docs: release v1.9.0 — version bumps, changelog, and documentation updates

[ajitpratap0]

Summary

This PR finalizes the v1.9.0 release by updating all version strings and documentation to reflect the 19 post-UAT fixes shipped in PR #348 (already merged). It touches no production code — only version constants, CHANGELOG, README, and docs.

• 3 version string bumps (1.8.0 → 1.9.0) across Go source files
• 1 CHANGELOG section added (complete v1.9.0 entry)
• 1 README section updated (What's New, release banner)
• 12 documentation files updated (headers, content, new sections)
• 4 stale v1.6.0/v1.8.0 metadata blocks corrected

---

What Changed in v1.9.0 (documented here, implemented in PR #348)

Category	ID	Summary
New features	DIALECT-3	SQLite PRAGMA fully parsed (bare, arg, assignment forms)
New features	DIALECT-4	WITHOUT ROWID on CREATE TABLE; reserved keywords as DDL column names
New features	SEC-1	Tautology detection: 1=1, 'a'='a', col=col, OR TRUE → CRITICAL
Parser bugs	CORE-1/2/3	KEY in qualified names; NATURAL JOIN type; OVER window_name
Parser bugs	DIALECT-1/2	MySQL backtick + SQL Server bracket reserved-word identifiers
Error codes	ERR-1	E1009 ErrCodeUnterminatedBlockComment (was E1002)
Security	SEC-2	UNION split: PatternUnionInjection (CRITICAL) / PatternUnionGeneric (HIGH)
CLI bugs	CLI-1/2	token_count: actual count from tokenizer (was 0 / len(statements))
CLI bugs	CLI-3/4/5	Query Size non-zero; first SELECT column indented; CTE in parse output
CLI UX	CLI-6/7/8	No usage block on domain errors; lint exits 1; ✅/❌ checkmarks

---

Files Changed

Version Bumps (code)

File	Change
pkg/gosqlx/gosqlx.go	const Version = "1.9.0"
cmd/gosqlx/cmd/root.go	var Version = "1.9.0" + Version: "1.9.0" in rootCmd + updated version comment block
cmd/gosqlx/cmd/doc.go	Version comment 1.9.0
cmd/gosqlx/doc.go	Package doc comment v1.9.0
doc.go	Package doc comment v1.9.0
CLAUDE.md	Project status current: v1.9.0

CHANGELOG.md

Prepended a full [1.9.0] section covering all 19 fixes under Features, Bug Fixes, and Security headings with structured [ID] tags. Updated the Version History Summary table: 1.9.0 → Current, 1.8.0 → Previous.

README.md

• Release banner updated: v1.9.0 Released · SQLite PRAGMA · Tautology Detection · 19 Post-UAT Fixes · lint CI-gate · UNION false-positive fix
• What's New table replaced with v1.9.0 feature table (8 rows covering SQLite PRAGMA, WITHOUT ROWID, tautology detection, UNION fix, lint CI-gate, CLI output fixes, parser fixes, E1009)
• Performance highlights heading updated to v1.9.0
• Historical v1.8.0 feature annotations in Key Features list preserved (correct introduction-version markers)

docs/ERROR_CODES.md

• Quick Reference table: added E1009 | Tokenizer | Unterminated block comment (missing \*/`)`
• New E1009 — Unterminated Block Comment section with SQL example, error message, hint, and builder function reference
• Version header updated: v1.6.0 / December 2025 → v1.9.0 / 2026-02-28

docs/SQL_COMPATIBILITY.md

• Version header: v1.9.0 | 2026-02-28
• Added Recent Additions (v1.9.0) section (7 bullet points) before the existing v1.8.0 section
• SQLite PRAGMA row: 🔧 Syntax | 10% → ✅ Full | 90%
• WITHOUT ROWID row: ⚠️ Partial | 40% → ✅ Full | 85%
• Overall Compliance heading: (v1.8.0) → (v1.9.0)
• Metadata block (Last Updated, GoSQLX Version, Test Suite Version): updated to v1.9.0 / 2026-02-28
• Added Quick Reference: What's New in v1.9.0 section before the existing v1.8.0 quick reference

docs/CLI_GUIDE.md

• Version header: v1.9.0 / 2026-02-28
• lint Exit Codes table updated: exit 0 = no violations; exit 1 = any violation (error, warning, or info)
• Added v1.9.0 callout explaining the behavioral change (previously required --fail-on-warn to exit 1 on warnings)

docs/SECURITY.md

• Version header + Analysis Date: v1.9.0 / 2026-02-28
• Security Package heading updated to (v1.4+, updated v1.9.0)
• Added Tautology Detection (v1.9.0) section — describes numeric, string, identifier, and keyword (OR TRUE) patterns; severity CRITICAL / PatternTautology
• Added UNION Detection (v1.9.0) section — explains the PatternUnionInjection (CRITICAL) vs PatternUnionGeneric (HIGH) split and why it eliminates false positives on legitimate UNION queries

docs/MIGRATION.md

Prepended v1.8.0 → v1.9.0 (2026-02-28) section at the top:

• "No breaking changes. No API changes. Drop-in upgrade."
• Behavioral note for lint exit codes (CLI-7)
• Behavioral note for E1009 (ERR-1) — code catching E1002 for /* handling should update to E1009

docs/GETTING_STARTED.md

• What's New section updated to v1.9.0 with 6 bullet points (SQLite PRAGMA, tautology detection, UNION fix, lint CI-gate, E1009, 19 post-UAT fixes)
• Available CLI Commands version tag: (v1.6.0) → (v1.9.0)

docs/ — Header-only updates (no content gaps found)

File	Change
docs/PRODUCTION_GUIDE.md	v1.8.0 / 2026-02-24 → v1.9.0 / 2026-02-28
docs/README.md	Current Version + Feature Overview heading → v1.9.0
docs/USAGE_GUIDE.md	v1.6.0 / December 2025 → v1.9.0 / 2026-02-28
docs/LINTING_RULES.md	v1.6.0 / December 2025 → v1.9.0 / 2026-02-28
docs/ARCHITECTURE.md	v1.6.0 / December 2025 → v1.9.0 / 2026-02-28
docs/API_REFERENCE.md	Title (v1.6.0) → (v1.9.0)

---

Verification

# Version check
go build -o /tmp/gosqlx_v190 ./cmd/gosqlx/ && /tmp/gosqlx_v190 --version
# → gosqlx version 1.9.0 ✅

# All packages pass with race detection (pre-commit hook)
go test -short ./...   # ✅ all 47 packages pass
go vet ./...           # ✅ zero warnings
gofmt -l .            # ✅ zero files need formatting

---

Behavioural Changes for Users (documented in MIGRATION.md)

lint exit codes (CLI-7):

• Before: exits 0 unless errors present or --fail-on-warn set
• After: exits 1 whenever any violation (error, warning, or info) is found
• Impact: CI pipelines using gosqlx lint as a quality gate now correctly fail on warnings

E1009 for unterminated block comments (ERR-1):

• Before: unterminated /* ... */ emitted E1002 (generic string error code)
• After: emits E1009 ErrCodeUnterminatedBlockComment
• Impact: code catching specific error codes for /* handling should update to E1009

---

Next Steps (after merge)

git checkout main && git pull
git tag v1.9.0 -a -m "v1.9.0: SQLite PRAGMA, tautology detection, 19 post-UAT fixes"
git push origin v1.9.0   # triggers GoReleaser workflow automatically

🤖 Generated with Claude Code

[claude]

Claude finished @ajitpratap0's task —— View job

---

PR Review: v1.9.0 Release Documentation Updates

Overall Assessment: This is a well-structured release PR with comprehensive documentation updates. The changes are consistent and accurately reflect the documented features. However, there are some minor issues and potential improvements to consider.

---

✅ Positive Findings

Version Consistency: All version strings have been consistently updated from 1.8.0 → 1.9.0 across the entire codebase including:

• Library constants (pkg/gosqlx/gosqlx.go:77)
• CLI version variables (cmd/gosqlx/cmd/root.go:44)
• Documentation headers and metadata blocks

Documentation Quality: The CHANGELOG.md v1.9.0 section is exceptionally well-structured with clear categorization (Features, Bug Fixes, Security) and proper ID tagging system.

New Feature Implementation: The SQLite PRAGMA parser (pkg/sql/parser/pragma.go) is clean and follows the project's coding standards with proper error handling.

CHANGELOG Accuracy: ✅ Verified that documented features match actual implementation:

• ✅ E1009 error code properly implemented in pkg/errors/errors.go:75
• ✅ WITHOUT ROWID support added to CREATE TABLE (pkg/sql/parser/ddl.go + pkg/sql/ast/ast.go)
• ✅ PRAGMA statement parsing implemented (pkg/sql/parser/pragma.go)
• ✅ Tautology and UNION detection patterns updated in security scanner
• ✅ Core parser fixes for qualified names, NATURAL JOIN, and window functions

---

⚠️ Issues and Concerns

1. CLI Exit Code Documentation Inconsistency ⚠️ HIGH

Issue: The CLI documentation in cmd/gosqlx/cmd/lint.go:77 still claims:

1 - Errors or warnings found (warnings only if --fail-on-warn is set)

But the actual implementation at line 237 shows:

if totalViolations > 0 {
    return fmt.Errorf("found %d violation(s)...", ...)
}

Impact: HIGH - This is misleading documentation that could confuse users about CI integration behavior.

Fix: Update the CLI help text to match the v1.9.0 behavior: 1 - Any violation found (error, warning, or info)

2. Test Behavior Alignment ⚠️ MEDIUM

Issue: In cmd/gosqlx/cmd/lint_test.go:56,71,97, tests expect expectedError: true for warnings/info violations with comments indicating "CI gate behavior." The implementation appears correct, but the test approach doesn't directly verify exit codes.

Recommendation: Consider adding integration tests that verify actual exit codes using subprocess execution to ensure the behavior matches expectations.

3. Documentation Update Quality ✅ GOOD

Migration Guide: The docs/MIGRATION.md clearly documents behavioral changes with proper impact assessment.

CLI Guide: The docs/CLI_GUIDE.md correctly updates exit code documentation for lint command with appropriate v1.9.0 callout.

---

🔍 Code Quality Assessment

Memory Management: ✅ The new PRAGMA parser properly follows the project's object pooling patterns.

Error Handling: ✅ New E1009 error code implementation is consistent with the existing error system architecture.

Testing: ✅ Core parser fixes in pkg/sql/parser/core_fixes_test.go follow project testing conventions with proper tokenizer pool management.

Security Implementation: ✅ The security pattern changes are well-implemented:

• Tautology detection covers numeric (1=1), string ('a'='a'), identifier (col=col), and keyword (OR TRUE) patterns
• UNION pattern split properly addresses false positives: PatternUnionInjection (CRITICAL) vs PatternUnionGeneric (HIGH)
• Verification tests in pkg/sql/security/sec_verify_test.go validate the behavioral changes

---

📋 Security Considerations

Positive Security Enhancements:

• ✅ Tautology detection properly identifies authentication bypass patterns
• ✅ UNION detection split should significantly reduce false positives in legitimate applications
• ✅ New patterns follow established severity classification system

No Security Concerns: The changes enhance security detection without introducing new vulnerabilities.

---

🚀 Performance Impact

✅ No Performance Regressions Expected: This is primarily a documentation and bug fix release. The new PRAGMA parser adds minimal overhead only when SQLite PRAGMA statements are encountered.

---

📝 Recommendations

Priority	Issue	Recommendation
HIGH	CLI help text inconsistency	Fix lint command documentation to reflect v1.9.0 exit behavior
MEDIUM	Test coverage	Consider adding integration tests for CLI exit code behavior
LOW	Documentation completeness	The extensive version comment block in root.go is excellent documentation

---

✅ Final Verdict

This is a high-quality release PR that significantly improves the project's SQLite support and security scanning while maintaining backward compatibility. The CHANGELOG entries accurately reflect the implemented changes, and the new features are properly implemented.

Primary Concern: The CLI documentation inconsistency for lint exit codes should be addressed before merge to prevent user confusion.

Recommendation: Approve with requested changes to fix the CLI documentation inconsistency.

---

Review Completed: All documented features verified against implementation ✅
Test Coverage: Appropriate for scope of changes ✅
Security Impact: Positive enhancements only ✅
Performance Impact: No regressions expected ✅

---