> For the complete documentation index, see [llms.txt](https://docs.prestd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prestd.com/releases/v2.0.0.md).

# v2.0.0

Released: July 7, 2026

[GitHub tag](https://github.com/prest/prest/releases/tag/v2.0.0) · [Download binaries](https://github.com/prest/prest/releases/tag/v2.0.0)

**v2.0.0** is the first stable v2 release. It includes all v2 release-candidate work (rc1–rc6) plus post-rc6 improvements ([#972](https://github.com/prest/prest/pull/972), [#974](https://github.com/prest/prest/pull/974), [#973](https://github.com/prest/prest/pull/973)).

* **Binary:** [v2.0.0 release assets](https://github.com/prest/prest/releases/tag/v2.0.0)
* **Docker:** `prest/prest:v2.0.0`
* **Go install:** `go install github.com/prest/prest/v2/cmd/prestd@v2.0.0`

See the [v2 RC changelog](/releases.md) for the full rc1–rc6 history and [Changes since rc6](/releases/main-since-rc6.md) for detailed notes on #972–#973.

***

## Highlights

### Multi-database ([#973](https://github.com/prest/prest/pull/973))

Route CRUD and custom queries by database alias:

```http
GET /tenant-a/public/users
GET /_QUERIES/tenant-a/myfolder/my_query?field1=foo
```

Configure via `[[databases]]` in TOML or `DATABASE_ALIAS_N` / `DATABASE_URL_N` environment pairs. See the [Multi-database guide](/get-started/multi-database.md).

### Readiness endpoint ([#973](https://github.com/prest/prest/pull/973))

| Endpoint       | Purpose   | Behavior                                              |
| -------------- | --------- | ----------------------------------------------------- |
| `GET /_health` | Liveness  | Pings the default database                            |
| `GET /_ready`  | Readiness | Pings the default database and every registered alias |

Use `/_ready` for Kubernetes readiness probes.

### Configuration resilience ([#974](https://github.com/prest/prest/pull/974))

Startup is never blocked by bad configuration. Invalid or missing settings produce warnings and safe fallbacks instead of fatal exits.

### JWT auto-disable ([#974](https://github.com/prest/prest/pull/974))

When `jwt.default = true` but no verification material is configured (`jwt.key`, `jwt.jwks`, or `jwt.wellknownurl`), JWT middleware is **auto-disabled** with an error log — the server continues to start. When `auth.enabled = true` without `jwt.key`, auth is also auto-disabled. This prevents authentication bypass via an empty HMAC key ([GHSA-fj7v-859r-2fm4](https://github.com/prest/prest/security/advisories/GHSA-fj7v-859r-2fm4)).

> **v2.0.0-rc6 binary:** the [rc6 release](/releases/v2.0.0-rc6.md) **refused to start** in the same situations. See the rc6 page for that historical behavior.

### OR clause filtering ([#958](https://github.com/prest/prest/pull/958))

Combine filter conditions with OR logic using `_or`, without writing custom SQL:

```http
GET /db/public/articles?_or=title=$ilike.%search%||name=$ilike.%search%
```

See [Parameters](/api-reference/parameters.md#or-clause-filtering).

### Per-user permissions ([#912](https://github.com/prest/prest/pull/912))

Fine-grained access control via `[[access.users]]` with per-user table permissions. See [Permissions](/get-started/permissions.md).

### Structured logging ([#950](https://github.com/prest/prest/pull/950), [#972](https://github.com/prest/prest/pull/972))

Structured JSON logging via Go `slog` is configured on every startup. Set `PREST_LOG_LEVEL` to `debug`, `info`, `warn`, or `error`.

### Security hardening (rc3–rc6)

* `_returning` parameter hardened ([#935](https://github.com/prest/prest/pull/935))
* Unified identifier validation ([#938](https://github.com/prest/prest/pull/938), [GHSA-p46v-f2x8-qp98](https://github.com/prest/prest/security/advisories/GHSA-p46v-f2x8-qp98))
* `tsquery` operator hardened ([#940](https://github.com/prest/prest/pull/940))
* Custom query template parameters sanitized ([#972](https://github.com/prest/prest/pull/972))
* Database credentials redacted in error logs via `logsafe` ([#972](https://github.com/prest/prest/pull/972))

***

## Breaking changes and migration notes

| Change                 | v2.0.0 behavior                                                                                           |
| ---------------------- | --------------------------------------------------------------------------------------------------------- |
| `jwt.default` default  | **`false`** — JWT is off unless explicitly enabled (rc6 implied `true`)                                   |
| JWT missing key        | Auto-disabled with error log; server starts (rc6 refused to start)                                        |
| `PREST_SSL_*` env vars | Removed in rc2 — use `PREST_PG_SSL_*` ([#919](https://github.com/prest/prest/pull/919))                   |
| Default `pg.ssl.mode`  | `disable` when no config file found (v1 used `require`)                                                   |
| Multi-database         | Full `[[databases]]` registry support ([#973](https://github.com/prest/prest/pull/973))                   |
| Per-alias permissions  | `access.tables` supports `database` and `schema` fields ([#973](https://github.com/prest/prest/pull/973)) |

Follow the [Upgrading to v2](/get-started/upgrading-to-v2.md) guide when migrating from v1 or rc6.

***

## Documentation links

* [Multi-database guide](/get-started/multi-database.md)
* [Configuring pREST](/get-started/configuring-prest.md)
* [Upgrading to v2](/get-started/upgrading-to-v2.md)
* [Changes since rc6 (detailed)](/releases/main-since-rc6.md)
* [v2.0.0-rc6 release notes](/releases/v2.0.0-rc6.md)