QoreDB v0.1.36 — Release Notes

Driver and connection audit — 17 defects fixed across authentication, security, tunnels, and secrets.

🔐 Authentication Fixes

MySQL/MariaDB — empty passwords no longer scrambled into a non-empty auth response. Passwordless accounts work again.
MySQL/PostgreSQL — connect() now classifies auth errors consistently with test()
Redis — "db3" and "3" resolve to the same database index
MongoDB — authSource is now configurable instead of hardcoded to "admin"

ClickHouse — the cleartext guard and HTTP scheme now derive from the same value. ssl=false with ssl_mode=require no longer sends Basic Auth in the clear.
SQL Server — trust_cert() is no longer unconditional. verify-ca and verify-full actually verify the certificate and honour ssl_ca_cert.
MySQL — a URL's ssl-mode (VERIFY_IDENTITY) is no longer silently downgraded to Required by the connection form.

SSH reconnection — reopens the tunnel on the same local port and confirms health with a ping. Previously left the pool on a dead port while reporting "Healthy".
Proxy + SSH — the combination is now rejected upfront. ssh -L resolves the target on the bastion, so the layering could never work.
Resource cleanup — explicit tunnel close after test, kill_on_drop on the SSH process, Drop on ProxyTunnel
Orphaned sessions — a session opened by the driver then cancelled by the connect timeout is now properly disconnected
Disconnect — closes both tunnels even when the first one fails
HTTP CONNECT proxy — reads the full header block, parses the status as a code instead of a substring, and forwards leftover bytes. The MySQL/PostgreSQL greeting is no longer swallowed.

Proxy password and SSH passphrase survive an edit — a secret absent from the request now keeps the value stored in the vault
Connection modal — checks result.success, so a vault or keyring failure no longer silently appears as a success

MongoDB — options from a parsed URL (authSource, replicaSet, srv, TLS) reach the driver through an additive, backward-compatible options field. mongodb+srv rebuilds a proper SRV URI with no port.
IPv6 — literal hosts are bracketed in every URL builder
PostgreSQL — database name is URL-encoded for characters that would break the DSN, while preserving MotherDuck's md: prefix