v0.11.0

After more than 6 months since v0.10.3, we're excited to ship GatewayD v0.11.0, a significant releases in the project's history. The highlight is pre-authenticated backend pool connections, a foundational capability that transforms how GatewayD manages PostgreSQL connections and unlocks critical use cases like identity brokering via the auth plugin.

Highlights

Pre-Authenticate Backend Pool Connections (#721)

This is the most important change in v0.11.0. Previously, backend connections in the pool were raw TCP sockets. They had no PostgreSQL session state until a client connected and the startup handshake was forwarded through. With pre-auth, GatewayD now performs the full PostgreSQL startup handshake (including authentication) immediately after establishing each backend TCP connection, so pool connections are ready for queries before any client arrives.

Why pre-auth matters:

• Enables the auth plugin's identity broker model. The auth plugin can now authenticate frontend clients independently (via custom credentials and soon federated identity providers) and map them onto pre-authenticated backend connections. Without pre-auth, the auth plugin had no way to decouple frontend and backend authentication.
• DISCARD ALL-based connection recycling. When a client disconnects, GatewayD now sends DISCARD ALL to reset the backend session state instead of tearing down and re-establishing the TCP connection. This is significantly faster and reduces load on the PostgreSQL server.
• Full authentication method support. The startup handshake supports trust, cleartext, MD5, and SCRAM-SHA-256 authentication, covering all common PostgreSQL configurations.

Configure it via the new startupParams block in the client config:

clients:
  default:
    writes:
      startupParams:
        user: postgres
        database: postgres
        password: postgres

Improved Connection Lifecycle & Shutdown

The traffic handling model in OnTraffic has been redesigned. Instead of using channels to coordinate the client-to-server and server-to-client goroutines, both goroutines now participate in a sync.WaitGroup. OnTraffic blocks until both goroutines have fully exited, guaranteeing the backend connection is idle before attempting session reset or recycling. This eliminates a class of race conditions where DISCARD ALL could collide with a still-active reader.

Additionally, the shutdown sequence has been improved: the server status is now set to "stopped" before proxies are shut down, so OnClose hooks can detect the shutdown-in-progress state and avoid spurious error logs. Expected shutdown errors (e.g. ErrClientNotFound during cleanup) are now logged at DEBUG level instead of ERROR.

Unified Raft Log Adapter (#686)

A new StandardLogWriter captures Go stdlib log output (used internally by raft-boltdb) and redirects it through zerolog with proper formatting and the "component": "raftboltdb" tag. Raft TCP transport output is now discarded instead of writing to stderr. This ensures all log output flows through GatewayD's structured logging pipeline.

hclog Format String Handling (#689)

Fixed a bug where hclog.Format values (used by hashicorp/go-plugin) were not rendered correctly in the hclog-to-zerolog adapter. Format strings are now properly interpolated via fmt.Sprintf.

Other Changes

• Race condition fix in Client.Send/Receive: The connection is now snapshotted under a mutex to prevent races with concurrent Close() calls.
• New Proxy methods: ExpireBackendReadDeadline() and ClearBackendDeadline() allow precise control over backend connection deadlines during goroutine teardown.
• New error codes: ErrCodePgStartupFailed and ErrCodePgResetSessionFailed for pre-auth error handling.
• Test improvements: Replaced zerolog.Logger{} and zerolog.New(nil) with zerolog.Nop() across all test files for correctness.
• Makefile: Added test-postgres-up and test-postgres-down targets for running local PostgreSQL containers during development.
• Renovate: Added Renovate configuration for automated dependency management.
• Documentation: Fixed markdown formatting across all CLI docs.

Dependency Updates

Major dependency bumps include:

Dependency	Old	New
gatewayd-plugin-sdk	v0.4.3	v0.4.4
OpenTelemetry	v1.37.0	v1.40.0
gRPC	v1.74.2	v1.79.1
jackc/pgx	v5.7.5	v5.8.0
redis/go-redis	v9.12.0	v9.18.0
hashicorp/go-plugin	v1.6.3	v1.7.0
sentry-go	v0.35.0	v0.42.0
protobuf	v1.36.7	v1.36.11
testcontainers-go	v0.38.0	v0.40.0

New dependency: xdg-go/scram v1.2.0 for SCRAM-SHA-256 authentication support.

Full Changelog: v0.10.3...v0.11.0