Releases

Latest v2 release: v2.4.2 — RFC 7518 minimum key sizes for HMAC jwt.key (#1017), bound values for custom query scripts with credential headers withheld from templates, and SQL removed from logs (#1023).

For stable v1 releases, see GitHub Releases.

Unreleased (main)

Nothing merged after v2.4.2 yet. See Changes since v2.4.2.

v2.4.2 highlights

Area	Change
JWT	HMAC jwt.key minimums (32/48/64 bytes); short keys are discarded and auth disables itself (#1017)
JWT	jwt.algo enforced as the sole permitted signature algorithm (#1017)
Custom queries	Bind values with sqlVal / sqlList / ident; rejected interpolated values now fail with 400 (#1023)
Custom queries	Credential headers withheld from templates; script path traversal rejected (#1023)
Logging	Script SQL no longer logged; CRUD parameter values replaced by a count (#1023)

See v2.4.2 release notes. Check jwt.key length before upgrading — a short key leaves the API unauthenticated rather than refusing to start.

v2.4.1 highlights

Area	Change
MCP	/_mcp honours [expose], closing a catalog-discovery bypass (#1016)
Custom queries	SQL-keyword screen on interpolated script values (#1016) — too broad, relaxed in v2.4.2

See v2.4.1 release notes and Changes since v2.4.0. Upgrade past v2.4.1 to v2.4.2.

v2.4.0 highlights

Area	Change
Observability	Opt-in OpenTelemetry traces/metrics/logs, local SigNoz dev stack (#1003)
Vector search	pgvector KNN ordering (_korder) and distance filtering (:vecdist) (#1011)
pREST Studio	Dependency upgrade — auth-dialog and tool-invocation fixes (#1004)

See v2.4.0 release notes and Changes since v2.3.0.

_korder / :vecdist and the [otel] section landed in v2.4.0 and are unchanged in v2.4.1 and v2.4.2.

v2.3.0 highlights

Area	Change
Security	Unauthenticated _select SQL-injection fixed — CVSS 9.8 (GHSA-qvx3-q8vx-9q3c, #1002)
Multi-adapter	Adapter registry, automatic Postgres/TimescaleDB detection, path-based routing (#999)
JWKS hardening	jwx/v3 — non-2xx rejection, 1 MiB body cap, URL redaction in logs (#1002)

See v2.3.0 release notes. Upgrade from v2.2.0 as soon as possible for the security fix.

v2.2.0 highlights

Area	Change
pREST Studio	Embedded UI at /_studio/ — Data / REST / MCP explorers (#990)
Custom queries	Optional database storage, registry API, query ACL (#980)
TimescaleDB	E2E certification on the native PostgreSQL adapter (#988)
Config sample	Fully documented prest.sample.toml (#978)

See v2.2.0 release notes, Changes since v2.1.0, and pREST Studio.

v2.1.0 highlights

Area	Change
MCP over HTTP	Read-only /_mcp endpoint with JSON-RPC initialize, tools/list, and tools/call (#977)
Schema-aware tools	Per-table prest.select.{database}.{schema}.{table} tools with typed input schemas from catalog metadata
Safety	Read-only by design; inherits auth, ACL, and identifier validation from the existing HTTP stack

See v2.1.0 release notes, the MCP over HTTP guide, and AI and MCP (Cursor / Claude Desktop / adapter install) for usage and upgrade notes.

v2.0.0 highlights

Area	Change
Multi-database	[[databases]] registry, alias routing, /_ready (#973)
Config resilience	Graceful fallbacks; startup never blocked by bad config (#974)
JWT	Auto-disable when misconfigured; jwt.default defaults to false (#974)
Security	Template sanitization, credential redaction in logs (#972)
OR filtering	_or query parameter (#958)
Permissions	Per-user table permissions (#912)

See v2.0.0 release notes and Changes since rc6 for full details.

Release candidate history (rc1 – rc6)

The v2 release candidates shipped the following before v2.0.0 was tagged.

Features

Version	Change
rc1	Per-user table permissions via [[access.users]] (#912)
rc6	OR clause filtering with the _or query parameter (#958)
rc6	Structured JSON logging via Go slog (#950)
rc6	Docker images built with GoReleaser (#953)

Security

Version	Change
rc3	_returning parameter hardened against SQL injection (#935)
rc4	Unified identifier validation across templates, groupby, and path params (#938, GHSA-p46v-f2x8-qp98)
rc5	tsquery operator hardened against SQL injection (#940)
rc6	JWT auth bypass fixed when default enforcement runs without a key (#960, GHSA-fj7v-859r-2fm4)

Config and breaking changes

Version	Change
rc2	Deprecated PREST_SSL_* environment variables and [ssl] TOML block removed — use PREST_PG_SSL_* / [pg.ssl] (#919)
rc2	Default pg.ssl.mode is disable when no config file is found (v1 used require)
rc6	Server refuses to start when JWT is enabled without verification material (unless debug mode is on)

Fixes

Version	Change
rc2	Default cache storage path set when caching is disabled (#918)
rc6	_select field names are whitespace-trimmed after comma splitting (#941)
rc6	Identifier formatting fix (#955)

Upgrading

If you are moving from v1 to v2, see the Upgrading to v2 guide.