DBine v0.1.10

DBine v0.1.10 installers.

New

• Drivers update on their own, apart from the app: DBine looks in a signed index for the newest driver compatible with your version, downloads it in the background and goes back to the previous one if something fails. In Settings › Drivers there is a Check for updates button, the status of each driver and Roll back. A driver can be released on its own, without a new app version.
• Rename a database: Rename… on a database in the explorer. The dialog shows the other sessions open on it (which the rename ends), whether the new name exists, how many objects move and the full script. Afterwards the connection's default database, open tabs, saved queries, migrations, project targets and scheduled task steps follow the new name; tasks that change data in it ask for approval again. Available in SQL Server, Azure SQL, Babelfish, the PostgreSQL family, MySQL, MariaDB, Snowflake and MongoDB; where the engine can't rename (or move) a database, it isn't offered.
• Which column is this value? In an INSERT … VALUES, placing the cursor on a value shows a tooltip with its column (for example "Column 14 of 48: Name") and highlights that column in the list. Without a column list, it uses the table's columns in order. Works on every SQL and CQL engine.
• More ways to sign in to SQL Server with Microsoft Entra ID: interactive with MFA (in the browser), integrated (the Windows account, through the organization's federated ADFS), managed identity and default (environment variables, managed identity, Azure CLI or Azure Developer CLI). The token is kept while DBine runs and renewed before it expires.
• Map a login to a database: Assign login… in Users and permissions creates the database user for a server login that already exists (CREATE USER … FOR LOGIN, with its default schema), listing the logins that don't have a user there yet. Available in SQL Server, Azure SQL Database (the login is typed there), Babelfish and SAP ASE.

Improvements

• What each version brings: the new-version notice shows its changes and those of the versions in between, starting from the one you have installed, in the app's language.
• Old app versions: from now on, an app older than the last five versions has to update in order to download new drivers. The drivers it already has installed keep working.
• Users and permissions: changes are queued and applied together. A pending changes bar lists them, one review shows the whole script, and they run one at a time: applied ones leave the list and, if one fails, it and the rest stay pending.
• Reads by MCP clients and the AI assistant are protected by the database itself:
  • Enforced by the server: on the PostgreSQL family, MySQL, MariaDB, SQLite and libSQL, each read runs as a single statement inside a read-only transaction that the server enforces and DBine always rolls back.
  • Approval: on the other engines, every read asks for your approval in DBine, the same way writes do. The approval dialog says whether it's a read or a write, and Approve all applies to reads and writes separately.
  • Write check: DBine still checks each query for writes, as an extra layer.

Fixes

• Read-only is stricter: the queries of MCP clients at the Read level, the AI assistant and read-only connections are checked word by word, not only by their first word. They now refuse:

  • a write hidden after a read in a SQL Server batch;
  • a data-modifying WITH;
  • SELECT … INTO, EXEC and SET;
  • functions that act outside the query, such as set_config, dblink_exec and xp_cmdshell.

  An estimated plan refuses scripts that would turn plan mode off, so AI alternatives in Optimize query can't run anything. Scheduled tasks whose scripts now count as writing ask to be approved again.

• Library with git: a shared repository can no longer make DBine read, write or delete files outside the Library's folder.

• SSH tunnels: each server's host key is checked on its own. A key accepted for a jump host no longer counts for the next server, known_hosts is checked first and a changed key is always refused. Servers you accepted before are asked once more. The tunnel's local port only serves your own user's programs.

• Cloud backup: a backup file someone else modified can no longer weaken the encryption of your next upload.

• libSQL / Turso: an authToken in a pasted URL is kept in the system keychain, not in the connection's address, name or history. Connections saved before are cleaned up when DBine starts.

• Document the database: column names can't inject HTML into the Markdown data dictionary.

• Task notifications on Windows: a database error message can no longer run commands through the notification. Notifications on macOS and Linux get the text as separate arguments too.

• SSH tunnels: a server whose key you accepted in DBine and that now presents a different one is refused, instead of asking you again. The connection's SSH section lists the accepted servers, each with Forget.

• SQL against PostgreSQL: string values are written as E'…' with backslashes escaped, so a value can't end the string early on a server with standard_conforming_strings off. This covers the PostgreSQL family, CockroachDB and similar engines.

• Snowflake scripts: a backslash inside a "quoted name" no longer changes where a statement ends.

• CSV and TSV export: text cells and column names that start with =, +, -, @, a tab or a carriage return get a ' in front, so spreadsheets don't run them as formulas. Numbers are never changed. An option in the export dialog turns it off.

• Discarding changes in Projects: a file named like a pattern (*) only discards that file.

• Copy a subset: masking uses a new random 256-bit key on every run.

• Driver updates: the app never accepts a driver index older than the one it was released with, even on a new installation, nor one that has stopped being renewed. Installed drivers keep working either way.

• Connection import, the linter and the health check no longer stop on accented or other multi-byte characters.

• Read-only on SQL Server: each query runs in a transaction that is always rolled back. Backups, restores, enabling or disabling triggers, text-pointer writes, Service Broker and transaction statements are refused when they come after a read in the same batch.

• Read-only on PostgreSQL: names written with Unicode escapes (U&"…") are refused, so a forbidden function can't be called under another spelling.

• CSV and TSV export: the formula protection also applies to text stored in columns declared as numbers, which SQLite allows.

• Generated scripts: object names from the server can't end a comment and run as code. This covers the fixes suggested by Health check, and the users, backup and structure scripts. ClickHouse names with a backslash are quoted correctly.

• Read-only: a statement that doesn't start with a word, such as a bracketed name that runs a procedure on SQL Server, is refused. The words inside parenthesized reads are checked too.

• Modify table: the warnings in the script you open as a query stay on their comment line.

• Passwords and secret options are masked wherever they're edited, including backup steps in scheduled tasks.

• View dependencies and Rename no longer stop on routines with unusual quoted names.

• Read-only on SQL Server: a batch can only start with SELECT, WITH, USE or PRINT. What follows SHOW, DESCRIBE or PRAGMA is checked on every engine.

• Import connections: an Oracle JDBC URL with a user and password keeps them out of the connection's name: the password goes to the system keychain.

• Read-only on SQL Server: a procedure whose name starts like print_ or select1 is no longer taken for a read.

• Import connections: an Oracle password containing @ is kept whole in the system keychain.

• SSH tunnels on Linux: the tunnel's local port only trusts open connections from your own user.

• Read-only: a query with a lone carriage return or an unusual Unicode space is refused, because engines disagree on where a comment or a statement ends there. Functions with side effects are refused too: load_extension in SQLite, pg_notify and logical replication reads in PostgreSQL, and session or query cancellation in Snowflake.

• Import connections: a SQL Server URL with no host no longer puts its password in the connection's name.

• Users and permissions: the preview hides PostgreSQL passwords in every form.

• Read-only: queries that take locks other sessions wait on are refused, for example pg_advisory_lock, GET_LOCK, LOCK IN SHARE MODE and FOR SHARE.

• Snowflake and Cassandra: // comments are read the way the server reads them.

• Read-only SQL Server connections refuse lock hints and WAITFOR.

• Read-only connections refuse advancing a sequence (NEXT VALUE FOR, .NEXTVAL).

• Rename:

  • On every engine, a dependent whose code would split into more than one statement is refused.
  • Snowflake routine bodies containing $$ are kept whole.
  • OrientDB names that DBine couldn't quote safely are refused.

• SQL export: string values are written the way the source engine reads them, so they come back exact when you run the script there. They also can't add statements on an engine that reads backslashes differently.

  • PostgreSQL, SQL Server, Oracle, SQLite, DuckDB, Firebird, SAP HANA, Trino, Db2, Teradata, Vertica, Exasol, Netezza and Dremio: a backslash is written with the engine's own character function, so no backslash appears inside a string. Firebird scripts carry one row per INSERT, which is all Firebird accepts.
  • Engines that read backslash escapes (MySQL, ClickHouse, Snowflake, Redshift…): backslashes and quotes are escaped the way those engines read them.
  • Unknown sources (a grid from several databases) get a form that's safe on any engine. The new option Target reads strings the standard way writes their backslashes as they are.

• CSV and TSV export: formula protection also covers text after a , or ;, which a spreadsheet with another list separator would split into its own cell.

• Rename on Snowflake: views, functions and procedures that name the renamed object are listed for you to fix by hand instead of being re-created, so they keep their owner, EXECUTE AS and SECURE.

Downloads

• Windows: -setup.exe (requires WebView2, included in Windows 10/11).
• macOS: .dmg; aarch64 for Apple Silicon, x64 for Intel.
• Linux: .AppImage (portable), .deb or .rpm.

Version 0.1.4 and later receive it through the automatic update.

The binaries aren't signed by Apple or Microsoft:

• macOS: the first time, it warns that it can't verify the developer. Open System Settings › Privacy & Security › "Open Anyway", or run in the terminal: xattr -dr com.apple.quarantine /Applications/DBine.app.
• Windows: SmartScreen may ask for "More info" › "Run anyway".
• Each engine's driver (except SQLite) is downloaded the first time you connect.