A patch release: pg_trgm no longer has to be on the search_path, and the project now follows OpenSSF supply-chain practices.
No action needed after upgrading. Only the generated search statements change.
Fixed
- The typo-tolerant and relaxed search SQL now schema-qualifies the trigram operator and
word_similarity()with the configuredextension_schema, as every otherpg_trgm/unaccentreference already did. Installations that keep the extensions in a dedicated schema outside thesearch_pathnow work.
Changed
- CI: every workflow runs with a read-only token and pins its actions to a commit SHA. The demo's base images are pinned by digest, and Dependabot keeps them current.
- The OpenSSF Scorecard is published weekly and shown as a README badge.
.bestpractices.jsonholds the answers for the OpenSSF Best Practices badge. mainis protected: every change lands through a pull request once CI passes.- The Composer package now contains
.github/, a few KB of workflow files, because Scorecard reads the same archive that Composer downloads. - README: every known limitation now points to its planned fix on the roadmap.
Full list: CHANGELOG