v2.44.0

Features

• Super admins can set connection parameters on a Postgres database, such as pgdog.role=replica. Also available through the API and the Terraform provider.
• Admins can issue a scoped service account token for unattended MCP agents.
• A lightweight tunnel agent that only handles network access, published as its own image and versioned with Devhub.

Improvements

• Redesigned navigation and modals.
• The QueryDesk audit log names who approved each query and when.
• Members without the Auditor permission see only their own queries in the QueryDesk audit log.
• A database that refuses a connection, or whose tables can't be listed, now says why.
• Refusing a filter on a CTE or derived-table output names the redacted column behind it, and the Data protection panel opens on the refused query.
• Applying a Postgres connection string keeps the database's other credentials and reports which settings were applied.
• Pending queries show the error when an approved query is rejected by the database.
• Connected apps leads with distinct users and counts each session once.
• A TerraDesk resource policy's approval count replaces the workspace baseline for the resources it governs.
• The helm chart's default POOL_SIZE is higher.

Bug Fixes

• EXPLAIN (GENERIC_PLAN) on a statement with $n placeholders returns the plan instead of failing silently.
• SQL the tokenizer rejects shows a readable error in QueryDesk instead of crashing.
• Two schema syncs of the same database at once both finish without an error.
• An inherited data protection policy always redacts exactly as its source policy does.
• The Workflow API returns group, so Terraform stops re-planning it.