database: v1.44.0

1.44.0 (2026-10-24)

Features

• ci: restore CodeQL and add a security review cadence (#6456) (10d839a)
• devbox: separate runner trust pools and add an observable drain (#6450) (64401ab)
• sdk: offload saturated resource runs to trusted devbox runners (#6454) (59bce45)

Bug Fixes

• auth: add per-account MFA verification limits (95205fe)
• auth: add per-account MFA verification limits (#6555) (b4d67f0)
• auth: grant MFA hook caller schema usage (c324497)
• auth: reserve MFA attempts atomically and restrict the hook (0c945d5)
• calendar: bind provider OAuth state to user and workspace (#6520) (f1685c6)
• calendar: DB-backed single-use OAuth state and BASE_URL redirects (4f203fe)
• ci: never let a dispatch input select code in a privileged cache scope (ff48a7a)
• database: date calendar OAuth nonce migration in the past (16e8f57)
• database: enforce trusted definer search paths across exposed schemas (04efff7)
• database: harden remaining legacy chat read policies (497d419)
• database: narrow notification cleanup and extend access tests (9b223b5)
• database: preserve atomic lifecycle metadata replacement (94b5e42)
• database: preserve server task access and exercise storage catalog (e206f1d)
• database: repair hardened file operation tests (a457fda)
• database: restrict internal definer functions and add caller checks (cda8a16)
• database: restrict internal definer functions and add caller checks (#6557) (0c665ae)
• database: scope email helper to the current caller (cf7f104)
• database: scope email helper to the current caller (#6550) (f261aa0)
• database: scope list-less tasks to their creator (bfb22e1)
• database: tighten notification email access (4b4e13b)
• database: tighten notification email access (#6552) (d9161cc)
• database: verify final definer callers and server chat boundary (7a6dcf6)
• devbox: cancel lost offload creates by key and page logs by run cursor (aace86b)
• devbox: fence keyed creates and enforce the commit-run protocol server-side (d0dd8c6)
• devbox: roll out the run log cursor without a long table lock (6b6b09e)
• security: fence temporary types and preserve managed definers (83623b2)
• security: harden database file operations (2d41f91)
• security: harden database file operations (#6527) (521de7c)
• security: harden guest and challenge password verification (#6556) (81253df)
• security: limit password attempts and enforce challenge grants (a15d80f)
• security: reserve password attempts and close guest view grants (7c1088c)