Skip to content

0.18.3

Choose a tag to compare

View all tags
@cevheri cevheri released this 11 Oct 15:32
· 208 commits to main since this release
Immutable release. Only release title and notes can be modified.
0.18.3
c23f389

LibreDB Studio 0.18.3 is a patch release.
It adds two read-only connection types, Kubernetes and S3-compatible object storage, taking Studio to twenty-nine external engines, and Test Connection no longer calls a host that never answers a slow query.
The rest is a run of fixes across StarRocks, RisingWave, ScyllaDB, Milvus, Couchbase, Trino, Oracle test data, the Terminate action and the AI schema context from community contributors, a credential mask for query history, and a forty-sixth local model for the agent.
Since 0.18.2 the Helm chart has named the two new engines, S3 in chart 0.1.82 and Kubernetes in 0.1.84.
The image carries no security fix; the chart published one, in chart 0.1.83, which keeps the service account token out of the pod, and the Helm section says who must act.

Kubernetes

A Kubernetes connection reads one cluster over the API server's REST API, with no driver.
The tree shows a Cluster pseudo-container and the namespaces with their kinds, a click on a built-in object opens its YAML, Describe sits on its row menu, and a pod's row also carries Logs.
A click on a pod row shows its last 50 log lines, the way a click on a table previews 50 rows; the pod's YAML stays on the row menu (#1667).
The editor runs one kubectl command per run: get, describe, logs, top pod, top node, events, api-resources, api-versions, explain, auth can-i, auth whoami and version.

It is read-only whatever the connection's read-only box says: no request Studio can send writes, runs a program or opens a stream, and no Secret value reaches any surface, only a Secret's name, type, key count and age.

Connect with the form, or paste a kubeconfig into Import kubeconfig, which reads it in the browser and never sends it to the server.
Credentials are a bearer token, or a client certificate and key, with the cluster's CA.
No credential plugin runs, so an EKS, GKE or AKS context comes in without a credential, and the provider doc shows how to make a ServiceAccount token bound to the view ClusterRole or to the studio-reader ClusterRole it defines.
Studio has no in-cluster identity and never uses the pod's own service account: a connection is its fields and nothing else.
Test Connection runs six self access reviews and names each risky right the identity holds, such as pods/exec, nodes/proxy or listing Secrets, and when a connection with no token or client certificate is refused with 401 or 403, the error names the anonymous request and the missing credential; a pasted kubeconfig context with no usable credential is flagged at import (#1668).
The provider is #1666, and the shared work behind it is #1661, #1663, #1664 and #1659.

S3-compatible object storage

An S3 connection reads buckets and objects over the S3 REST API with no SDK, signing each request with Studio's own SigV4 code and the connection's key pair, or sending it unsigned when both keys are empty.
The tree shows buckets, the Keys panel walks folders one level at a time (#1630, #1633), and an object opens with its metadata and a capped preview of text, JSON or NDJSON, CSV or TSV, Parquet, or hex.
The editor runs one AWS CLI read command per run, such as aws s3 ls, aws s3api list-buckets and aws s3api head-object, or Studio's own preview s3://bucket/key.
It is read-only by construction, because Studio sends only GET and HEAD requests (#1632).
It is verified on MinIO, Silo, Garage and RustFS, and not on AWS S3 or any hosted service (#1654).

Test Connection names a host that never answers

A Kubernetes, Qdrant or InfluxDB host whose connect never completes, such as an address that drops the packets, is now a connection error with HTTP 503: "No answer from : after seconds: check the address, the port and the network path." (#1669).
On any engine, a Test Connection that times out now answers "The connection got no answer after seconds: check the address, the port, the network path and that the server is running." instead of telling a connection test to try a simpler query.

Also in this release

Studio

  • Query history stores the value of a kubectl credential flag, such as --token, as ***, even behind a no-break space, a zero-width character or a typographic dash; a tab keeps what was typed and a saved query what was saved; the embedded workspace writes no history (#1664, #1665, #1666).
  • Terminate on a session row is offered only to an admin, and only where the engine accepts it; MongoDB keeps it through killOp (#1625, closes #1424).
  • Test Connection refuses a Couchbase bucket the cluster does not have, and warns about a missing pinned Trino catalog, instead of reporting success (#1628, closes #1411).

Engines

  • StarRocks: an inline row edit the server refuses to prepare is sent as text, so it saves (#1620, closes #1403).
  • RisingWave: every session turns on implicit flush, so an inline edit is read back (#1626, closes #1399).
  • ScyllaDB: View Source of a materialized view works (#1618, closes #1415).
  • Milvus: a collection with dynamic fields keeps $meta in the default projection and in the searches Studio generates (#1621, closes #1417).
  • Oracle: Generate Test Data writes dates through TO_DATE and TO_TIMESTAMP, and NUMBER values unquoted (#1627, part of #1400).

The agent and AI

  • One more local model is measured for the agent, taking the roster to 46: qwen3.8:27b, which clears all six agent surfaces five times in a row (#1651).
  • AI Describe bounds the schema it sends, the Data Profiler sends only its table, and a request a llama.cpp server refuses as larger than its context ("exceeds the available context size") fails once with a plain sentence instead of being retried (#1579, closes #1422).

Distribution

  • A Portainer app template is published from this repository (#1652).
  • The Railway template and the Fly recipe are pinned to 0.18.2 (#1653, #1636).

Documentation

  • Stale engine counts and one outdated claim are dropped from docs and comments (#1638, #1640, #1641, #1642, #1643, #1644, #1645, #1646, #1647, #1622).
  • The providers README gains its libSQL test-database row, the architecture doc's pointers are fixed, the obsolete 0.16.0 logout note is removed, and the README lists Databend (#1637, #1655, #1657, #1634).

Helm chart: 0.1.85

Tracks app release 0.18.3; no template, value or default moves in this version.
Chart 0.1.82 named S3-compatible object storage, and 0.1.84 Kubernetes, in the description, the keywords and the README.
Chart 0.1.83 is a security fix: it sets automountServiceAccountToken on the pod spec from serviceAccount.automountServiceAccountToken (#1660).
The value used to reach only the ServiceAccount the chart renders, so an install with serviceAccount.create=false mounted the API token of the account it ran as, usually the namespace's default one, into the pod, where anything that reads a file in the container could take it.
Studio reads that token only for Vault Kubernetes auth (VAULT_ROLE), so it now stays out unless the value is true.
An install with create=false that logs in to Vault through the pod's account must set the value to true, or project a token through extraVolumes and extraVolumeMounts and point VAULT_K8S_TOKEN_PATH at it; that is the one action an upgrade from a chart before 0.1.83 (0.1.81 or 0.1.82) may need.
artifacthub.io/containsSecurityUpdates is false for 0.1.85.

helm repo add libredb https://libredb.org/libredb-studio/
helm upgrade --install libredb-studio libredb/libredb-studio --version 0.1.85

Contributors

The Kubernetes and S3-compatible object storage providers, the Test Connection fix, the history mask and the chart fix are by @cevheri.

Full changelog: 0.18.2...0.18.3

Assets 31
Loading