v1.16.1

What's Changed

Security

• The hosted Semantic Layer token is only ever sent to dbt Cloud hosts; a repository's .dex/config.yml can no longer point it elsewhere (GHSA-28xv-9wpg-c42r)
• explore query refuses functions that read files, URLs or other databases, and resolves every subquery against the cache (GHSA-f3jf-cv9h-7c3g)
• Errors and warnings are redacted before they are printed, and --warm no longer copies uv's output into its envelope (GHSA-jm75-qwf5-vg52)
• Security hardening: dbt no longer inherits credentials it never reads, profiles.yml secrets must be a single env_var() reference, transform classify flags more executable and authority-bearing content, and every connector extra requires urllib3 2.8.0 or later

Reported by Sthenos Security, found with Reachable. If you used the hosted Semantic Layer backend in a repository you did not write, check its .dex/config.yml for a semantic.host outside dbt Cloud and rotate the token if you find one. Details in CHANGELOG.md.

Downstream-visible changes

• transform plan drafts the measured half of each model's declaration (#493) by @marcociav-exmergo in #812
• transform apply hands back a co-author trailer that credits Dex (#811) by @marcociav-exmergo in #813
• Show how the project already decides: precedent in the declaration draft, and a warning for a filter value the column never holds (#494) by @marcociav-exmergo in #818
• transform plan warns when an edit contradicts what the model declares (#495) by @marcociav-exmergo in #819

Bug fixes

• Fix severity handling for fully NULL columns by @charanreddy0006 in #798
• fix(redshift): install botocore[crt] and refuse a missing one as a prerequisite by @arxh80 in #815
• fix(transform): scaffolded sources name their database outside Trino too by @arxh80 in #816
• fix(transform): return host models from DexEngine results (#579) by @bradleyjoejoseph in #821
• fix(transform): settle spend and uptime when dbt build raises (closes #667) by @bradleyjoejoseph in #808
• fix(transform): require models behind metrics in build evidence by @MbappeWU in #810

Other changes

• docs(semantic-layer): mark entity description as not settable from a dbt project by @nosmile99 in #805
• docs(skills): say the plugin builds the engine from bundled source by @arxh80 in #814
• docs: document what to commit in .dex/ (config, snapshot, cache, plans, queries, drift) by @nosmile99 in #817
• docs(explore): example envelopes for semantic commands and multi-statement query by @MbappeWU in #809

Dependencies

• build(deps): bump the github-actions group across 1 directory with 3 updates by @dependabot[bot] in #807
• build(deps): bump ruff from 0.15.19 to 0.17.1 in /packages/dex-core in the dev-tools group by @dependabot[bot] in #806

New Contributors

• @charanreddy0006 made their first contribution in #798
• @nosmile99 made their first contribution in #805

Full Changelog: v1.16.0...v1.16.1