NextSQL v0.0.6

NextSQL 0.0.6 — security and Studio updates

This preview fixes a server denial of service reported while building Bzync
Launcher and includes the security and Admin changes since 0.0.5.

Security and correctness

• EXTRACT and DATE_TRUNC require exactly two arguments; DATE_ADD and
  DATE_DIFF require exactly three. Missing or extra arguments now return
  invalid_argument before argument indexing or NULL propagation. The reported
  SELECT DATE_ADD(NOW(), INTERVAL '-5 minutes') no longer panics. Use the
  native form SELECT DATE_ADD(NOW(), -5, 'minute').
• Unexpected recoverable panics in a connection's serving goroutine close that
  connection and run existing cleanup, including transaction abort, lock release,
  and session/admission removal. Other sessions and the listener continue serving.
  Panic payloads are excluded from the diagnostic log. An interrupted commit
  retains normal uncertain-outcome semantics.
• Source builds require Go 1.26.10; container builds use Go 1.27.3, including
  the certificate-validation security fix. The docs dependencies and Studio
  SQL-reference generator's regex are patched.

Admin and tooling

• Setup, Operations, and Studio share consistent typography, controls, panels,
  responsive layouts, and light/dark presentation.
• Studio offers automatic native SQL completion and capability-aware notes for
  unavailable or unverified features. The bundled reference covers 77 command
  forms and 183 built-in names; the connected server remains authoritative.
• The Node driver's TypeScript smoke fixture uses matching Node16 module and
  resolution settings. The driver's runtime and package version are unchanged.
• The retained upgrade-fixture helper explicitly creates its database instead
  of stopping after credential-only initialization.

Upgrade and compatibility

Stop the daemon, install the 0.0.6 Linux packages, and restart it. Verify both
the CLI and running daemon report 0.0.6; replacing only the CLI or npm package
does not update an already-running server. Keep a verified pre-upgrade backup.
Windows hosts use the Linux packages under WSL 2.

There are no storage, WAL, catalog, backup, or NSQL format changes relative to
0.0.5 and no data migration for this patch. Native date-function signatures
remain unchanged. Node and Bun drivers remain at 0.0.1; existing clients receive
the server fix by connecting to the upgraded daemon. No separate driver release
is required. Existing downgrade restrictions for earlier format versions still
apply; see Compatibility.

Container users pin docker.io/bzynchub/nextsql:0.0.6. Image tags and release
assets are immutable; no latest image tag is published.

Validation and limits

Regression coverage includes all four date functions, malformed NULL calls,
table-backed and no-FROM SELECT, prepared statements over TLS, pre-authentication
and execution panics, rollback, lock release, and connection accounting. Focused
normal and race tests pass. The local broad run hit a backup-package timeout on
an I/O-pressured host; the local full race run was stopped during backup I/O.
Neither local run is a full-suite pass. The exact release commit passed the
hosted production evidence gate
before tagging; its retained log records disk-backed scratch. The published
assets, installed daemon, Downloads page, and new clean/dirty retained fixtures
also pass their post-release checks.

The bounded 25K-row / 256-vector SLO run completed with encryption, WAL, and
fsync enabled. Initial single-row insert/update latency targets were not met
on the local host. A serial five-second follow-up met the insert targets;
update p99 still exceeded its 10 ms target. This is not a new performance
sign-off. The measured context, limits, and both raw reports are retained in the
release evidence.

This remains a preview. Validate SLOs, crash recovery, HA, and backup/restore
on your deployment hardware. No new performance or availability claim is made.

Full changelog: v0.0.5...v0.0.6