
     c_duckdb_library_version :: IO CString
 
 {- | Get the list of (fully qualified) table names of the query.
@@ -211,5 +211,5 @@
 Returns A duckdb_value of type VARCHAR[] containing the (fully qualified)
 table names of the query. Must be destroyed with duckdb_destroy_value.
 -}
-foreign import ccall safe "duckdb_get_table_names"
+foreign import ccall "duckdb_get_table_names"
     c_duckdb_get_table_names :: DuckDBConnection -> CString -> CBool -> IO DuckDBValue
diff --git a/src/Database/DuckDB/FFI/PendingResult.hs b/src/Database/DuckDB/FFI/PendingResult.hs
--- a/src/Database/DuckDB/FFI/PendingResult.hs
+++ b/src/Database/DuckDB/FFI/PendingResult.hs
@@ -29,7 +29,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_pending_prepared"
+foreign import ccall "duckdb_pending_prepared"
     c_duckdb_pending_prepared :: DuckDBPreparedStatement -> Ptr DuckDBPendingResult -> IO DuckDBState
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -50,7 +50,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_pending_prepared_streaming"
+foreign import ccall "duckdb_pending_prepared_streaming"
     c_duckdb_pending_prepared_streaming :: DuckDBPreparedStatement -> Ptr DuckDBPendingResult -> IO DuckDBState
 
 {- | Closes the pending result and de-allocates all memory allocated for the
@@ -59,7 +59,7 @@
 Parameters:
 * @pending_result@: The pending result to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_pending"
+foreign import ccall safe "duckdb_destroy_pending"
     c_duckdb_destroy_pending :: Ptr DuckDBPendingResult -> IO ()
 
 {- | Returns the error message contained within the pending result.
@@ -72,7 +72,7 @@
 
 Returns The error of the pending result.
 -}
-foreign import ccall unsafe "duckdb_pending_error"
+foreign import ccall safe "duckdb_pending_error"
     c_duckdb_pending_error :: DuckDBPendingResult -> IO CString
 
 {- | Executes a single task within the query, returning whether or not the query is
@@ -92,7 +92,7 @@
 
 Returns The state of the pending result after the execution.
 -}
-foreign import ccall safe "duckdb_pending_execute_task"
+foreign import ccall "duckdb_pending_execute_task"
     c_duckdb_pending_execute_task :: DuckDBPendingResult -> IO DuckDBPendingState
 
 {- | If this returns DUCKDB_PENDING_RESULT_READY, the duckdb_execute_pending
@@ -109,7 +109,7 @@
 
 Returns The state of the pending result.
 -}
-foreign import ccall unsafe "duckdb_pending_execute_check_state"
+foreign import ccall safe "duckdb_pending_execute_check_state"
     c_duckdb_pending_execute_check_state :: DuckDBPendingResult -> IO DuckDBPendingState
 
 {- | Fully execute a pending query result, returning the final query result.
@@ -126,7 +126,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_execute_pending"
+foreign import ccall "duckdb_execute_pending"
     c_duckdb_execute_pending :: DuckDBPendingResult -> Ptr DuckDBResult -> IO DuckDBState
 
 {- | Returns whether a duckdb_pending_state is finished executing. For example if
@@ -139,5 +139,5 @@
 
 Returns Boolean indicating pending execution should be considered finished.
 -}
-foreign import ccall unsafe "duckdb_pending_execution_is_finished"
+foreign import ccall safe "duckdb_pending_execution_is_finished"
     c_duckdb_pending_execution_is_finished :: DuckDBPendingState -> IO CBool
diff --git a/src/Database/DuckDB/FFI/PreparedStatements.hs b/src/Database/DuckDB/FFI/PreparedStatements.hs
--- a/src/Database/DuckDB/FFI/PreparedStatements.hs
+++ b/src/Database/DuckDB/FFI/PreparedStatements.hs
@@ -34,7 +34,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_prepare"
+foreign import ccall "duckdb_prepare"
     c_duckdb_prepare :: DuckDBConnection -> CString -> Ptr DuckDBPreparedStatement -> IO DuckDBState
 
 {- | Closes the prepared statement and de-allocates all memory allocated for the
@@ -43,7 +43,7 @@
 Parameters:
 * @prepared_statement@: The prepared statement to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_prepare"
+foreign import ccall safe "duckdb_destroy_prepare"
     c_duckdb_destroy_prepare :: Ptr DuckDBPreparedStatement -> IO ()
 
 {- | Returns the error message associated with the given prepared statement. If the
@@ -57,7 +57,7 @@
 
 Returns The error message, or @nullptr@ if there is none.
 -}
-foreign import ccall unsafe "duckdb_prepare_error"
+foreign import ccall safe "duckdb_prepare_error"
     c_duckdb_prepare_error :: DuckDBPreparedStatement -> IO CString
 
 {- | Returns the number of parameters that can be provided to the given prepared
@@ -69,7 +69,7 @@
 * @prepared_statement@: The prepared statement to obtain the number of
   parameters for.
 -}
-foreign import ccall unsafe "duckdb_nparams"
+foreign import ccall safe "duckdb_nparams"
     c_duckdb_nparams :: DuckDBPreparedStatement -> IO DuckDBIdx
 
 {- | Returns the name used to identify the parameter The returned string should be
@@ -81,7 +81,7 @@
 * @prepared_statement@: The prepared statement for which to get the parameter
   name from.
 -}
-foreign import ccall unsafe "duckdb_parameter_name"
+foreign import ccall safe "duckdb_parameter_name"
     c_duckdb_parameter_name :: DuckDBPreparedStatement -> DuckDBIdx -> IO CString
 
 {- | Returns the parameter type for the parameter at the given index.
@@ -95,7 +95,7 @@
 
 Returns The parameter type
 -}
-foreign import ccall unsafe "duckdb_param_type"
+foreign import ccall safe "duckdb_param_type"
     c_duckdb_param_type :: DuckDBPreparedStatement -> DuckDBIdx -> IO DuckDBType
 
 {- | Returns the logical type for the parameter at the given index.
@@ -112,11 +112,11 @@
 
 Returns The logical type of the parameter
 -}
-foreign import ccall unsafe "duckdb_param_logical_type"
+foreign import ccall safe "duckdb_param_logical_type"
     c_duckdb_param_logical_type :: DuckDBPreparedStatement -> DuckDBIdx -> IO DuckDBLogicalType
 
 -- | Clear the params bind to the prepared statement.
-foreign import ccall unsafe "duckdb_clear_bindings"
+foreign import ccall safe "duckdb_clear_bindings"
     c_duckdb_clear_bindings :: DuckDBPreparedStatement -> IO DuckDBState
 
 {- | Returns the statement type of the statement to be executed
@@ -126,7 +126,7 @@
 
 Returns duckdb_statement_type value or DUCKDB_STATEMENT_TYPE_INVALID
 -}
-foreign import ccall unsafe "duckdb_prepared_statement_type"
+foreign import ccall safe "duckdb_prepared_statement_type"
     c_duckdb_prepared_statement_type :: DuckDBPreparedStatement -> IO DuckDBStatementType
 
 {- | Returns the number of columns present in a the result of the prepared
@@ -137,7 +137,7 @@
 
 Returns The number of columns present in the result of the prepared statement.
 -}
-foreign import ccall unsafe "duckdb_prepared_statement_column_count"
+foreign import ccall safe "duckdb_prepared_statement_column_count"
     c_duckdb_prepared_statement_column_count :: DuckDBPreparedStatement -> IO DuckDBIdx
 
 {- | Returns the name of the specified column of the result of the
@@ -151,7 +151,7 @@
 
 Returns The column name of the specified column.
 -}
-foreign import ccall unsafe "duckdb_prepared_statement_column_name"
+foreign import ccall safe "duckdb_prepared_statement_column_name"
     c_duckdb_prepared_statement_column_name :: DuckDBPreparedStatement -> DuckDBIdx -> IO CString
 
 {- | Returns the column type of the specified column of the result of the
@@ -166,7 +166,7 @@
 
 Returns The logical type of the specified column.
 -}
-foreign import ccall unsafe "duckdb_prepared_statement_column_logical_type"
+foreign import ccall safe "duckdb_prepared_statement_column_logical_type"
     c_duckdb_prepared_statement_column_logical_type :: DuckDBPreparedStatement -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Returns the column type of the specified column of the result of the
@@ -180,5 +180,5 @@
 
 Returns The type of the specified column.
 -}
-foreign import ccall unsafe "duckdb_prepared_statement_column_type"
+foreign import ccall safe "duckdb_prepared_statement_column_type"
     c_duckdb_prepared_statement_column_type :: DuckDBPreparedStatement -> DuckDBIdx -> IO DuckDBType
diff --git a/src/Database/DuckDB/FFI/ProfilingInfo.hs b/src/Database/DuckDB/FFI/ProfilingInfo.hs
--- a/src/Database/DuckDB/FFI/ProfilingInfo.hs
+++ b/src/Database/DuckDB/FFI/ProfilingInfo.hs
@@ -17,7 +17,7 @@
 
 Returns A profiling information object.
 -}
-foreign import ccall unsafe "duckdb_get_profiling_info"
+foreign import ccall safe "duckdb_get_profiling_info"
     c_duckdb_get_profiling_info :: DuckDBConnection -> IO DuckDBProfilingInfo
 
 {- | Returns the value of the metric of the current profiling info node. Returns
@@ -31,7 +31,7 @@
 
 Returns The value of the metric. Must be freed with @duckdb_destroy_value@
 -}
-foreign import ccall unsafe "duckdb_profiling_info_get_value"
+foreign import ccall safe "duckdb_profiling_info_get_value"
     c_duckdb_profiling_info_get_value :: DuckDBProfilingInfo -> CString -> IO DuckDBValue
 
 {- | Returns the key-value metric map of this profiling node as a MAP duckdb_value.
@@ -42,7 +42,7 @@
 
 Returns The key-value metric map as a MAP duckdb_value.
 -}
-foreign import ccall unsafe "duckdb_profiling_info_get_metrics"
+foreign import ccall safe "duckdb_profiling_info_get_metrics"
     c_duckdb_profiling_info_get_metrics :: DuckDBProfilingInfo -> IO DuckDBValue
 
 {- | Returns the number of children in the current profiling info node.
@@ -52,7 +52,7 @@
 
 Returns The number of children in the current node.
 -}
-foreign import ccall unsafe "duckdb_profiling_info_get_child_count"
+foreign import ccall safe "duckdb_profiling_info_get_child_count"
     c_duckdb_profiling_info_get_child_count :: DuckDBProfilingInfo -> IO DuckDBIdx
 
 {- | Returns the child node at the specified index.
@@ -63,5 +63,5 @@
 
 Returns The child node at the specified index.
 -}
-foreign import ccall unsafe "duckdb_profiling_info_get_child"
+foreign import ccall safe "duckdb_profiling_info_get_child"
     c_duckdb_profiling_info_get_child :: DuckDBProfilingInfo -> DuckDBIdx -> IO DuckDBProfilingInfo
diff --git a/src/Database/DuckDB/FFI/QueryExecution.hs b/src/Database/DuckDB/FFI/QueryExecution.hs
--- a/src/Database/DuckDB/FFI/QueryExecution.hs
+++ b/src/Database/DuckDB/FFI/QueryExecution.hs
@@ -36,7 +36,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_query"
+foreign import ccall "duckdb_query"
     c_duckdb_query :: DuckDBConnection -> CString -> Ptr DuckDBResult -> IO DuckDBState
 
 {- | Closes the result and de-allocates all memory allocated for that result.
@@ -44,7 +44,7 @@
 Parameters:
 * @result@: The result to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_result"
+foreign import ccall safe "duckdb_destroy_result"
     c_duckdb_destroy_result :: Ptr DuckDBResult -> IO ()
 
 {- | Returns the column name of the specified column. The result should not need to
@@ -59,7 +59,7 @@
 
 Returns The column name of the specified column.
 -}
-foreign import ccall unsafe "duckdb_column_name"
+foreign import ccall safe "duckdb_column_name"
     c_duckdb_column_name :: Ptr DuckDBResult -> DuckDBIdx -> IO CString
 
 {- | Returns the column type of the specified column.
@@ -72,7 +72,7 @@
 
 Returns The column type of the specified column.
 -}
-foreign import ccall unsafe "duckdb_column_type"
+foreign import ccall safe "duckdb_column_type"
     c_duckdb_column_type :: Ptr DuckDBResult -> DuckDBIdx -> IO DuckDBType
 
 {- | Returns the statement type of the statement that was executed
@@ -86,7 +86,7 @@
 @wrapped_duckdb_result_statement_type@ but mirror the DuckDB C API semantics of
 @duckdb_result_statement_type@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_statement_type"
+foreign import ccall safe "wrapped_duckdb_result_statement_type"
     c_duckdb_result_statement_type :: Ptr DuckDBResult -> IO DuckDBStatementType
 
 {- | Returns the logical column type of the specified column.
@@ -102,7 +102,7 @@
 
 Returns The logical column type of the specified column.
 -}
-foreign import ccall unsafe "duckdb_column_logical_type"
+foreign import ccall safe "duckdb_column_logical_type"
     c_duckdb_column_logical_type :: Ptr DuckDBResult -> DuckDBIdx -> IO DuckDBLogicalType
 
 {- | Returns the arrow options associated with the given result. These options are
@@ -118,7 +118,7 @@
 @wrapped_duckdb_result_get_arrow_options@ but mirror the DuckDB C API semantics
 of @duckdb_result_get_arrow_options@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_get_arrow_options"
+foreign import ccall safe "wrapped_duckdb_result_get_arrow_options"
     c_duckdb_result_get_arrow_options :: Ptr DuckDBResult -> IO DuckDBArrowOptions
 
 {- | Returns the number of columns present in a the result object.
@@ -128,7 +128,7 @@
 
 Returns The number of columns present in the result object.
 -}
-foreign import ccall unsafe "duckdb_column_count"
+foreign import ccall safe "duckdb_column_count"
     c_duckdb_column_count :: Ptr DuckDBResult -> IO DuckDBIdx
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -141,7 +141,7 @@
 
 Returns The number of rows present in the result object.
 -}
-foreign import ccall unsafe "duckdb_row_count"
+foreign import ccall safe "duckdb_row_count"
     c_duckdb_row_count :: Ptr DuckDBResult -> IO DuckDBIdx
 
 {- | Returns the number of rows changed by the query stored in the result. This is
@@ -153,7 +153,7 @@
 
 Returns The number of rows changed.
 -}
-foreign import ccall unsafe "duckdb_rows_changed"
+foreign import ccall safe "duckdb_rows_changed"
     c_duckdb_rows_changed :: Ptr DuckDBResult -> IO DuckDBIdx
 
 {- | > Deprecated This method has been deprecated. Prefer using
@@ -178,7 +178,7 @@
 
 Returns The column data of the specified column.
 -}
-foreign import ccall unsafe "duckdb_column_data"
+foreign import ccall safe "duckdb_column_data"
     c_duckdb_column_data :: Ptr DuckDBResult -> DuckDBIdx -> IO (Ptr ())
 
 {- | > Deprecated This method has been deprecated. Prefer using
@@ -200,7 +200,7 @@
 
 Returns The nullmask of the specified column.
 -}
-foreign import ccall unsafe "duckdb_nullmask_data"
+foreign import ccall safe "duckdb_nullmask_data"
     c_duckdb_nullmask_data :: Ptr DuckDBResult -> DuckDBIdx -> IO (Ptr CBool)
 
 {- | Returns the error message contained within the result. The error is only set
@@ -214,7 +214,7 @@
 
 Returns The error of the result.
 -}
-foreign import ccall unsafe "duckdb_result_error"
+foreign import ccall safe "duckdb_result_error"
     c_duckdb_result_error :: Ptr DuckDBResult -> IO CString
 
 {- | Returns the result error type contained within the result. The error is only
@@ -225,5 +225,5 @@
 
 Returns The error type of the result.
 -}
-foreign import ccall unsafe "duckdb_result_error_type"
+foreign import ccall safe "duckdb_result_error_type"
     c_duckdb_result_error_type :: Ptr DuckDBResult -> IO DuckDBErrorType
diff --git a/src/Database/DuckDB/FFI/ReplacementScans.hs b/src/Database/DuckDB/FFI/ReplacementScans.hs
--- a/src/Database/DuckDB/FFI/ReplacementScans.hs
+++ b/src/Database/DuckDB/FFI/ReplacementScans.hs
@@ -17,7 +17,7 @@
 * @extra_data@: Extra data that is passed back into the specified callback
 * @delete_callback@: The delete callback to call on the extra data, if any
 -}
-foreign import ccall unsafe "duckdb_add_replacement_scan"
+foreign import ccall safe "duckdb_add_replacement_scan"
     c_duckdb_add_replacement_scan :: DuckDBDatabase -> DuckDBReplacementCallback -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Sets the replacement function name. If this function is called in the
@@ -28,7 +28,7 @@
 * @info@: The info object
 * @function_name@: The function name to substitute.
 -}
-foreign import ccall unsafe "duckdb_replacement_scan_set_function_name"
+foreign import ccall safe "duckdb_replacement_scan_set_function_name"
     c_duckdb_replacement_scan_set_function_name :: DuckDBReplacementScanInfo -> CString -> IO ()
 
 {- | Adds a parameter to the replacement scan function.
@@ -37,7 +37,7 @@
 * @info@: The info object
 * @parameter@: The parameter to add.
 -}
-foreign import ccall unsafe "duckdb_replacement_scan_add_parameter"
+foreign import ccall safe "duckdb_replacement_scan_add_parameter"
     c_duckdb_replacement_scan_add_parameter :: DuckDBReplacementScanInfo -> DuckDBValue -> IO ()
 
 {- | Report that an error has occurred while executing the replacement scan.
@@ -46,5 +46,5 @@
 * @info@: The info object
 * @error@: The error message
 -}
-foreign import ccall unsafe "duckdb_replacement_scan_set_error"
+foreign import ccall safe "duckdb_replacement_scan_set_error"
     c_duckdb_replacement_scan_set_error :: DuckDBReplacementScanInfo -> CString -> IO ()
diff --git a/src/Database/DuckDB/FFI/ResultFunctions.hs b/src/Database/DuckDB/FFI/ResultFunctions.hs
--- a/src/Database/DuckDB/FFI/ResultFunctions.hs
+++ b/src/Database/DuckDB/FFI/ResultFunctions.hs
@@ -39,7 +39,7 @@
 @wrapped_duckdb_result_get_chunk@ but mirror the DuckDB C API semantics of
 @duckdb_result_get_chunk@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_get_chunk"
+foreign import ccall safe "wrapped_duckdb_result_get_chunk"
     c_duckdb_result_get_chunk :: Ptr DuckDBResult -> DuckDBIdx -> IO DuckDBDataChunk
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -56,7 +56,7 @@
 @wrapped_duckdb_result_is_streaming@ but mirror the DuckDB C API semantics of
 @duckdb_result_is_streaming@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_is_streaming"
+foreign import ccall safe "wrapped_duckdb_result_is_streaming"
     c_duckdb_result_is_streaming :: Ptr DuckDBResult -> IO CBool
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -73,7 +73,7 @@
 @wrapped_duckdb_result_chunk_count@ but mirror the DuckDB C API semantics of
 @duckdb_result_chunk_count@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_chunk_count"
+foreign import ccall safe "wrapped_duckdb_result_chunk_count"
     c_duckdb_result_chunk_count :: Ptr DuckDBResult -> IO DuckDBIdx
 
 {- | Returns the return_type of the given result, or DUCKDB_RETURN_TYPE_INVALID on
@@ -88,5 +88,5 @@
 @wrapped_duckdb_result_return_type@ but mirror the DuckDB C API semantics of
 @duckdb_result_return_type@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_result_return_type"
+foreign import ccall safe "wrapped_duckdb_result_return_type"
     c_duckdb_result_return_type :: Ptr DuckDBResult -> IO DuckDBResultType
diff --git a/src/Database/DuckDB/FFI/SafeFetch.hs b/src/Database/DuckDB/FFI/SafeFetch.hs
--- a/src/Database/DuckDB/FFI/SafeFetch.hs
+++ b/src/Database/DuckDB/FFI/SafeFetch.hs
@@ -38,7 +38,7 @@
 Returns The boolean value at the specified location, or false if the value
 cannot be converted.
 -}
-foreign import ccall unsafe "duckdb_value_boolean"
+foreign import ccall safe "duckdb_value_boolean"
     c_duckdb_value_boolean :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CBool
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -47,7 +47,7 @@
 Returns The int8_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_int8"
+foreign import ccall safe "duckdb_value_int8"
     c_duckdb_value_int8 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Int8
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -56,7 +56,7 @@
 Returns The int16_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_int16"
+foreign import ccall safe "duckdb_value_int16"
     c_duckdb_value_int16 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Int16
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -65,7 +65,7 @@
 Returns The int32_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_int32"
+foreign import ccall safe "duckdb_value_int32"
     c_duckdb_value_int32 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Int32
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -74,7 +74,7 @@
 Returns The int64_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_int64"
+foreign import ccall safe "duckdb_value_int64"
     c_duckdb_value_int64 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Int64
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -86,7 +86,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_hugeint@
 but mirror the DuckDB C API semantics of @duckdb_value_hugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_hugeint"
+foreign import ccall safe "wrapped_duckdb_value_hugeint"
     c_duckdb_value_hugeint :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBHugeInt -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -98,7 +98,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_uhugeint@
 but mirror the DuckDB C API semantics of @duckdb_value_uhugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_uhugeint"
+foreign import ccall safe "wrapped_duckdb_value_uhugeint"
     c_duckdb_value_uhugeint :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBUHugeInt -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -110,7 +110,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_decimal@
 but mirror the DuckDB C API semantics of @duckdb_value_decimal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_decimal"
+foreign import ccall safe "wrapped_duckdb_value_decimal"
     c_duckdb_value_decimal :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBDecimal -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -119,7 +119,7 @@
 Returns The uint8_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_uint8"
+foreign import ccall safe "duckdb_value_uint8"
     c_duckdb_value_uint8 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Word8
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -128,7 +128,7 @@
 Returns The uint16_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_uint16"
+foreign import ccall safe "duckdb_value_uint16"
     c_duckdb_value_uint16 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Word16
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -137,7 +137,7 @@
 Returns The uint32_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_uint32"
+foreign import ccall safe "duckdb_value_uint32"
     c_duckdb_value_uint32 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Word32
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -146,7 +146,7 @@
 Returns The uint64_t value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_uint64"
+foreign import ccall safe "duckdb_value_uint64"
     c_duckdb_value_uint64 :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO Word64
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -155,7 +155,7 @@
 Returns The float value at the specified location, or 0 if the value cannot be
 converted.
 -}
-foreign import ccall unsafe "duckdb_value_float"
+foreign import ccall safe "duckdb_value_float"
     c_duckdb_value_float :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CFloat
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -164,7 +164,7 @@
 Returns The double value at the specified location, or 0 if the value cannot
 be converted.
 -}
-foreign import ccall unsafe "duckdb_value_double"
+foreign import ccall safe "duckdb_value_double"
     c_duckdb_value_double :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CDouble
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -173,7 +173,7 @@
 Returns The duckdb_date value at the specified location, or 0 if the value
 cannot be converted.
 -}
-foreign import ccall unsafe "duckdb_value_date"
+foreign import ccall safe "duckdb_value_date"
     c_duckdb_value_date :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO DuckDBDate
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -182,7 +182,7 @@
 Returns The duckdb_time value at the specified location, or 0 if the value
 cannot be converted.
 -}
-foreign import ccall unsafe "duckdb_value_time"
+foreign import ccall safe "duckdb_value_time"
     c_duckdb_value_time :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO DuckDBTime
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -191,7 +191,7 @@
 Returns The duckdb_timestamp value at the specified location, or 0 if the
 value cannot be converted.
 -}
-foreign import ccall unsafe "duckdb_value_timestamp"
+foreign import ccall safe "duckdb_value_timestamp"
     c_duckdb_value_timestamp :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO DuckDBTimestamp
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -203,7 +203,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_interval@
 but mirror the DuckDB C API semantics of @duckdb_value_interval@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_interval"
+foreign import ccall safe "wrapped_duckdb_value_interval"
     c_duckdb_value_interval :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBInterval -> IO ()
 
 {- | > Deprecated This method has been deprecated. Use duckdb_value_string instead.
@@ -213,7 +213,7 @@
 or nullptr if the value cannot be converted. The result must be freed with
 @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_value_varchar"
+foreign import ccall safe "duckdb_value_varchar"
     c_duckdb_value_varchar :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CString
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -228,7 +228,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_string@
 but mirror the DuckDB C API semantics of @duckdb_value_string@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_string"
+foreign import ccall safe "wrapped_duckdb_value_string"
     c_duckdb_value_string :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBString -> IO ()
 
 {- | > Deprecated This method has been deprecated. Use duckdb_value_string_internal
@@ -239,7 +239,7 @@
 columns and does not auto-cast. If the column is NOT a VARCHAR column this
 function will return NULL. The result must NOT be freed.
 -}
-foreign import ccall unsafe "duckdb_value_varchar_internal"
+foreign import ccall safe "duckdb_value_varchar_internal"
     c_duckdb_value_varchar_internal :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CString
 
 {- | > Deprecated This method has been deprecated. Use duckdb_value_string_internal
@@ -254,7 +254,7 @@
 @wrapped_duckdb_value_string_internal@ but mirror the DuckDB C API semantics of
 @duckdb_value_string_internal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_string_internal"
+foreign import ccall safe "wrapped_duckdb_value_string_internal"
     c_duckdb_value_string_internal :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBString -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -267,7 +267,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_value_blob@ but
 mirror the DuckDB C API semantics of @duckdb_value_blob@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_value_blob"
+foreign import ccall safe "wrapped_duckdb_value_blob"
     c_duckdb_value_blob :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> Ptr DuckDBBlob -> IO ()
 
 {- | > Warning Deprecation notice. This method is scheduled for removal in a future
@@ -276,5 +276,5 @@
 Returns Returns true if the value at the specified index is NULL, and false
 otherwise.
 -}
-foreign import ccall unsafe "duckdb_value_is_null"
+foreign import ccall safe "duckdb_value_is_null"
     c_duckdb_value_is_null :: Ptr DuckDBResult -> DuckDBIdx -> DuckDBIdx -> IO CBool
diff --git a/src/Database/DuckDB/FFI/ScalarFunctions.hs b/src/Database/DuckDB/FFI/ScalarFunctions.hs
--- a/src/Database/DuckDB/FFI/ScalarFunctions.hs
+++ b/src/Database/DuckDB/FFI/ScalarFunctions.hs
@@ -38,7 +38,7 @@
 
 Returns The scalar function object.
 -}
-foreign import ccall unsafe "duckdb_create_scalar_function"
+foreign import ccall safe "duckdb_create_scalar_function"
     c_duckdb_create_scalar_function :: IO DuckDBScalarFunction
 
 {- | Destroys the given scalar function object.
@@ -46,7 +46,7 @@
 Parameters:
 * @scalar_function@: The scalar function to destroy
 -}
-foreign import ccall unsafe "duckdb_destroy_scalar_function"
+foreign import ccall safe "duckdb_destroy_scalar_function"
     c_duckdb_destroy_scalar_function :: Ptr DuckDBScalarFunction -> IO ()
 
 {- | Sets the name of the given scalar function.
@@ -55,7 +55,7 @@
 * @scalar_function@: The scalar function
 * @name@: The name of the scalar function
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_name"
+foreign import ccall safe "duckdb_scalar_function_set_name"
     c_duckdb_scalar_function_set_name :: DuckDBScalarFunction -> CString -> IO ()
 
 {- | Sets the parameters of the given scalar function to varargs. Does not require
@@ -67,7 +67,7 @@
 
 Returns The parameter type. Cannot contain INVALID.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_varargs"
+foreign import ccall safe "duckdb_scalar_function_set_varargs"
     c_duckdb_scalar_function_set_varargs :: DuckDBScalarFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the scalar function's null-handling behavior to special.
@@ -75,7 +75,7 @@
 Parameters:
 * @scalar_function@: The scalar function.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_special_handling"
+foreign import ccall safe "duckdb_scalar_function_set_special_handling"
     c_duckdb_scalar_function_set_special_handling :: DuckDBScalarFunction -> IO ()
 
 {- | Sets the Function Stability of the scalar function to VOLATILE, indicating the
@@ -85,7 +85,7 @@
 Parameters:
 * @scalar_function@: The scalar function.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_volatile"
+foreign import ccall safe "duckdb_scalar_function_set_volatile"
     c_duckdb_scalar_function_set_volatile :: DuckDBScalarFunction -> IO ()
 
 {- | Adds a parameter to the scalar function.
@@ -94,7 +94,7 @@
 * @scalar_function@: The scalar function.
 * @type@: The parameter type. Cannot contain INVALID.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_add_parameter"
+foreign import ccall safe "duckdb_scalar_function_add_parameter"
     c_duckdb_scalar_function_add_parameter :: DuckDBScalarFunction -> DuckDBLogicalType -> IO ()
 
 {- | Sets the return type of the scalar function.
@@ -103,7 +103,7 @@
 * @scalar_function@: The scalar function
 * @type@: Cannot contain INVALID or ANY.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_return_type"
+foreign import ccall safe "duckdb_scalar_function_set_return_type"
     c_duckdb_scalar_function_set_return_type :: DuckDBScalarFunction -> DuckDBLogicalType -> IO ()
 
 {- | Assigns extra information to the scalar function that can be fetched during
@@ -115,7 +115,7 @@
 * @destroy@: The callback that will be called to destroy the extra information
   (if any)
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_extra_info"
+foreign import ccall safe "duckdb_scalar_function_set_extra_info"
     c_duckdb_scalar_function_set_extra_info :: DuckDBScalarFunction -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Sets the (optional) bind function of the scalar function.
@@ -124,7 +124,7 @@
 * @scalar_function@: The scalar function.
 * @bind@: The bind function.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_bind"
+foreign import ccall safe "duckdb_scalar_function_set_bind"
     c_duckdb_scalar_function_set_bind :: DuckDBScalarFunction -> DuckDBScalarFunctionBindFun -> IO ()
 
 {- | Sets the user-provided bind data in the bind object of the scalar function.
@@ -137,7 +137,7 @@
 * @bind_data@: The bind data object.
 * @destroy@: The callback to destroy the bind data (if any).
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_bind_data"
+foreign import ccall safe "duckdb_scalar_function_set_bind_data"
     c_duckdb_scalar_function_set_bind_data :: DuckDBBindInfo -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Sets the copy-callback for the user-provided bind data in the bind object of
@@ -147,7 +147,7 @@
 * @info@: The bind info of the scalar function.
 * @copy@: The callback to copy the bind data (if any).
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_bind_data_copy"
+foreign import ccall safe "duckdb_scalar_function_set_bind_data_copy"
     c_duckdb_scalar_function_set_bind_data_copy :: DuckDBBindInfo -> DuckDBCopyCallback -> IO ()
 
 {- | Report that an error has occurred while calling bind on a scalar function.
@@ -156,7 +156,7 @@
 * @info@: The bind info object.
 * @error@: The error message.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_bind_set_error"
+foreign import ccall safe "duckdb_scalar_function_bind_set_error"
     c_duckdb_scalar_function_bind_set_error :: DuckDBBindInfo -> CString -> IO ()
 
 {- | Sets the main function of the scalar function.
@@ -165,7 +165,7 @@
 * @scalar_function@: The scalar function
 * @function@: The function
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_function"
+foreign import ccall safe "duckdb_scalar_function_set_function"
     c_duckdb_scalar_function_set_function :: DuckDBScalarFunction -> DuckDBScalarFunctionFun -> IO ()
 
 {- | Register the scalar function object within the given connection.
@@ -181,7 +181,7 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_scalar_function"
+foreign import ccall safe "duckdb_register_scalar_function"
     c_duckdb_register_scalar_function :: DuckDBConnection -> DuckDBScalarFunction -> IO DuckDBState
 
 {- | Retrieves the extra info of the function as set in
@@ -192,7 +192,7 @@
 
 Returns The extra info.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_get_extra_info"
+foreign import ccall safe "duckdb_scalar_function_get_extra_info"
     c_duckdb_scalar_function_get_extra_info :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Retrieves the extra info of the function as set in the bind info.
@@ -202,7 +202,7 @@
 
 Returns The extra info.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_bind_get_extra_info"
+foreign import ccall safe "duckdb_scalar_function_bind_get_extra_info"
     c_duckdb_scalar_function_bind_get_extra_info :: DuckDBBindInfo -> IO (Ptr ())
 
 {- | Gets the scalar function's bind data set by
@@ -213,7 +213,7 @@
 
 Returns The bind data object.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_get_bind_data"
+foreign import ccall safe "duckdb_scalar_function_get_bind_data"
     c_duckdb_scalar_function_get_bind_data :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Retrieves the client context of the bind info of a scalar function.
@@ -223,7 +223,7 @@
 * @out_context@: The client context of the bind info. Must be destroyed with
   @duckdb_destroy_client_context@.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_get_client_context"
+foreign import ccall safe "duckdb_scalar_function_get_client_context"
     c_duckdb_scalar_function_get_client_context :: DuckDBBindInfo -> Ptr DuckDBClientContext -> IO ()
 
 {- | Report that an error has occurred while executing the scalar function.
@@ -232,7 +232,7 @@
 * @info@: The info object.
 * @error@: The error message
 -}
-foreign import ccall unsafe "duckdb_scalar_function_set_error"
+foreign import ccall safe "duckdb_scalar_function_set_error"
     c_duckdb_scalar_function_set_error :: DuckDBFunctionInfo -> CString -> IO ()
 
 {- | Creates a new empty scalar function set.
@@ -241,11 +241,11 @@
 
 Returns The scalar function set object.
 -}
-foreign import ccall unsafe "duckdb_create_scalar_function_set"
+foreign import ccall safe "duckdb_create_scalar_function_set"
     c_duckdb_create_scalar_function_set :: CString -> IO DuckDBScalarFunctionSet
 
 -- | Destroys the given scalar function set object.
-foreign import ccall unsafe "duckdb_destroy_scalar_function_set"
+foreign import ccall safe "duckdb_destroy_scalar_function_set"
     c_duckdb_destroy_scalar_function_set :: Ptr DuckDBScalarFunctionSet -> IO ()
 
 {- | Adds the scalar function as a new overload to the scalar function set.
@@ -257,7 +257,7 @@
 * @set@: The scalar function set
 * @function@: The function to add
 -}
-foreign import ccall unsafe "duckdb_add_scalar_function_to_set"
+foreign import ccall safe "duckdb_add_scalar_function_to_set"
     c_duckdb_add_scalar_function_to_set :: DuckDBScalarFunctionSet -> DuckDBScalarFunction -> IO DuckDBState
 
 {- | Register the scalar function set within the given connection.
@@ -273,7 +273,7 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_scalar_function_set"
+foreign import ccall safe "duckdb_register_scalar_function_set"
     c_duckdb_register_scalar_function_set :: DuckDBConnection -> DuckDBScalarFunctionSet -> IO DuckDBState
 
 {- | Returns the number of input arguments of the scalar function.
@@ -283,7 +283,7 @@
 
 Returns The number of input arguments.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_bind_get_argument_count"
+foreign import ccall safe "duckdb_scalar_function_bind_get_argument_count"
     c_duckdb_scalar_function_bind_get_argument_count :: DuckDBBindInfo -> IO DuckDBIdx
 
 {- | Returns the input argument at index of the scalar function.
@@ -295,5 +295,5 @@
 Returns The input argument at index. Must be destroyed with
 @duckdb_destroy_expression@.
 -}
-foreign import ccall unsafe "duckdb_scalar_function_bind_get_argument"
+foreign import ccall safe "duckdb_scalar_function_bind_get_argument"
     c_duckdb_scalar_function_bind_get_argument :: DuckDBBindInfo -> DuckDBIdx -> IO DuckDBExpression
diff --git a/src/Database/DuckDB/FFI/SelectionVector.hs b/src/Database/DuckDB/FFI/SelectionVector.hs
--- a/src/Database/DuckDB/FFI/SelectionVector.hs
+++ b/src/Database/DuckDB/FFI/SelectionVector.hs
@@ -15,7 +15,7 @@
 
 Returns The selection vector.
 -}
-foreign import ccall unsafe "duckdb_create_selection_vector"
+foreign import ccall safe "duckdb_create_selection_vector"
     c_duckdb_create_selection_vector :: DuckDBIdx -> IO DuckDBSelectionVector
 
 {- | Destroys the selection vector and de-allocates its memory.
@@ -23,7 +23,7 @@
 Parameters:
 * @sel@: The selection vector.
 -}
-foreign import ccall unsafe "duckdb_destroy_selection_vector"
+foreign import ccall safe "duckdb_destroy_selection_vector"
     c_duckdb_destroy_selection_vector :: DuckDBSelectionVector -> IO ()
 
 {- | Access the data pointer of a selection vector.
@@ -33,5 +33,5 @@
 
 Returns The data pointer.
 -}
-foreign import ccall unsafe "duckdb_selection_vector_get_data_ptr"
+foreign import ccall safe "duckdb_selection_vector_get_data_ptr"
     c_duckdb_selection_vector_get_data_ptr :: DuckDBSelectionVector -> IO (Ptr DuckDBSel)
diff --git a/src/Database/DuckDB/FFI/StreamingResult.hs b/src/Database/DuckDB/FFI/StreamingResult.hs
--- a/src/Database/DuckDB/FFI/StreamingResult.hs
+++ b/src/Database/DuckDB/FFI/StreamingResult.hs
@@ -32,7 +32,7 @@
 @wrapped_duckdb_stream_fetch_chunk@ but mirror the DuckDB C API semantics of
 @duckdb_stream_fetch_chunk@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_stream_fetch_chunk"
+foreign import ccall safe "wrapped_duckdb_stream_fetch_chunk"
     c_duckdb_stream_fetch_chunk :: Ptr DuckDBResult -> IO DuckDBDataChunk
 
 {- | Fetches a data chunk from a duckdb_result. This function should be called
@@ -50,5 +50,5 @@
 These bindings call the wrapper symbol @wrapped_duckdb_fetch_chunk@ but
 mirror the DuckDB C API semantics of @duckdb_fetch_chunk@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_fetch_chunk"
+foreign import ccall safe "wrapped_duckdb_fetch_chunk"
     c_duckdb_fetch_chunk :: Ptr DuckDBResult -> IO DuckDBDataChunk
diff --git a/src/Database/DuckDB/FFI/TableDescription.hs b/src/Database/DuckDB/FFI/TableDescription.hs
--- a/src/Database/DuckDB/FFI/TableDescription.hs
+++ b/src/Database/DuckDB/FFI/TableDescription.hs
@@ -24,7 +24,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_table_description_create"
+foreign import ccall "duckdb_table_description_create"
     c_duckdb_table_description_create :: DuckDBConnection -> CString -> CString -> Ptr DuckDBTableDescription -> IO DuckDBState
 
 {- | Creates a table description object. Note that
@@ -41,7 +41,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall safe "duckdb_table_description_create_ext"
+foreign import ccall "duckdb_table_description_create_ext"
     c_duckdb_table_description_create_ext :: DuckDBConnection -> CString -> CString -> CString -> Ptr DuckDBTableDescription -> IO DuckDBState
 
 {- | Destroy the TableDescription object.
@@ -49,7 +49,7 @@
 Parameters:
 * @table_description@: The table_description to destroy.
 -}
-foreign import ccall unsafe "duckdb_table_description_destroy"
+foreign import ccall safe "duckdb_table_description_destroy"
     c_duckdb_table_description_destroy :: Ptr DuckDBTableDescription -> IO ()
 
 {- | Returns the error message associated with the given table_description. If the
@@ -62,7 +62,7 @@
 
 Returns The error message, or @nullptr@ if there is none.
 -}
-foreign import ccall unsafe "duckdb_table_description_error"
+foreign import ccall safe "duckdb_table_description_error"
     c_duckdb_table_description_error :: DuckDBTableDescription -> IO CString
 
 {- | Check if the column at @index@ index of the table has a DEFAULT expression.
@@ -74,7 +74,7 @@
 
 Returns @DuckDBSuccess@ on success or @DuckDBError@ on failure.
 -}
-foreign import ccall unsafe "duckdb_column_has_default"
+foreign import ccall safe "duckdb_column_has_default"
     c_duckdb_column_has_default :: DuckDBTableDescription -> DuckDBIdx -> Ptr CBool -> IO DuckDBState
 
 {- | Obtain the column name at @index@. The out result must be destroyed with
@@ -86,5 +86,5 @@
 
 Returns The column name.
 -}
-foreign import ccall unsafe "duckdb_table_description_get_column_name"
+foreign import ccall safe "duckdb_table_description_get_column_name"
     c_duckdb_table_description_get_column_name :: DuckDBTableDescription -> DuckDBIdx -> IO CString
diff --git a/src/Database/DuckDB/FFI/TableFunctions.hs b/src/Database/DuckDB/FFI/TableFunctions.hs
--- a/src/Database/DuckDB/FFI/TableFunctions.hs
+++ b/src/Database/DuckDB/FFI/TableFunctions.hs
@@ -49,7 +49,7 @@
 
 Returns The table function object.
 -}
-foreign import ccall unsafe "duckdb_create_table_function"
+foreign import ccall safe "duckdb_create_table_function"
     c_duckdb_create_table_function :: IO DuckDBTableFunction
 
 {- | Destroys the given table function object.
@@ -57,7 +57,7 @@
 Parameters:
 * @table_function@: The table function to destroy
 -}
-foreign import ccall unsafe "duckdb_destroy_table_function"
+foreign import ccall safe "duckdb_destroy_table_function"
     c_duckdb_destroy_table_function :: Ptr DuckDBTableFunction -> IO ()
 
 {- | Sets the name of the given table function.
@@ -66,7 +66,7 @@
 * @table_function@: The table function
 * @name@: The name of the table function
 -}
-foreign import ccall unsafe "duckdb_table_function_set_name"
+foreign import ccall safe "duckdb_table_function_set_name"
     c_duckdb_table_function_set_name :: DuckDBTableFunction -> CString -> IO ()
 
 {- | Adds a parameter to the table function.
@@ -75,7 +75,7 @@
 * @table_function@: The table function.
 * @type@: The parameter type. Cannot contain INVALID.
 -}
-foreign import ccall unsafe "duckdb_table_function_add_parameter"
+foreign import ccall safe "duckdb_table_function_add_parameter"
     c_duckdb_table_function_add_parameter :: DuckDBTableFunction -> DuckDBLogicalType -> IO ()
 
 {- | Adds a named parameter to the table function.
@@ -85,7 +85,7 @@
 * @name@: The parameter name.
 * @type@: The parameter type. Cannot contain INVALID.
 -}
-foreign import ccall unsafe "duckdb_table_function_add_named_parameter"
+foreign import ccall safe "duckdb_table_function_add_named_parameter"
     c_duckdb_table_function_add_named_parameter :: DuckDBTableFunction -> CString -> DuckDBLogicalType -> IO ()
 
 {- | Assigns extra information to the table function that can be fetched during
@@ -97,7 +97,7 @@
 * @destroy@: The callback that will be called to destroy the extra information
   (if any)
 -}
-foreign import ccall unsafe "duckdb_table_function_set_extra_info"
+foreign import ccall safe "duckdb_table_function_set_extra_info"
     c_duckdb_table_function_set_extra_info :: DuckDBTableFunction -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Sets the bind function of the table function.
@@ -106,7 +106,7 @@
 * @table_function@: The table function
 * @bind@: The bind function
 -}
-foreign import ccall unsafe "duckdb_table_function_set_bind"
+foreign import ccall safe "duckdb_table_function_set_bind"
     c_duckdb_table_function_set_bind :: DuckDBTableFunction -> DuckDBTableFunctionBindFun -> IO ()
 
 {- | Sets the init function of the table function.
@@ -115,7 +115,7 @@
 * @table_function@: The table function
 * @init@: The init function
 -}
-foreign import ccall unsafe "duckdb_table_function_set_init"
+foreign import ccall safe "duckdb_table_function_set_init"
     c_duckdb_table_function_set_init :: DuckDBTableFunction -> DuckDBTableFunctionInitFun -> IO ()
 
 {- | Sets the thread-local init function of the table function.
@@ -124,7 +124,7 @@
 * @table_function@: The table function
 * @init@: The init function
 -}
-foreign import ccall unsafe "duckdb_table_function_set_local_init"
+foreign import ccall safe "duckdb_table_function_set_local_init"
     c_duckdb_table_function_set_local_init :: DuckDBTableFunction -> DuckDBTableFunctionInitFun -> IO ()
 
 {- | Sets the main function of the table function.
@@ -133,7 +133,7 @@
 * @table_function@: The table function
 * @function@: The function
 -}
-foreign import ccall unsafe "duckdb_table_function_set_function"
+foreign import ccall safe "duckdb_table_function_set_function"
     c_duckdb_table_function_set_function :: DuckDBTableFunction -> DuckDBTableFunctionFun -> IO ()
 
 {- | Sets whether or not the given table function supports projection pushdown.
@@ -148,7 +148,7 @@
 * @pushdown@: True if the table function supports projection pushdown, false
   otherwise.
 -}
-foreign import ccall unsafe "duckdb_table_function_supports_projection_pushdown"
+foreign import ccall safe "duckdb_table_function_supports_projection_pushdown"
     c_duckdb_table_function_supports_projection_pushdown :: DuckDBTableFunction -> CBool -> IO ()
 
 {- | Register the table function object within the given connection.
@@ -165,7 +165,7 @@
 
 Returns Whether or not the registration was successful.
 -}
-foreign import ccall unsafe "duckdb_register_table_function"
+foreign import ccall safe "duckdb_register_table_function"
     c_duckdb_register_table_function :: DuckDBConnection -> DuckDBTableFunction -> IO DuckDBState
 
 {- | Retrieves the extra info of the function as set in
@@ -176,7 +176,7 @@
 
 Returns The extra info
 -}
-foreign import ccall unsafe "duckdb_bind_get_extra_info"
+foreign import ccall safe "duckdb_bind_get_extra_info"
     c_duckdb_bind_get_extra_info :: DuckDBBindInfo -> IO (Ptr ())
 
 {- | Retrieves the client context of the bind info of a table function.
@@ -186,7 +186,7 @@
 * @out_context@: The client context of the bind info. Must be destroyed with
   @duckdb_destroy_client_context@.
 -}
-foreign import ccall unsafe "duckdb_table_function_get_client_context"
+foreign import ccall safe "duckdb_table_function_get_client_context"
     c_duckdb_table_function_get_client_context :: DuckDBBindInfo -> Ptr DuckDBClientContext -> IO ()
 
 {- | Adds a result column to the output of the table function.
@@ -196,7 +196,7 @@
 * @name@: The column name.
 * @type@: The logical column type.
 -}
-foreign import ccall unsafe "duckdb_bind_add_result_column"
+foreign import ccall safe "duckdb_bind_add_result_column"
     c_duckdb_bind_add_result_column :: DuckDBBindInfo -> CString -> DuckDBLogicalType -> IO ()
 
 {- | Retrieves the number of regular (non-named) parameters to the function.
@@ -206,7 +206,7 @@
 
 Returns The number of parameters
 -}
-foreign import ccall unsafe "duckdb_bind_get_parameter_count"
+foreign import ccall safe "duckdb_bind_get_parameter_count"
     c_duckdb_bind_get_parameter_count :: DuckDBBindInfo -> IO DuckDBIdx
 
 {- | Retrieves the parameter at the given index.
@@ -220,7 +220,7 @@
 Returns The value of the parameter. Must be destroyed with
 @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_bind_get_parameter"
+foreign import ccall safe "duckdb_bind_get_parameter"
     c_duckdb_bind_get_parameter :: DuckDBBindInfo -> DuckDBIdx -> IO DuckDBValue
 
 {- | Retrieves a named parameter with the given name.
@@ -234,7 +234,7 @@
 Returns The value of the parameter. Must be destroyed with
 @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_bind_get_named_parameter"
+foreign import ccall safe "duckdb_bind_get_named_parameter"
     c_duckdb_bind_get_named_parameter :: DuckDBBindInfo -> CString -> IO DuckDBValue
 
 {- | Sets the user-provided bind data in the bind object of the table function.
@@ -245,7 +245,7 @@
 * @bind_data@: The bind data object.
 * @destroy@: The callback to destroy the bind data (if any).
 -}
-foreign import ccall unsafe "duckdb_bind_set_bind_data"
+foreign import ccall safe "duckdb_bind_set_bind_data"
     c_duckdb_bind_set_bind_data :: DuckDBBindInfo -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Sets the cardinality estimate for the table function, used for optimization.
@@ -255,7 +255,7 @@
 * @is_exact@: Whether or not the cardinality estimate is exact, or an
   approximation
 -}
-foreign import ccall unsafe "duckdb_bind_set_cardinality"
+foreign import ccall safe "duckdb_bind_set_cardinality"
     c_duckdb_bind_set_cardinality :: DuckDBBindInfo -> DuckDBIdx -> CBool -> IO ()
 
 {- | Report that an error has occurred while calling bind on a table function.
@@ -264,7 +264,7 @@
 * @info@: The info object
 * @error@: The error message
 -}
-foreign import ccall unsafe "duckdb_bind_set_error"
+foreign import ccall safe "duckdb_bind_set_error"
     c_duckdb_bind_set_error :: DuckDBBindInfo -> CString -> IO ()
 
 {- | Retrieves the extra info of the function as set in
@@ -275,7 +275,7 @@
 
 Returns The extra info
 -}
-foreign import ccall unsafe "duckdb_init_get_extra_info"
+foreign import ccall safe "duckdb_init_get_extra_info"
     c_duckdb_init_get_extra_info :: DuckDBInitInfo -> IO (Ptr ())
 
 {- | Gets the bind data set by @duckdb_bind_set_bind_data@ during the bind.
@@ -288,7 +288,7 @@
 
 Returns The bind data object
 -}
-foreign import ccall unsafe "duckdb_init_get_bind_data"
+foreign import ccall safe "duckdb_init_get_bind_data"
     c_duckdb_init_get_bind_data :: DuckDBInitInfo -> IO (Ptr ())
 
 {- | Sets the user-provided init data in the init object. This object can be
@@ -300,7 +300,7 @@
 * @destroy@: The callback that will be called to destroy the init data (if
   any)
 -}
-foreign import ccall unsafe "duckdb_init_set_init_data"
+foreign import ccall safe "duckdb_init_set_init_data"
     c_duckdb_init_set_init_data :: DuckDBInitInfo -> Ptr () -> DuckDBDeleteCallback -> IO ()
 
 {- | Returns the number of projected columns.
@@ -313,7 +313,7 @@
 
 Returns The number of projected columns.
 -}
-foreign import ccall unsafe "duckdb_init_get_column_count"
+foreign import ccall safe "duckdb_init_get_column_count"
     c_duckdb_init_get_column_count :: DuckDBInitInfo -> IO DuckDBIdx
 
 {- | Returns the column index of the projected column at the specified position.
@@ -328,7 +328,7 @@
 
 Returns The column index of the projected column.
 -}
-foreign import ccall unsafe "duckdb_init_get_column_index"
+foreign import ccall safe "duckdb_init_get_column_index"
     c_duckdb_init_get_column_index :: DuckDBInitInfo -> DuckDBIdx -> IO DuckDBIdx
 
 {- | Sets how many threads can process this table function in parallel (default: 1)
@@ -338,7 +338,7 @@
 * @max_threads@: The maximum amount of threads that can process this table
   function
 -}
-foreign import ccall unsafe "duckdb_init_set_max_threads"
+foreign import ccall safe "duckdb_init_set_max_threads"
     c_duckdb_init_set_max_threads :: DuckDBInitInfo -> DuckDBIdx -> IO ()
 
 {- | Report that an error has occurred while calling init.
@@ -347,7 +347,7 @@
 * @info@: The info object
 * @error@: The error message
 -}
-foreign import ccall unsafe "duckdb_init_set_error"
+foreign import ccall safe "duckdb_init_set_error"
     c_duckdb_init_set_error :: DuckDBInitInfo -> CString -> IO ()
 
 {- | Retrieves the extra info of the function as set in
@@ -358,7 +358,7 @@
 
 Returns The extra info
 -}
-foreign import ccall unsafe "duckdb_function_get_extra_info"
+foreign import ccall safe "duckdb_function_get_extra_info"
     c_duckdb_function_get_extra_info :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Gets the table function's bind data set by @duckdb_bind_set_bind_data@.
@@ -371,7 +371,7 @@
 
 Returns The bind data object.
 -}
-foreign import ccall unsafe "duckdb_function_get_bind_data"
+foreign import ccall safe "duckdb_function_get_bind_data"
     c_duckdb_function_get_bind_data :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Gets the init data set by @duckdb_init_set_init_data@ during the init.
@@ -381,7 +381,7 @@
 
 Returns The init data object
 -}
-foreign import ccall unsafe "duckdb_function_get_init_data"
+foreign import ccall safe "duckdb_function_get_init_data"
     c_duckdb_function_get_init_data :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Gets the thread-local init data set by @duckdb_init_set_init_data@ during the
@@ -392,7 +392,7 @@
 
 Returns The init data object
 -}
-foreign import ccall unsafe "duckdb_function_get_local_init_data"
+foreign import ccall safe "duckdb_function_get_local_init_data"
     c_duckdb_function_get_local_init_data :: DuckDBFunctionInfo -> IO (Ptr ())
 
 {- | Report that an error has occurred while executing the function.
@@ -401,5 +401,5 @@
 * @info@: The info object
 * @error@: The error message
 -}
-foreign import ccall unsafe "duckdb_function_set_error"
+foreign import ccall safe "duckdb_function_set_error"
     c_duckdb_function_set_error :: DuckDBFunctionInfo -> CString -> IO ()
diff --git a/src/Database/DuckDB/FFI/Threading.hs b/src/Database/DuckDB/FFI/Threading.hs
--- a/src/Database/DuckDB/FFI/Threading.hs
+++ b/src/Database/DuckDB/FFI/Threading.hs
@@ -21,7 +21,7 @@
 * @database@: The database object to execute tasks for
 * @max_tasks@: The maximum amount of tasks to execute
 -}
-foreign import ccall safe "duckdb_execute_tasks"
+foreign import ccall "duckdb_execute_tasks"
     c_duckdb_execute_tasks :: DuckDBDatabase -> DuckDBIdx -> IO ()
 
 {- | Creates a task state that can be used with duckdb_execute_tasks_state to
@@ -34,7 +34,7 @@
 
 Returns The task state that can be used with duckdb_execute_tasks_state.
 -}
-foreign import ccall unsafe "duckdb_create_task_state"
+foreign import ccall safe "duckdb_create_task_state"
     c_duckdb_create_task_state :: DuckDBDatabase -> IO DuckDBTaskState
 
 {- | Execute DuckDB tasks on this thread.
@@ -45,7 +45,7 @@
 Parameters:
 * @state@: The task state of the executor
 -}
-foreign import ccall safe "duckdb_execute_tasks_state"
+foreign import ccall "duckdb_execute_tasks_state"
     c_duckdb_execute_tasks_state :: DuckDBTaskState -> IO ()
 
 {- | Execute DuckDB tasks on this thread.
@@ -62,7 +62,7 @@
 
 Returns The amount of tasks that have actually been executed
 -}
-foreign import ccall safe "duckdb_execute_n_tasks_state"
+foreign import ccall "duckdb_execute_n_tasks_state"
     c_duckdb_execute_n_tasks_state :: DuckDBTaskState -> DuckDBIdx -> IO DuckDBIdx
 
 {- | Finish execution on a specific task.
@@ -70,7 +70,7 @@
 Parameters:
 * @state@: The task state to finish execution
 -}
-foreign import ccall unsafe "duckdb_finish_execution"
+foreign import ccall safe "duckdb_finish_execution"
     c_duckdb_finish_execution :: DuckDBTaskState -> IO ()
 
 {- | Check if the provided duckdb_task_state has finished execution
@@ -81,7 +81,7 @@
 Returns Whether or not duckdb_finish_execution has been called on the task
 state
 -}
-foreign import ccall unsafe "duckdb_task_state_is_finished"
+foreign import ccall safe "duckdb_task_state_is_finished"
     c_duckdb_task_state_is_finished :: DuckDBTaskState -> IO CBool
 
 {- | Destroys the task state returned from duckdb_create_task_state.
@@ -92,7 +92,7 @@
 Parameters:
 * @state@: The task state to clean up
 -}
-foreign import ccall unsafe "duckdb_destroy_task_state"
+foreign import ccall safe "duckdb_destroy_task_state"
     c_duckdb_destroy_task_state :: DuckDBTaskState -> IO ()
 
 {- | Returns true if the execution of the current query is finished.
@@ -100,5 +100,5 @@
 Parameters:
 * @con@: The connection on which to check
 -}
-foreign import ccall unsafe "duckdb_execution_is_finished"
+foreign import ccall safe "duckdb_execution_is_finished"
     c_duckdb_execution_is_finished :: DuckDBConnection -> IO CBool
diff --git a/src/Database/DuckDB/FFI/Validity.hs b/src/Database/DuckDB/FFI/Validity.hs
--- a/src/Database/DuckDB/FFI/Validity.hs
+++ b/src/Database/DuckDB/FFI/Validity.hs
@@ -20,7 +20,7 @@
 
 Returns true if the row is valid, false otherwise
 -}
-foreign import ccall unsafe "duckdb_validity_row_is_valid"
+foreign import ccall safe "duckdb_validity_row_is_valid"
     c_duckdb_validity_row_is_valid :: Ptr Word64 -> DuckDBIdx -> IO CBool
 
 {- | In a validity mask, sets a specific row to either valid or invalid.
@@ -35,7 +35,7 @@
 * @row@: The row index
 * @valid@: Whether or not to set the row to valid, or invalid
 -}
-foreign import ccall unsafe "duckdb_validity_set_row_validity"
+foreign import ccall safe "duckdb_validity_set_row_validity"
     c_duckdb_validity_set_row_validity :: Ptr Word64 -> DuckDBIdx -> CBool -> IO ()
 
 {- | In a validity mask, sets a specific row to invalid.
@@ -46,7 +46,7 @@
 * @validity@: The validity mask
 * @row@: The row index
 -}
-foreign import ccall unsafe "duckdb_validity_set_row_invalid"
+foreign import ccall safe "duckdb_validity_set_row_invalid"
     c_duckdb_validity_set_row_invalid :: Ptr Word64 -> DuckDBIdx -> IO ()
 
 {- | In a validity mask, sets a specific row to valid.
@@ -57,5 +57,5 @@
 * @validity@: The validity mask
 * @row@: The row index
 -}
-foreign import ccall unsafe "duckdb_validity_set_row_valid"
+foreign import ccall safe "duckdb_validity_set_row_valid"
     c_duckdb_validity_set_row_valid :: Ptr Word64 -> DuckDBIdx -> IO ()
diff --git a/src/Database/DuckDB/FFI/ValueInterface.hs b/src/Database/DuckDB/FFI/ValueInterface.hs
--- a/src/Database/DuckDB/FFI/ValueInterface.hs
+++ b/src/Database/DuckDB/FFI/ValueInterface.hs
@@ -90,7 +90,7 @@
 Parameters:
 * @value@: The value to destroy.
 -}
-foreign import ccall unsafe "duckdb_destroy_value"
+foreign import ccall safe "duckdb_destroy_value"
     c_duckdb_destroy_value :: Ptr DuckDBValue -> IO ()
 
 {- | Creates a value from a null-terminated string
@@ -100,7 +100,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_varchar"
+foreign import ccall safe "duckdb_create_varchar"
     c_duckdb_create_varchar :: CString -> IO DuckDBValue
 
 {- | Creates a value from a string
@@ -111,7 +111,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_varchar_length"
+foreign import ccall safe "duckdb_create_varchar_length"
     c_duckdb_create_varchar_length :: CString -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates a value from a boolean
@@ -121,7 +121,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_bool"
+foreign import ccall safe "duckdb_create_bool"
     c_duckdb_create_bool :: CBool -> IO DuckDBValue
 
 {- | Creates a value from an int8_t (a tinyint)
@@ -131,7 +131,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_int8"
+foreign import ccall safe "duckdb_create_int8"
     c_duckdb_create_int8 :: Int8 -> IO DuckDBValue
 
 {- | Creates a value from a uint8_t (a utinyint)
@@ -141,7 +141,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_uint8"
+foreign import ccall safe "duckdb_create_uint8"
     c_duckdb_create_uint8 :: Word8 -> IO DuckDBValue
 
 {- | Creates a value from an int16_t (a smallint)
@@ -151,7 +151,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_int16"
+foreign import ccall safe "duckdb_create_int16"
     c_duckdb_create_int16 :: Int16 -> IO DuckDBValue
 
 {- | Creates a value from a uint16_t (a usmallint)
@@ -161,7 +161,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_uint16"
+foreign import ccall safe "duckdb_create_uint16"
     c_duckdb_create_uint16 :: Word16 -> IO DuckDBValue
 
 {- | Creates a value from an int32_t (an integer)
@@ -171,7 +171,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_int32"
+foreign import ccall safe "duckdb_create_int32"
     c_duckdb_create_int32 :: Int32 -> IO DuckDBValue
 
 {- | Creates a value from a uint32_t (a uinteger)
@@ -181,7 +181,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_uint32"
+foreign import ccall safe "duckdb_create_uint32"
     c_duckdb_create_uint32 :: Word32 -> IO DuckDBValue
 
 {- | Creates a value from a uint64_t (a ubigint)
@@ -191,14 +191,14 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_uint64"
+foreign import ccall safe "duckdb_create_uint64"
     c_duckdb_create_uint64 :: Word64 -> IO DuckDBValue
 
 {- | Creates a value from an int64
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_int64"
+foreign import ccall safe "duckdb_create_int64"
     c_duckdb_create_int64 :: Int64 -> IO DuckDBValue
 
 {- | Creates a value from a hugeint
@@ -211,7 +211,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_hugeint@
 but mirror the DuckDB C API semantics of @duckdb_create_hugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_hugeint"
+foreign import ccall safe "wrapped_duckdb_create_hugeint"
     c_duckdb_create_hugeint :: Ptr DuckDBHugeInt -> IO DuckDBValue
 
 {- | Creates a value from a uhugeint
@@ -224,7 +224,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_uhugeint@
 but mirror the DuckDB C API semantics of @duckdb_create_uhugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_uhugeint"
+foreign import ccall safe "wrapped_duckdb_create_uhugeint"
     c_duckdb_create_uhugeint :: Ptr DuckDBUHugeInt -> IO DuckDBValue
 
 {- | Creates a BIGNUM value from a duckdb_bignum
@@ -237,7 +237,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_bignum@
 but mirror the DuckDB C API semantics of @duckdb_create_bignum@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_bignum"
+foreign import ccall safe "wrapped_duckdb_create_bignum"
     c_duckdb_create_bignum :: Ptr DuckDBBignum -> IO DuckDBValue
 
 {- | Creates a DECIMAL value from a duckdb_decimal
@@ -250,7 +250,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_decimal@
 but mirror the DuckDB C API semantics of @duckdb_create_decimal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_decimal"
+foreign import ccall safe "wrapped_duckdb_create_decimal"
     c_duckdb_create_decimal :: Ptr DuckDBDecimal -> IO DuckDBValue
 
 {- | Creates a value from a float
@@ -260,7 +260,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_float"
+foreign import ccall safe "duckdb_create_float"
     c_duckdb_create_float :: CFloat -> IO DuckDBValue
 
 {- | Creates a value from a double
@@ -270,7 +270,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_double"
+foreign import ccall safe "duckdb_create_double"
     c_duckdb_create_double :: CDouble -> IO DuckDBValue
 
 {- | Creates a value from a date
@@ -280,7 +280,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_date"
+foreign import ccall safe "duckdb_create_date"
     c_duckdb_create_date :: DuckDBDate -> IO DuckDBValue
 
 {- | Creates a value from a time
@@ -290,7 +290,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_time"
+foreign import ccall safe "duckdb_create_time"
     c_duckdb_create_time :: DuckDBTime -> IO DuckDBValue
 
 {- | Creates a value from a time_ns
@@ -300,7 +300,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_time_ns"
+foreign import ccall safe "duckdb_create_time_ns"
     c_duckdb_create_time_ns :: DuckDBTimeNs -> IO DuckDBValue
 
 {- | Creates a value from a time_tz. Not to be confused with
@@ -311,7 +311,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_time_tz_value"
+foreign import ccall safe "duckdb_create_time_tz_value"
     c_duckdb_create_time_tz_value :: DuckDBTimeTz -> IO DuckDBValue
 
 {- | Creates a TIMESTAMP value from a duckdb_timestamp
@@ -321,7 +321,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_timestamp"
+foreign import ccall safe "duckdb_create_timestamp"
     c_duckdb_create_timestamp :: DuckDBTimestamp -> IO DuckDBValue
 
 {- | Creates a TIMESTAMP_TZ value from a duckdb_timestamp
@@ -331,7 +331,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_timestamp_tz"
+foreign import ccall safe "duckdb_create_timestamp_tz"
     c_duckdb_create_timestamp_tz :: DuckDBTimestamp -> IO DuckDBValue
 
 {- | Creates a TIMESTAMP_S value from a duckdb_timestamp_s
@@ -341,7 +341,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_timestamp_s"
+foreign import ccall safe "duckdb_create_timestamp_s"
     c_duckdb_create_timestamp_s :: DuckDBTimestampS -> IO DuckDBValue
 
 {- | Creates a TIMESTAMP_MS value from a duckdb_timestamp_ms
@@ -351,7 +351,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_timestamp_ms"
+foreign import ccall safe "duckdb_create_timestamp_ms"
     c_duckdb_create_timestamp_ms :: DuckDBTimestampMs -> IO DuckDBValue
 
 {- | Creates a TIMESTAMP_NS value from a duckdb_timestamp_ns
@@ -361,7 +361,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_timestamp_ns"
+foreign import ccall safe "duckdb_create_timestamp_ns"
     c_duckdb_create_timestamp_ns :: DuckDBTimestampNs -> IO DuckDBValue
 
 {- | Creates a value from an interval
@@ -374,7 +374,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_interval@
 but mirror the DuckDB C API semantics of @duckdb_create_interval@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_interval"
+foreign import ccall safe "wrapped_duckdb_create_interval"
     c_duckdb_create_interval :: Ptr DuckDBInterval -> IO DuckDBValue
 
 {- | Creates a value from a blob
@@ -385,7 +385,7 @@
 
 Returns The value. This must be destroyed with @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_blob"
+foreign import ccall safe "duckdb_create_blob"
     c_duckdb_create_blob :: Ptr Word8 -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates a BIT value from a duckdb_bit
@@ -398,7 +398,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_bit@ but
 mirror the DuckDB C API semantics of @duckdb_create_bit@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_bit"
+foreign import ccall safe "wrapped_duckdb_create_bit"
     c_duckdb_create_bit :: Ptr DuckDBBit -> IO DuckDBValue
 
 {- | Creates a UUID value from a uhugeint
@@ -411,7 +411,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_create_uuid@ but
 mirror the DuckDB C API semantics of @duckdb_create_uuid@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_create_uuid"
+foreign import ccall safe "wrapped_duckdb_create_uuid"
     c_duckdb_create_uuid :: Ptr DuckDBUHugeInt -> IO DuckDBValue
 
 {- | Returns the boolean value of the given value.
@@ -421,7 +421,7 @@
 
 Returns A boolean, or false if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_bool"
+foreign import ccall safe "duckdb_get_bool"
     c_duckdb_get_bool :: DuckDBValue -> IO CBool
 
 {- | Returns the int8_t value of the given value.
@@ -431,7 +431,7 @@
 
 Returns A int8_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_int8"
+foreign import ccall safe "duckdb_get_int8"
     c_duckdb_get_int8 :: DuckDBValue -> IO Int8
 
 {- | Returns the uint8_t value of the given value.
@@ -441,7 +441,7 @@
 
 Returns A uint8_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_uint8"
+foreign import ccall safe "duckdb_get_uint8"
     c_duckdb_get_uint8 :: DuckDBValue -> IO Word8
 
 {- | Returns the int16_t value of the given value.
@@ -451,7 +451,7 @@
 
 Returns A int16_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_int16"
+foreign import ccall safe "duckdb_get_int16"
     c_duckdb_get_int16 :: DuckDBValue -> IO Int16
 
 {- | Returns the uint16_t value of the given value.
@@ -461,7 +461,7 @@
 
 Returns A uint16_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_uint16"
+foreign import ccall safe "duckdb_get_uint16"
     c_duckdb_get_uint16 :: DuckDBValue -> IO Word16
 
 {- | Returns the int32_t value of the given value.
@@ -471,7 +471,7 @@
 
 Returns A int32_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_int32"
+foreign import ccall safe "duckdb_get_int32"
     c_duckdb_get_int32 :: DuckDBValue -> IO Int32
 
 {- | Returns the uint32_t value of the given value.
@@ -481,7 +481,7 @@
 
 Returns A uint32_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_uint32"
+foreign import ccall safe "duckdb_get_uint32"
     c_duckdb_get_uint32 :: DuckDBValue -> IO Word32
 
 {- | Returns the int64_t value of the given value.
@@ -491,7 +491,7 @@
 
 Returns A int64_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_int64"
+foreign import ccall safe "duckdb_get_int64"
     c_duckdb_get_int64 :: DuckDBValue -> IO Int64
 
 {- | Returns the uint64_t value of the given value.
@@ -501,7 +501,7 @@
 
 Returns A uint64_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_uint64"
+foreign import ccall safe "duckdb_get_uint64"
     c_duckdb_get_uint64 :: DuckDBValue -> IO Word64
 
 {- | Returns the hugeint value of the given value.
@@ -514,7 +514,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_hugeint@ but
 mirror the DuckDB C API semantics of @duckdb_get_hugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_hugeint"
+foreign import ccall safe "wrapped_duckdb_get_hugeint"
     c_duckdb_get_hugeint :: DuckDBValue -> Ptr DuckDBHugeInt -> IO ()
 
 {- | Returns the uhugeint value of the given value.
@@ -527,7 +527,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_uhugeint@
 but mirror the DuckDB C API semantics of @duckdb_get_uhugeint@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_uhugeint"
+foreign import ccall safe "wrapped_duckdb_get_uhugeint"
     c_duckdb_get_uhugeint :: DuckDBValue -> Ptr DuckDBUHugeInt -> IO ()
 
 {- | Returns the duckdb_bignum value of the given value. The @data@ field must be
@@ -542,7 +542,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_bignum@ but
 mirror the DuckDB C API semantics of @duckdb_get_bignum@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_bignum"
+foreign import ccall safe "wrapped_duckdb_get_bignum"
     c_duckdb_get_bignum :: DuckDBValue -> Ptr DuckDBBignum -> IO ()
 
 {- | Returns the duckdb_decimal value of the given value.
@@ -555,7 +555,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_decimal@ but
 mirror the DuckDB C API semantics of @duckdb_get_decimal@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_decimal"
+foreign import ccall safe "wrapped_duckdb_get_decimal"
     c_duckdb_get_decimal :: DuckDBValue -> Ptr DuckDBDecimal -> IO ()
 
 {- | Returns the float value of the given value.
@@ -565,7 +565,7 @@
 
 Returns A float, or NAN if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_float"
+foreign import ccall safe "duckdb_get_float"
     c_duckdb_get_float :: DuckDBValue -> IO CFloat
 
 {- | Returns the double value of the given value.
@@ -575,7 +575,7 @@
 
 Returns A double, or NAN if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_double"
+foreign import ccall safe "duckdb_get_double"
     c_duckdb_get_double :: DuckDBValue -> IO CDouble
 
 {- | Returns the date value of the given value.
@@ -585,7 +585,7 @@
 
 Returns A duckdb_date, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_date"
+foreign import ccall safe "duckdb_get_date"
     c_duckdb_get_date :: DuckDBValue -> IO DuckDBDate
 
 {- | Returns the time value of the given value.
@@ -595,7 +595,7 @@
 
 Returns A duckdb_time, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_time"
+foreign import ccall safe "duckdb_get_time"
     c_duckdb_get_time :: DuckDBValue -> IO DuckDBTime
 
 {- | Returns the time_ns value of the given value.
@@ -605,7 +605,7 @@
 
 Returns A duckdb_time_ns, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_time_ns"
+foreign import ccall safe "duckdb_get_time_ns"
     c_duckdb_get_time_ns :: DuckDBValue -> IO DuckDBTimeNs
 
 {- | Returns the time_tz value of the given value.
@@ -615,7 +615,7 @@
 
 Returns A duckdb_time_tz, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_time_tz"
+foreign import ccall safe "duckdb_get_time_tz"
     c_duckdb_get_time_tz :: DuckDBValue -> IO DuckDBTimeTz
 
 {- | Returns the TIMESTAMP value of the given value.
@@ -625,7 +625,7 @@
 
 Returns A duckdb_timestamp, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_timestamp"
+foreign import ccall safe "duckdb_get_timestamp"
     c_duckdb_get_timestamp :: DuckDBValue -> IO DuckDBTimestamp
 
 {- | Returns the TIMESTAMP_TZ value of the given value.
@@ -635,7 +635,7 @@
 
 Returns A duckdb_timestamp, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_timestamp_tz"
+foreign import ccall safe "duckdb_get_timestamp_tz"
     c_duckdb_get_timestamp_tz :: DuckDBValue -> IO DuckDBTimestamp
 
 {- | Returns the duckdb_timestamp_s value of the given value.
@@ -645,7 +645,7 @@
 
 Returns A duckdb_timestamp_s, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_timestamp_s"
+foreign import ccall safe "duckdb_get_timestamp_s"
     c_duckdb_get_timestamp_s :: DuckDBValue -> IO DuckDBTimestampS
 
 {- | Returns the duckdb_timestamp_ms value of the given value.
@@ -655,7 +655,7 @@
 
 Returns A duckdb_timestamp_ms, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_timestamp_ms"
+foreign import ccall safe "duckdb_get_timestamp_ms"
     c_duckdb_get_timestamp_ms :: DuckDBValue -> IO DuckDBTimestampMs
 
 {- | Returns the duckdb_timestamp_ns value of the given value.
@@ -665,7 +665,7 @@
 
 Returns A duckdb_timestamp_ns, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_timestamp_ns"
+foreign import ccall safe "duckdb_get_timestamp_ns"
     c_duckdb_get_timestamp_ns :: DuckDBValue -> IO DuckDBTimestampNs
 
 {- | Returns the interval value of the given value.
@@ -678,7 +678,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_interval@
 but mirror the DuckDB C API semantics of @duckdb_get_interval@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_interval"
+foreign import ccall safe "wrapped_duckdb_get_interval"
     c_duckdb_get_interval :: DuckDBValue -> Ptr DuckDBInterval -> IO ()
 
 {- | Returns the type of the given value. The type is valid as long as the value is
@@ -689,7 +689,7 @@
 
 Returns A duckdb_logical_type.
 -}
-foreign import ccall unsafe "duckdb_get_value_type"
+foreign import ccall safe "duckdb_get_value_type"
     c_duckdb_get_value_type :: DuckDBValue -> IO DuckDBLogicalType
 
 {- | Returns the blob value of the given value.
@@ -702,7 +702,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_blob@ but
 mirror the DuckDB C API semantics of @duckdb_get_blob@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_blob"
+foreign import ccall safe "wrapped_duckdb_get_blob"
     c_duckdb_get_blob :: DuckDBValue -> Ptr DuckDBBlob -> IO ()
 
 {- | Returns the duckdb_bit value of the given value. The @data@ field must be
@@ -716,7 +716,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_bit@ but
 mirror the DuckDB C API semantics of @duckdb_get_bit@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_bit"
+foreign import ccall safe "wrapped_duckdb_get_bit"
     c_duckdb_get_bit :: DuckDBValue -> Ptr DuckDBBit -> IO ()
 
 {- | Returns a duckdb_uhugeint representing the UUID value of the given value.
@@ -729,7 +729,7 @@
 These bindings call the wrapper symbol @wrapped_duckdb_get_uuid@ but
 mirror the DuckDB C API semantics of @duckdb_get_uuid@.
 -}
-foreign import ccall unsafe "wrapped_duckdb_get_uuid"
+foreign import ccall safe "wrapped_duckdb_get_uuid"
     c_duckdb_get_uuid :: DuckDBValue -> Ptr DuckDBUHugeInt -> IO ()
 
 {- | Obtains a string representation of the given value. The result must be
@@ -740,7 +740,7 @@
 
 Returns The string value. This must be destroyed with @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_get_varchar"
+foreign import ccall safe "duckdb_get_varchar"
     c_duckdb_get_varchar :: DuckDBValue -> IO CString
 
 {- | Creates a struct value from a type and an array of values. Must be destroyed
@@ -753,7 +753,7 @@
 Returns The struct value, or nullptr, if any child type is @DUCKDB_TYPE_ANY@
 or @DUCKDB_TYPE_INVALID@.
 -}
-foreign import ccall unsafe "duckdb_create_struct_value"
+foreign import ccall safe "duckdb_create_struct_value"
     c_duckdb_create_struct_value :: DuckDBLogicalType -> Ptr DuckDBValue -> IO DuckDBValue
 
 {- | Creates a list value from a child (element) type and an array of values of
@@ -767,7 +767,7 @@
 Returns The list value, or nullptr, if the child type is @DUCKDB_TYPE_ANY@ or
 @DUCKDB_TYPE_INVALID@.
 -}
-foreign import ccall unsafe "duckdb_create_list_value"
+foreign import ccall safe "duckdb_create_list_value"
     c_duckdb_create_list_value :: DuckDBLogicalType -> Ptr DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates an array value from a child (element) type and an array of values of
@@ -781,7 +781,7 @@
 Returns The array value, or nullptr, if the child type is @DUCKDB_TYPE_ANY@ or
 @DUCKDB_TYPE_INVALID@.
 -}
-foreign import ccall unsafe "duckdb_create_array_value"
+foreign import ccall safe "duckdb_create_array_value"
     c_duckdb_create_array_value :: DuckDBLogicalType -> Ptr DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates a map value from a map type and two arrays, one for the keys and one
@@ -796,7 +796,7 @@
 
 Returns The map value, or nullptr, if the parameters are invalid.
 -}
-foreign import ccall unsafe "duckdb_create_map_value"
+foreign import ccall safe "duckdb_create_map_value"
     c_duckdb_create_map_value :: DuckDBLogicalType -> Ptr DuckDBValue -> Ptr DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates a union value from a union type, a tag index, and a value. Must be
@@ -809,7 +809,7 @@
 
 Returns The union value, or nullptr, if the parameters are invalid.
 -}
-foreign import ccall unsafe "duckdb_create_union_value"
+foreign import ccall safe "duckdb_create_union_value"
     c_duckdb_create_union_value :: DuckDBLogicalType -> DuckDBIdx -> DuckDBValue -> IO DuckDBValue
 
 {- | Returns the number of elements in a MAP value.
@@ -819,7 +819,7 @@
 
 Returns The number of elements in the map.
 -}
-foreign import ccall unsafe "duckdb_get_map_size"
+foreign import ccall safe "duckdb_get_map_size"
     c_duckdb_get_map_size :: DuckDBValue -> IO DuckDBIdx
 
 {- | Returns the MAP key at index as a duckdb_value.
@@ -830,7 +830,7 @@
 
 Returns The key as a duckdb_value.
 -}
-foreign import ccall unsafe "duckdb_get_map_key"
+foreign import ccall safe "duckdb_get_map_key"
     c_duckdb_get_map_key :: DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Returns the MAP value at index as a duckdb_value.
@@ -841,7 +841,7 @@
 
 Returns The value as a duckdb_value.
 -}
-foreign import ccall unsafe "duckdb_get_map_value"
+foreign import ccall safe "duckdb_get_map_value"
     c_duckdb_get_map_value :: DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Returns whether the value's type is SQLNULL or not.
@@ -851,7 +851,7 @@
 
 Returns True, if the value's type is SQLNULL, otherwise false.
 -}
-foreign import ccall unsafe "duckdb_is_null_value"
+foreign import ccall safe "duckdb_is_null_value"
     c_duckdb_is_null_value :: DuckDBValue -> IO CBool
 
 {- | Creates a value of type SQLNULL.
@@ -859,7 +859,7 @@
 Returns The duckdb_value representing SQLNULL. This must be destroyed with
 @duckdb_destroy_value@.
 -}
-foreign import ccall unsafe "duckdb_create_null_value"
+foreign import ccall safe "duckdb_create_null_value"
     c_duckdb_create_null_value :: IO DuckDBValue
 
 {- | Returns the number of elements in a LIST value.
@@ -869,7 +869,7 @@
 
 Returns The number of elements in the list.
 -}
-foreign import ccall unsafe "duckdb_get_list_size"
+foreign import ccall safe "duckdb_get_list_size"
     c_duckdb_get_list_size :: DuckDBValue -> IO DuckDBIdx
 
 {- | Returns the LIST child at index as a duckdb_value.
@@ -880,7 +880,7 @@
 
 Returns The child as a duckdb_value.
 -}
-foreign import ccall unsafe "duckdb_get_list_child"
+foreign import ccall safe "duckdb_get_list_child"
     c_duckdb_get_list_child :: DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Creates an enum value from a type and a value. Must be destroyed with
@@ -892,7 +892,7 @@
 
 Returns The enum value, or nullptr.
 -}
-foreign import ccall unsafe "duckdb_create_enum_value"
+foreign import ccall safe "duckdb_create_enum_value"
     c_duckdb_create_enum_value :: DuckDBLogicalType -> Word64 -> IO DuckDBValue
 
 {- | Returns the enum value of the given value.
@@ -902,7 +902,7 @@
 
 Returns A uint64_t, or MinValue if the value cannot be converted
 -}
-foreign import ccall unsafe "duckdb_get_enum_value"
+foreign import ccall safe "duckdb_get_enum_value"
     c_duckdb_get_enum_value :: DuckDBValue -> IO Word64
 
 {- | Returns the STRUCT child at index as a duckdb_value.
@@ -913,7 +913,7 @@
 
 Returns The child as a duckdb_value.
 -}
-foreign import ccall unsafe "duckdb_get_struct_child"
+foreign import ccall safe "duckdb_get_struct_child"
     c_duckdb_get_struct_child :: DuckDBValue -> DuckDBIdx -> IO DuckDBValue
 
 {- | Returns the SQL string representation of the given value.
@@ -924,5 +924,5 @@
 Returns The SQL string representation as a null-terminated string. The result
 must be freed with @duckdb_free@.
 -}
-foreign import ccall unsafe "duckdb_value_to_string"
+foreign import ccall safe "duckdb_value_to_string"
     c_duckdb_value_to_string :: DuckDBValue -> IO CString
diff --git a/src/Database/DuckDB/FFI/Vector.hs b/src/Database/DuckDB/FFI/Vector.hs
--- a/src/Database/DuckDB/FFI/Vector.hs
+++ b/src/Database/DuckDB/FFI/Vector.hs
@@ -33,7 +33,7 @@
 
 Returns The vector.
 -}
-foreign import ccall unsafe "duckdb_create_vector"
+foreign import ccall safe "duckdb_create_vector"
     c_duckdb_create_vector :: DuckDBLogicalType -> DuckDBIdx -> IO DuckDBVector
 
 {- | Destroys the vector and de-allocates its memory.
@@ -41,7 +41,7 @@
 Parameters:
 * @vector@: A pointer to the vector.
 -}
-foreign import ccall unsafe "duckdb_destroy_vector"
+foreign import ccall safe "duckdb_destroy_vector"
     c_duckdb_destroy_vector :: Ptr DuckDBVector -> IO ()
 
 {- | Retrieves the column type of the specified vector.
@@ -53,7 +53,7 @@
 
 Returns The type of the vector
 -}
-foreign import ccall unsafe "duckdb_vector_get_column_type"
+foreign import ccall safe "duckdb_vector_get_column_type"
     c_duckdb_vector_get_column_type :: DuckDBVector -> IO DuckDBLogicalType
 
 {- | Retrieves the data pointer of the vector.
@@ -66,7 +66,7 @@
 
 Returns The data pointer
 -}
-foreign import ccall unsafe "duckdb_vector_get_data"
+foreign import ccall safe "duckdb_vector_get_data"
     c_duckdb_vector_get_data :: DuckDBVector -> IO (Ptr ())
 
 {- | Retrieves the validity mask pointer of the specified vector.
@@ -91,7 +91,7 @@
 Returns The pointer to the validity mask, or NULL if no validity mask is
 present
 -}
-foreign import ccall unsafe "duckdb_vector_get_validity"
+foreign import ccall safe "duckdb_vector_get_validity"
     c_duckdb_vector_get_validity :: DuckDBVector -> IO (Ptr Word64)
 
 {- | Ensures the validity mask is writable by allocating it.
@@ -103,7 +103,7 @@
 Parameters:
 * @vector@: The vector to alter
 -}
-foreign import ccall unsafe "duckdb_vector_ensure_validity_writable"
+foreign import ccall safe "duckdb_vector_ensure_validity_writable"
     c_duckdb_vector_ensure_validity_writable :: DuckDBVector -> IO ()
 
 {- | Assigns a string element in the vector at the specified location.
@@ -113,7 +113,7 @@
 * @index@: The row position in the vector to assign the string to
 * @str@: The null-terminated string
 -}
-foreign import ccall unsafe "duckdb_vector_assign_string_element"
+foreign import ccall safe "duckdb_vector_assign_string_element"
     c_duckdb_vector_assign_string_element :: DuckDBVector -> DuckDBIdx -> CString -> IO ()
 
 {- | Assigns a string element in the vector at the specified location. You may also
@@ -125,7 +125,7 @@
 * @str@: The string
 * @str_len@: The length of the string (in bytes)
 -}
-foreign import ccall unsafe "duckdb_vector_assign_string_element_len"
+foreign import ccall safe "duckdb_vector_assign_string_element_len"
     c_duckdb_vector_assign_string_element_len :: DuckDBVector -> DuckDBIdx -> CString -> DuckDBIdx -> IO ()
 
 {- | Retrieves the child vector of a list vector.
@@ -137,7 +137,7 @@
 
 Returns The child vector
 -}
-foreign import ccall unsafe "duckdb_list_vector_get_child"
+foreign import ccall safe "duckdb_list_vector_get_child"
     c_duckdb_list_vector_get_child :: DuckDBVector -> IO DuckDBVector
 
 {- | Returns the size of the child vector of the list.
@@ -147,7 +147,7 @@
 
 Returns The size of the child list
 -}
-foreign import ccall unsafe "duckdb_list_vector_get_size"
+foreign import ccall safe "duckdb_list_vector_get_size"
     c_duckdb_list_vector_get_size :: DuckDBVector -> IO DuckDBIdx
 
 {- | Sets the total size of the underlying child-vector of a list vector.
@@ -158,7 +158,7 @@
 
 Returns The duckdb state. Returns DuckDBError if the vector is nullptr.
 -}
-foreign import ccall unsafe "duckdb_list_vector_set_size"
+foreign import ccall safe "duckdb_list_vector_set_size"
     c_duckdb_list_vector_set_size :: DuckDBVector -> DuckDBIdx -> IO DuckDBState
 
 {- | Sets the total capacity of the underlying child-vector of a list.
@@ -172,7 +172,7 @@
 
 Returns The duckdb state. Returns DuckDBError if the vector is nullptr.
 -}
-foreign import ccall unsafe "duckdb_list_vector_reserve"
+foreign import ccall safe "duckdb_list_vector_reserve"
     c_duckdb_list_vector_reserve :: DuckDBVector -> DuckDBIdx -> IO DuckDBState
 
 {- | Retrieves the child vector of a struct vector. The resulting vector is valid
@@ -184,7 +184,7 @@
 
 Returns The child vector
 -}
-foreign import ccall unsafe "duckdb_struct_vector_get_child"
+foreign import ccall safe "duckdb_struct_vector_get_child"
     c_duckdb_struct_vector_get_child :: DuckDBVector -> DuckDBIdx -> IO DuckDBVector
 
 {- | Retrieves the child vector of an array vector. The resulting vector is valid
@@ -196,7 +196,7 @@
 
 Returns The child vector
 -}
-foreign import ccall unsafe "duckdb_array_vector_get_child"
+foreign import ccall safe "duckdb_array_vector_get_child"
     c_duckdb_array_vector_get_child :: DuckDBVector -> IO DuckDBVector
 
 {- | Slice a vector with a selection vector. The length of the selection vector
@@ -208,7 +208,7 @@
 * @sel@: The selection vector.
 * @len@: The length of the selection vector.
 -}
-foreign import ccall unsafe "duckdb_slice_vector"
+foreign import ccall safe "duckdb_slice_vector"
     c_duckdb_slice_vector :: DuckDBVector -> DuckDBSelectionVector -> DuckDBIdx -> IO ()
 
 {- | Copy the src vector to the dst with a selection vector that identifies which
@@ -225,7 +225,7 @@
   actual number of items copied = src_count - src_offset).
 * @dst_offset@: The offset in the dst vector to start copying to.
 -}
-foreign import ccall unsafe "duckdb_vector_copy_sel"
+foreign import ccall safe "duckdb_vector_copy_sel"
     c_duckdb_vector_copy_sel :: DuckDBVector -> DuckDBVector -> DuckDBSelectionVector -> DuckDBIdx -> DuckDBIdx -> DuckDBIdx -> IO ()
 
 {- | Copies the value from @value@ to @vector@.
@@ -234,7 +234,7 @@
 * @vector@: The receiving vector.
 * @value@: The value to copy into the vector.
 -}
-foreign import ccall unsafe "duckdb_vector_reference_value"
+foreign import ccall safe "duckdb_vector_reference_value"
     c_duckdb_vector_reference_value :: DuckDBVector -> DuckDBValue -> IO ()
 
 {- | Changes @to_vector@ to reference `from_vector. After, the vectors share
@@ -244,5 +244,5 @@
 * @to_vector@: The receiving vector.
 * @from_vector@: The vector to reference.
 -}
-foreign import ccall unsafe "duckdb_vector_reference_vector"
+foreign import ccall safe "duckdb_vector_reference_vector"
     c_duckdb_vector_reference_vector :: DuckDBVector -> DuckDBVector -> IO ()
diff --git a/test/AggregateFunctionsTest.hs b/test/AggregateFunctionsTest.hs
--- a/test/AggregateFunctionsTest.hs
+++ b/test/AggregateFunctionsTest.hs
@@ -379,22 +379,22 @@
 
 -- Wrapper builders ----------------------------------------------------------
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkStateSizeFun :: (DuckDBFunctionInfo -> IO DuckDBIdx) -> IO DuckDBAggregateStateSizeFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkInitFun :: (DuckDBFunctionInfo -> DuckDBAggregateState -> IO ()) -> IO DuckDBAggregateInitFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkUpdateFun :: (DuckDBFunctionInfo -> DuckDBDataChunk -> Ptr DuckDBAggregateState -> IO ()) -> IO DuckDBAggregateUpdateFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkCombineFun :: (DuckDBFunctionInfo -> Ptr DuckDBAggregateState -> Ptr DuckDBAggregateState -> DuckDBIdx -> IO ()) -> IO DuckDBAggregateCombineFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkFinalizeFun :: (DuckDBFunctionInfo -> Ptr DuckDBAggregateState -> DuckDBVector -> DuckDBIdx -> DuckDBIdx -> IO ()) -> IO DuckDBAggregateFinalizeFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkDestroyFun :: (Ptr DuckDBAggregateState -> DuckDBIdx -> IO ()) -> IO DuckDBAggregateDestroyFun
 
 -- Resource helpers ----------------------------------------------------------
diff --git a/test/ReplacementScansTest.hs b/test/ReplacementScansTest.hs
--- a/test/ReplacementScansTest.hs
+++ b/test/ReplacementScansTest.hs
@@ -101,7 +101,7 @@
             assertBool "replacement error message should surface" ("rejected" `isInfixOf` errMsg)
             c_duckdb_destroy_result resPtr
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkReplacementCallback ::
         (DuckDBReplacementScanInfo -> CString -> Ptr () -> IO ()) ->
         IO DuckDBReplacementCallback
diff --git a/test/TableFunctionsTest.hs b/test/TableFunctionsTest.hs
--- a/test/TableFunctionsTest.hs
+++ b/test/TableFunctionsTest.hs
@@ -534,14 +534,14 @@
 
 -- Wrappers -------------------------------------------------------------------
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkBindFun :: (DuckDBBindInfo -> IO ()) -> IO DuckDBTableFunctionBindFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkInitFun :: (DuckDBInitInfo -> IO ()) -> IO DuckDBTableFunctionInitFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkFunctionFun :: (DuckDBFunctionInfo -> DuckDBDataChunk -> IO ()) -> IO DuckDBTableFunctionFun
 
-foreign import ccall safe "wrapper"
+foreign import ccall "wrapper"
     mkDeleteCallback :: (Ptr () -> IO ()) -> IO DuckDBDeleteCallback