v3.0.0

3.0.0 (2026-07-31)

• feat(operator)!: make addRole() required on IDatabaseInstance (96e0a1b)

Bug Fixes

• cli: check every attribute DatabaseRole adoption resets (c3e73a6)
• cli: parse migrate pre-flight query output as JSON (0d3c16f)
• operator/cnpg: reject addRole() for the database owner (b9a58b5)
• operator/cnpg: reject role names claimed twice on one cluster (368e377)
• operator/cnpg: serialize grant Jobs within a database (8fab68f)
• operator/grants: grant sequences back for write grants (e632390)
• operator/grants: render sequence grants and revokes from one constant (24c7bb2)
• operator/mariadb: keep Grant CR names distinct after sanitizing (073861d)
• operator/mariadb: key addRole() names on the user@host account (2228cdf)
• operator/mariadb: merge grants targeting the same table (dfdd296)
• operator/mariadb: reject account identities claimed twice on one instance (5eb7966)
• operator/mariadb: reject config.owner, name Grant CRs by table (a38e201)
• operator/mariadb: resolve a blank host to the operator's default (cf37aa1)
• operator/mariadb: validate grant privileges (dd72666)
• operator/neo4j: reject usernames claimed twice on one deployment (6c935e1)
• operator/neo4j: sanitize role names used as label values (52a7f20)
• operator/neo4j: set a provisioned user's password unconditionally (ffe3c70)
• operator: bound derived resource names to the limits Kubernetes enforces (10fc918)
• operator: close dollar-quote injection and revoke-scan gaps in grant compiler (e380e30)
• operator: keep addRole() resource names distinct after sanitizing (ab61208)
• operator: make credentials username optional, readonly dependsOn (7e0b231)
• operator: make encoded and unchanged role identities disjoint (057c8fc)
• operator: percent-encode connection URI components on all backends (f675caa)
• operator: reject blank role and database names (20702fa)
• operator: reject engineOptions blocks the running engine cannot honour (1a027c6)
• operator: rename misleading test, use ERROR_CODES constant (5100461)
• operator: scope grant Job checksum to full resource identity (b9c8a51)
• operator: validate grants before claiming the account name (cab33ec)
• operator: validate role names and reject Neo4j environments (6087a29)

Features

• cli: add read-only migrate pre-flight command (638ca70)
• operator/cnpg: add addRole() and reimplement createDatabase on it (c67bfb2)
• operator/cnpg: replace psql bootstrap Job with Database/DatabaseRole CRDs (682a950)
• operator/mariadb: add addRole() and reimplement createDatabase on it (399de49)
• operator/neo4j: add addRole() and stop swallowing GRANT ROLE failures (c850c42)
• operator: add PostgreSQL grant reconciliation job (e329498)
• operator: add PostgreSQL grant SQL compiler (59cdfa0)
• operator: add role interfaces and config defaults (0a8d4d2)

BREAKING CHANGES

• IDatabaseInstance.addRole() is required. Only code that
  implements the interface is affected — realistically test mocks and hand-rolled
  fakes; every call site gets strictly better types.