Lexega SQL v2.0.0

Formatting, analysis and review no longer need a license key. Without a key, fmt, analyze, review and ci run with every built-in rule and dialect, custom rules, catalog snapshots, cloud storage locations, SARIF and PR comments. Each statement is then analyzed as written: rules that depend on semantic analysis may stay silent or report less precisely, and every report says how many. A license key adds semantic analysis, dbt/Jinja rendering, diff, cross-script analysis, policy enforcement, the dashboard and the runtime gate.

The parser, the built-in rules and the command line are now source-available. github.com/Lexega/lexega holds them under the Business Source License 1.1, with the engine that analyzes each statement as written and the catalog sidecars. Each release also carries lexega, a binary built from that source. It reports what lexega-sql reports without a key.

catalog pull now reads SQL Server and Azure SQL. Each platform now has its own sidecar, and lexega-mssql-catalog is the new one.

Comparing a column to NULL with = or an ordering operator is now flagged. WHERE col = NULL matches no rows whatever the data, and is almost always a mistake for col IS NULL. It now reports Q-NULL-EQ (high), as do <, >, <= and >=, including through a CTE chain. IS NULL, IS NOT DISTINCT FROM NULL and comparisons to non-NULL values stay silent. col <> NULL still reports Q-NULL-NEQ.

Wide boolean expressions no longer end a run. A WHERE clause with roughly a thousand or more OR / AND terms, the shape BI tools emit for a long IN list, aborted the run with no report. These now analyze at any width, with the same verdicts. The v1.23.0 fix covered statements that could not be parsed and still holds; this SQL parsed, and the run ended during analysis.

A statement whose analysis was lost no longer reports high confidence, and --strict pedantic fails on it. Unlike the boolean chains above, a long arithmetic or string-operator chain (a - b - c - …) still has a limit, and past it the statement's findings are lost. The report's confidence is then no longer high, and an analysis limitation names the line. A missing catalog, an unrecognized function name or an unresolved template does not lower confidence. --strict is unchanged. Previously pedantic reported that it was unavailable and enforced nothing.

Reports and decisions identify the catalog they were computed against. With --catalog, the report's catalog_info and the decision record's inputs carry catalog_sha256, and catalog inspect prints the same value for a catalog file. When a run adds dbt-declared column tags to the snapshot, the value covers the combined state and differs from the file alone. A decision made with a catalog has a different decision id from the one an earlier version produced.

Fixes

• A CREATE [OR REPLACE] TABLE whose table name is an unquoted keyword, such as clone, copy, tag or row, now parses and is analyzed. Previously the statement was skipped and its findings were silent.
• Databricks catalog snapshots now carry column masks and primary and foreign key constraints, so the findings that rely on them can fire. A pull also reads every page of a listing, where a workspace that answered in pages used to yield a truncated snapshot without an error.
• review, diff and ci no longer leave a changed SQL file out without saying so. Files with non-ASCII characters, quotes or backslashes in their names, an upper-case .SQL extension, or a path under tests/ or dbt_packages/ are now analyzed. Files under macros/ are still not analyzed, and are now listed as skipped.
• A directory scan (analyze -r, fmt -r, --scan-embedded) no longer follows symbolic links, so it reads and writes nothing outside the directory it was given. A path named on the command line is still followed.
• SARIF and GitLab SAST reports name each rule by its identifier, where every rule used to carry the same placeholder name. Both formats also say when a run was at reduced depth.

Upgrading

• Custom rules: a WHERE joined by AND or OR is now one chain at filter.logical_chain.op and filter.logical_chain.operands. A rule that matched filter.binary_op.op against and or or must move there.
• license activate asks you to accept the license agreement. From a script, pass --accept-license. INDIVIDUAL and PRO keys are entitled as Team.
• Scripts that run a catalog sidecar directly need its new name: lexega-catalog is now lexega-sf-catalog, and Databricks pulls use lexega-dbx-catalog.
• [template.substitution] in .lexega.toml takes presets only. A file that sets env or [[custom]] there stops the run with an error. Use --var-env NAME and --var-syntax '%%NAME%%' on the command line.

Files in this release

• lexega-<platform> is built from the source at this tag. So are the catalog sidecars: lexega-sf-catalog-*, lexega-dbx-catalog-* and lexega-mssql-catalog-*.
• lexega-sql-<platform> is the commercial build. It is not built from this repository. It is proprietary software under the Lexega Software License Agreement, and without a license key it reports what lexega reports.
• CHECKSUMS.sha256 lists the SHA-256 of every other file. The sbom-*.cdx.json files are CycloneDX SBOMs, one for each platform binary and each catalog sidecar.