What stackql/stackql shipped
Written by FoxPlug from the repository's own releases; not affiliated with Stackql. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/stackql/stackql; Stackql did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Added support for session-local provider aliases with explicit credentials, tenancy labels, request defaults and per-provider concurrency controls, with each query executed using a detached credential snapshot. Pull request #886
- Added opt-in endpoint selection through Omni server-variable metadata for SELECT, mutations and EXEC, with consistent precedence from explicit SQL input through environment selector. Pull request #887
- Registry calls now report non-2xx HTTP responses as errors instead of passing the response body to the YAML parser, so a 404 or 500 no longer produces a misleading parse failure. Pull request #889
- Document-registered auth is no longer presented as a runtime
token_urloverride; the document token URL and auth variables are resolved when no explicit auth is supplied, while explicit overrides are preserved. Pull request #894 - Added BUILDPRERELEASESUFFIX to build metadata and reported versions, with suffix selection centralised by branch: none for live or stable, -rc for non-live main, and -alpha for other branches. Pull request #888
- Fixed a Windows crash in the build artifact attachment script that occurred when the script hit a Unicode decode error and then tried to parse a null JSON object. Pull request #897
- Documented the npm trusted publisher setup after the first OIDC publish of the MCP server package failed with a 404 following a successful dry run. Pull request #898
- Committed the version pins for release v1.0.888 that the packaging run stamps only on its runners. Pull request #899
Why it matters
This week adds session-local provider aliases with credentials and concurrency controls, and opt-in endpoint selection for SELECT, mutations and EXEC, giving more control over how queries reach providers. It also makes registry failures report the actual HTTP status rather than a confusing parse error, which helps when a provider name is mistyped or the registry is down. The release tooling and packaging for directory submissions were cleaned up and documented along the way.
Changelog entry
- Support session-local provider aliases with explicit credentials, tenancy labels, request defaults and provider concurrency controls; execute queries with a detached credential snapshot. Pull request #886
- Support opt-in endpoint selection through Omni server-variable metadata for SELECT, mutations and EXEC, with consistent precedence. Pull request #887
- Report non-2xx registry responses as errors instead of parsing the response body. Pull request #889
- Resolve document token URL and auth variables when no --auth is supplied; preserve explicit
token_urloverrides. Pull request #894 - Add BUILDPRERELEASESUFFIX to build metadata and versions, with suffix selection by branch. Pull request #888
- Fix Windows UnicodeDecodeError and null JSON handling in the build artifact attachment script. Pull request #897
- Document npm trusted publisher setup after the first OIDC publish returned 404. Pull request #898
- Commit v1.0.888 version pins for npm, PyPI and plugin manifests. Pull request #899
- Clean up release and directory submission items from v1.0.888. Pull request #901
This week: session-local provider aliases with credentials and concurrency controls, opt-in endpoint selection via server-variable metadata, clearer registry errors on non-2xx responses, and packaging updates for directory submissions. Release v1.0.888 pins and Windows artifact f
Week of October 12, 2026
What shipped
- Fixed the approval gate in safe and
delete_safemodes so a retry is bound to the original action, and support for elicitation is checked before the approval input is read. Pull request #848 - Join queries now discard left-hand-side predicates before sending requests to the source, preventing dependent requests that should not be made. Pull request #846
- Joins now support the snake column alias pattern, with snake case handling moved into any-sdk. Pull request #845
- The PowerShell installer at /install and /install.ps1 now downloads the zip matching the machine's native architecture instead of always using the amd64 build. Pull request #844
- Added unit tests for the sqlrewrite package, which previously had none, including a table-driven test for GenerateRewrittenSelectDML. Pull request #847
Why it matters
This week fixes several behaviour bugs that affect real queries: approval retries in safe modes are now tied to the original prompt, and join requests no longer send predicates that should be filtered locally. Joins also gained support for snake column aliases. Windows ARM64 users get an installer that picks the correct build, and the sqlrewrite package now has test coverage it did not have before.
Changelog entry
- Bind approval retries in safe and
delete_safemodes to the original action and check elicitation support before reading approval input. Pull request #848 - Discard join left-hand-side predicates before source requests to prevent unnecessary dependent requests. Pull request #846
- Support the snake column alias pattern in joins and move snake case handling into any-sdk. Pull request #845
- Make the PowerShell installer choose the zip matching the native architecture, including ARM64. Pull request #844
- Add unit tests for the sqlrewrite package, including a table-driven test for GenerateRewrittenSelectDML. Pull request #847
This week: approval retries in safe modes are bound to the original action, join queries stop sending unnecessary dependent requests, snake case aliases work in joins, the Windows installer picks the ARM64 build on ARM64 machines, and sqlrewrite has unit tests.
This week's changes to the project: the approval gate in safe and delete_safe modes now binds a retry to the original action and checks elicitation support before reading the approval input. Join queries discard left-hand-side predicates before sending requests to the source, so dependent requests that should not be made are avoided. Joins now support the snake column alias pattern, with snake case handling moved into any-sdk. The PowerShell installer served at /install and /install.ps1 now downloads the zip that matches the machine's native architecture rather than always the amd64 build. Unit tests were added for the sqlrewrite package, including a table-driven test for GenerateRewrittenSelectDML.
Week of September 14, 2026
What shipped
- Released v0.11.707-final-cgo with modernc sqlite migration preparation. Release
- Added support for preview omisdk IAC and composable omnisdk exchange queries with new robot tests for dynamic graph functionality. Pull request #764
- Updated CI actions from Node.js 20 to Node.js 24 to reduce runner costs. Pull request #781
- Added retry logic to CI steps for known transient failures in Chocolatey mingw setup and Docker Buildx initialization. Pull request #775
- Unignored npm lockfile to enable Dependabot security updates and pinned ubuntu-latest to ubuntu-24.04. Pull request #772
- Bumped spf13/pflag from 1.0.9 to 1.0.10 with corrected deprecation comments. Pull request #758
- Fixed lint warnings in internal data transfer tests and removed PR_README.md. Pull request #767
Why it matters
This week focuses on infrastructure stability and modernization. Updates to CI workflows reduce costs while adding resilience to transient failures, and Dependabot can now properly track security updates. New IAC and SDK preview features expand functionality.
Changelog entry
- V0.11.707-final-cgo: modernc sqlite migration prep Release
- Preview omisdk IAC support and preview composable omnisdk exchange queries Pull request #764
- Added robot tests for dynamic graph show services and resources Pull request #764
- CI: Bumped Node.js 20-deprecated actions to Node.js 24 Pull request #781
- CI: Added retry logic for Chocolatey mingw and Docker Buildx setup Pull request #775
- Unignored npm lockfile for Dependabot security updates Pull request #772
- Pinned ubuntu-latest to ubuntu-24.04 Pull request #772
- Bumped spf13/pflag from 1.0.9 to 1.0.10 Pull request #758
- Fixed lint warnings in internal data transfer tests Pull request #767
V0.11.707-final-cgo ships with sqlite migration prep. CI gets Node.js 24 upgrades, retry logic for flaky steps, and better Dependabot coverage. Preview omisdk IAC and omnisdk exchange queries now available.
Stackql v0.11.707-final-cgo released with modernc sqlite migration preparation. Infrastructure improvements include Node.js 24 action upgrades to reduce runner costs, retry logic for transient CI failures, and fixed Dependabot coverage. Preview support added for omisdk IAC and composable omnisdk exchange queries with new dynamic graph tests.
More from stackql/stackql on GitHub
Merged pull requests
- submission-hygiene (#901, merged November 5, 2026 by jeffreyaven) (source)
- pins-1.0.888 (#899, merged November 5, 2026 by jeffreyaven) (source)
- release-doc-npm-trusted-publisher (#898, merged November 5, 2026 by jeffreyaven) (source)
- attach-artifacts-utf8 (#897, merged November 5, 2026 by jeffreyaven) (source)
- plugin-submissions (#896, merged November 5, 2026 by jeffreyaven) (source)
- multiple-fixes (#894, merged November 4, 2026 by general-kroll-4-life) (source)
- fix(registry): report non-2xx registry responses instead of parsing the body (#889, merged November 3, 2026 by pcbeingused333) (source)
- prerelease-policy-and-dead-code-cleanup (#888, merged November 3, 2026 by general-kroll-4-life) (source)
- server-variable-selectors (#887, merged November 2, 2026 by general-kroll-4-life) (source)
- provider-sessions-secrets-and-variables (#886, merged November 2, 2026 by general-kroll-4-life) (source)
- iam-iac (#879, merged October 31, 2026 by general-kroll-4-life) (source)
- npm-trusted-publishing (#880, merged October 31, 2026 by jeffreyaven) (source)
Releases
- v1.0.888, published November 5, 2026. First change listed: Booleans served through the XML transform are no longer typed as integers (#877). (source)
- v0.12.824, published October 22, 2026. First change listed: MCP Security: Hardened approval workflows with cryptographically signed, time-limited request state, preventing unsolicited, modified, expired, or replayed approvals. [#848](https… (source)
- v0.12.778, published October 11, 2026. First change listed: contributors: refresh leaderboard by @github-actions[bot] (source)
- v0.12.732, published September 30, 2026. First change listed: doc updates by @jeffreyaven in #792 (source)
- v0.12.718, published September 22, 2026. First change listed: fix lint: satisfy nilnil in internaldto tests; drop PRREADME.md (source)
- v0.11.669, published September 8, 2026. First change listed: mirror-publish-git-ident (source)
From the README
- [logo]: https://stackql.io/img/stackql-logo-bold.png "stackql logo" [homepage]: https://stackql.io/ [docs]: https://stackql.io/docs [blog]: https://stackql.io/blog [registry]: https://github.com/stackql/stackql-provider-registry [variables]: https://stackql.io/docs/getting-started/variables [macpkg]: https://storage.googleapis.com/stackql-public-releases/latest/stackqldarwinmultiarch.pkg… (source)