Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

v2.0.0

Released: July 7, 2026

GitHub tag · Download binaries

v2.0.0 is the first stable v2 release. It includes all v2 release-candidate work (rc1–rc6) plus post-rc6 improvements (#972, #974, #973).

  • Binary: v2.0.0 release assets

  • Docker: prest/prest:v2.0.0

  • Go install: go install github.com/prest/prest/v2/cmd/prestd@v2.0.0

See the v2 RC changelog for the full rc1–rc6 history and Changes since rc6 for detailed notes on #972–#973.

Highlights

Multi-database (#973)

Route CRUD and custom queries by database alias:

GET /tenant-a/public/users
GET /_QUERIES/tenant-a/myfolder/my_query?field1=foo

Configure via [[databases]] in TOML or DATABASE_ALIAS_N / DATABASE_URL_N environment pairs. See the Multi-database guide.

Readiness endpoint (#973)

Endpoint
Purpose
Behavior

GET /_health

Liveness

Pings the default database

GET /_ready

Readiness

Pings the default database and every registered alias

Use /_ready for Kubernetes readiness probes.

Configuration resilience (#974)

Startup is never blocked by bad configuration. Invalid or missing settings produce warnings and safe fallbacks instead of fatal exits.

JWT auto-disable (#974)

When jwt.default = true but no verification material is configured (jwt.key, jwt.jwks, or jwt.wellknownurl), JWT middleware is auto-disabled with an error log — the server continues to start. When auth.enabled = true without jwt.key, auth is also auto-disabled. This prevents authentication bypass via an empty HMAC key (GHSA-fj7v-859r-2fm4).

v2.0.0-rc6 binary: the rc6 release refused to start in the same situations. See the rc6 page for that historical behavior.

OR clause filtering (#958)

Combine filter conditions with OR logic using _or, without writing custom SQL:

See Parameters.

Per-user permissions (#912)

Fine-grained access control via [[access.users]] with per-user table permissions. See Permissions.

Structured logging (#950, #972)

Structured JSON logging via Go slog is configured on every startup. Set PREST_LOG_LEVEL to debug, info, warn, or error.

Security hardening (rc3–rc6)

  • _returning parameter hardened (#935)

  • Unified identifier validation (#938, GHSA-p46v-f2x8-qp98)

  • tsquery operator hardened (#940)

  • Custom query template parameters sanitized (#972)

  • Database credentials redacted in error logs via logsafe (#972)

Breaking changes and migration notes

Change
v2.0.0 behavior

jwt.default default

false — JWT is off unless explicitly enabled (rc6 implied true)

JWT missing key

Auto-disabled with error log; server starts (rc6 refused to start)

PREST_SSL_* env vars

Removed in rc2 — use PREST_PG_SSL_* (#919)

Default pg.ssl.mode

disable when no config file found (v1 used require)

Multi-database

Full [[databases]] registry support (#973)

Per-alias permissions

access.tables supports database and schema fields (#973)

Follow the Upgrading to v2 guide when migrating from v1 or rc6.

Documentation links

Previousv2.1.0NextChanges since rc6 (in v2.0.0)

Last updated