v0.3.3

Changelog

• 0b7a374 fix(npm): publish wrapper as @pgbot/cli (bare name blocked by npm)

v0.3.2

Changelog

• f55aad3 docs(changelog): cut 0.3.2 — re-cut of 0.3.1 to land npm (token fix)

v0.3.1

Changelog

• 7970738 ci(release): post-release smoke — image is public + signature verifies
• ed30d8d collect: report the server's config and real client load, not pgbot's own (PR#1)
• 006fad7 collect: side-effect + accuracy fixes to the read path (PR#1)
• 0996787 docs(changelog): cut 0.3.1 — PR#1 self-observation fixes + npm live
• 23e8b1d docs(readme): docker -e DATABASE_URL form + multi-arch/public note
• 67b810f docs(readme): docker run against a remote/managed DB, the secure way
• 51f0a74 docs(readme): show $DATABASE_URL env-var usage in the top quickstart
• 7df26c7 findings/vacuum/render: signal-quality fixes (PR#1)
• a7fab94 test(collect): self-observation gates in the full-pipeline integration test (PR#1)

v0.3.0

Changelog

• 76a950e docs(readme): a "Point pgbot at your database" section
• f73277f feat(D1): npm distribution — npx pgbot with no prior install
• 4aee619 feat(D3-0): classify every finding by Scope + split int4_identity_column
• 34c2360 feat(D3-1): --profile=schema + pgbot lint
• 5e0db08 feat(D3-2): --fail-on-new — act only on findings a change introduced
• c2e8fd6 feat(D3-3): wire the schema profile into the Action + document the two-job pattern
• 51f4506 fix(action): default version 'latest' 404'd on the install path
• 0d02610 fix(action): only pass --profile/--fail-on-new when used (older-binary compat)
• 3e48934 release: cosign --bundle + README usage pass, prep 0.3.0

v0.2.1

Changelog

• d8eea07 fix: exclude ALL of pgbot's own backends from pg_stat_activity findings
• ca2be0d fix: idle_in_transaction no longer counts pgbot's own pool connections

v0.2.0

Changelog

• ebf0696 build: local gate that builds HEAD (not the working tree)
• 839f3bd chore(R-2): golangci-lint clean — remove dead code, add lint config
• 7007d01 ci(R-2/R-3): gate on gofmt/-race/golangci-lint/govulncheck; Windows + SBOM
• 7e91ad2 docs(B1): make the reject-any-semicolon security choice explicit
• 733e390 docs(B2): configuration.md + README suppression section
• ee72f45 docs(B7-0): factual fixes in the two exemplars
• 62c913e docs(B7-0): findings-catalogue template + two exemplars + drift guard
• 8322940 docs(B7-1): complete the findings catalogue — 55 pages + drift guards
• 0b2a238 docs(R-1): README audit — exit codes, Windows archive, claims re-verified
• 54c3221 docs(R-5/R-6): version-support statement + community files
• 4c7d89c docs(changelog): cut 0.2.0 — fingerprint upgrade note + self-disclosed fixes
• 15474ab feat(A15): WAL archiving / PITR findings (archiving_failing/stalled/disabled)
• 09aad81 feat(A15-0): recovery-state probe + primary/standby + managed-provider gating
• a599aff feat(A16): checksum failures + corruption-detection findings
• 2b8bc8a feat(A17): failover readiness — sync_rep_degraded, time lag, disconnect, conflicts
• 1952840 feat(A18): stale_statistics + never_analyzed — the cause behind query_slowdown
• 31413fe feat(A19): is autovacuum keeping up? (5 findings)
• 5352c08 feat(B1): advisor caveat layer — confidence, stale-stats refusal, write-amp, size
• dad56f2 feat(B1): evidential index advisor — deterministic candidates, hypopg-validated
• 159ca9e feat(B2): per-object suppression for aggregate findings
• 9b11ea2 feat(B2-0): stable, human-writable Object identity on every finding
• 411ca27 feat(B2-1): .pgbot.toml discovery, parsing, validation, credential refusal
• 99a6870 feat(B2-2): apply suppression — visible, exit-code-safe, criticals never hidden
• 3a93cc7 feat(B2-3): suppressions rot — expiry notice + dead-rule detection
• 2f5ac2f feat(B2-4): config ergonomics — check, explain, init
• 9124b52 feat(B3): --all-databases — inspect the whole cluster, cluster findings once
• e3eeff4 feat(B4): pgbot diff — compare two baseline snapshots, honestly
• 39401e7 feat(B5-1/B5-2): --fail-on + SARIF/JUnit report formats
• 3edebbc feat(B5-3): GitHub Action — pgbot health check → Security tab
• d075d77 feat(B6): --format=prometheus — node_exporter textfile output
• 163bbe6 feat(B7-2): JSON Schema generated from the model, drift-guarded in CI
• 12ea591 feat(B7-3): wire the catalogue — offline explain-finding + report references
• 4044f41 feat(B8): four MCP tools — explain_plan, compare_to_baseline, schema_of, explain_finding
• 582450e feat(P1-A1): vacuum_horizon_blocked — name why dead tuples aren't reclaimed
• 0b1c06e feat(P1-A10): partition rollup + partition_seq_scan_heavy
• d02a5de feat(P1-A11): pg_stat_progress_* — in-flight operation truth
• 5a3f58e feat(P1-A12): low_hot_update_ratio
• 6ebd16c feat(P1-A13): connection breakdown in connection_saturation
• 4953d12 feat(P1-A14): WAL directory size (pg_ls_waldir), paired into slot finding
• adbf086 feat(P1-A2): multixact wraparound (mxid_wraparound)
• 5008bc1 feat(P1-A3): prepared_xact_abandoned
• e0b3e57 feat(P1-A4): pg_stat_statements saturation (pgss_entries_evicted)
• c0ec34a feat(P1-A5): io_timing_off — flag track_io_timing disabled
• 5fa2064 feat(P1-A6): redundant_indexes — prefix-contained / duplicate indexes
• e17a10b feat(P1-A7): fk_unindexed — foreign keys with no supporting index
• 6934d05 feat(P1-A8): sequence_exhaustion
• 661a4a0 feat(P1-A9): config sanity findings + ServerInfo.Provider
• acd5584 feat(R-4): exit-code precision — usage errors get their own code
• c9b8c38 feat: Claude Code plugin — pgbot MCP + skill + /pg-* commands
• 178ed6e feat: skill installer + pgbot.dev/skill one-liner
• 1bcefe4 fix(A6): redundant_indexes — covering index must also be non-partial/expression
• 522f46d fix(P0-1): per-database baseline fingerprint (was cluster-wide)
• 67378c8 fix(P0-2): ScrubQueryText emits the redaction marker (was deleting it)
• 783fe58 fix(P0-3): SIGINT/SIGTERM cancels the run instead of killing it mid-flight
• 73fd2fe fix(P0-4): installer verifies the cosign signature it advertises
• d4079a3 fix(P0-5): multi-arch container image + real CA roots
• 0b2ff87 fix(R-2): patch all govulncheck findings — pgx SQL-injection CVE + toolchain
• 18dd3a2 fix(ci): TCP readiness check to avoid postgres initdb-phase race
• 1cc5746 fix(ci): static-check excludes its own EXPLAIN-ANALYZE guard file
• fc60faf fix: commit the computeFindings(c, f) call-site updates (B2-3)
• db7c8d6 fix: scrub pg_stat_statements text — pgss stores utility statements verbatim
• 084539a harden: correct the "pgss text is normalized/safe" invariant + name the leak class
• c0c136b style: gofmt -w the tree
• 312af62 test(B1): prove READ ONLY blocks a ;-injected write in the advisor
• 249efa6 test(B7): executable guard runs every verify query against real Postgres

v0.1.6

Changelog

• 72484b5 feat: pgbot tables — largest tables + row counts + scan pattern

v0.1.5

Changelog

• 44243f5 feat: OpenAI support for explain/ask (provider-agnostic AI layer)
• 9bbf212 fix: accept --timeout on queries/vacuum/indexes (matches inspect)

v0.1.4

Changelog

• b42f302 feat: MCP tools top_queries and vacuum_health
• 4d73251 feat: pgbot queries — top pg_stat_statements by total time (--by-calls)
• a72ae9d feat: pgbot vacuum — autovacuum health per table, with computed "due?"
• 27b1ede feat: replication-slot WAL-retention + logical-subscription health findings

v0.1.3

Changelog

• fcadc29 feat: config-tuning findings + pgbot tune (deterministic, from the workload)