SQLGuard Ninja v0.6.0

Highlights

OpenTelemetry tracing and Prometheus metrics. Install the optional extras [otel] and [prometheus]. Pass SQLCheckpoint(telemetry=Telemetry(tracer=..., metrics=GuardMetrics())) to get spans for checkpoint and validation decisions. Metrics cover decisions, findings by rule, latency, errors, resource-limit rejections and checkpoint outcomes, all with bounded labels.
Privacy by default. Spans, metrics and audit events contain no SQL text, literals, comments, request-context values or internal detail. Traces and metrics also omit tenant ids and principals. Canary tests check this across many literal forms.
SARIF 2.1.0. sqlninja scan validates every statement in SQL files and writes SARIF for code scanning. The output validates against the OASIS schema in the tests and in CI.
Grafana dashboard. It ships with a local Prometheus + Grafana stack fed by synthetic traffic, which CI starts and checks.

Audit redaction previously let hex, bit, E'', dollar-quoted, U&'' and N'' strings, and INTERVAL text, through into sql_redacted. All are now redacted, and redacted SQL is withheld if any literal token survives. If you keep audit logs from earlier versions, review them for inlined secrets.

All benchmark results are still internal (issues #5 and #6). SQL Server and Oracle remain parser-level experimental.

python -m pip install "sqlguard-ninja[otel,prometheus]==0.6.0"