Skip to main content
interlace
Plugin: pg

Changelog

Release history and version updates for eslint-plugin-postgresql-security

Generated from the release history

Built from this package's CHANGELOG.md at deploy time, so it matches the version these docs describe. The full cross-package history lives on the changelog.

2.3.4

  • Fixno-missing-client-release and prefer-pool-query now expose their CWE at meta.docs.cwe, so every formatter renders it.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.2

2.3.3

  • FixString.raw statements survive the parser bump
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.1

2.3.2

  • Fixpool['connect']() checks out the same client
  • Fixthis['pool'] and db['query'] name the same pool and statement
  • Fixc['release']() is the same client release
  • Fixa quoted object key resolves like a bare one
  • Maintenancepool-field tracking records the name its guard accepted
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.19.0

2.3.1

  • FixAdd an install-size badge to the README prelude, linking to each package's packagephobia page. npm renders the README from the last publish, so a badge only appears on npmjs.com after a release.
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.2

2.3.0

  • Feature🐛 Fix — a template literal is a string, in 82 rules that disagreed
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.18.0

2.2.1

  • Fixpoint meta.docs.url at documentation that exists #683
  • Dependenciesupdated workspace dependencies: @interlace/eslint-devkit@1.17.2

2.2.0

  • Rules decide by evidence, and every vocabulary is now an option #574
  • DependenciesUpdated internal dependencies

2.1.0

  • Presets now emit rule ids prefixed with the package's own name, so registering #531

2.0.0

  • Every rule now abstains in files without local PostgreSQL evidence #479
  • Close two false-negative classes across every SDK-evidence gate #494
  • Fix a false negative: require shadowing is now lexical, not file-wide #483
  • DependenciesUpdated internal dependencies

1.5.3

  • Correct the declared ESLint floor: ^8.0.0 → ^8.40.0. #407
  • Test infrastructure only — no rule, config, or API behavior changes. These #329
  • Correct the ESLint peer range shown in the README Compatibility table. #423
  • Remove the superseded eslint-plugin-pg and eslint-plugin-jwt sources from #414
  • DependenciesUpdated internal dependencies

1.5.2

  • Ship the JavaScript without tsc's layout. #411
  • DependenciesUpdated internal dependencies

1.5.1

  • Complete the logo row across every published package. #377
  • Fix the ./oxlint subpath export, which pointed at src/oxlint.js — a file no build produces. require('<package>/oxlint') threw MODULE_NOT_FOUND on every published package, while every README documented that exact wiring for oxlint's jsPlugins. The export now points at the build output, dist/src/oxlint.js. #335
  • DependenciesUpdated internal dependencies

1.4.2

  • align codecov component names and update docs components
  • Ofri Peretz

0.0.1

  • Initial release with 13 rules for PostgreSQL security and best practices
  • no-unsafe-query - Prevents SQL injection via string interpolation
  • no-insecure-ssl - Prevents disabling SSL certificate validation
  • no-hardcoded-credentials - Prevents hardcoded passwords in config
  • no-unsafe-search-path - Prevents dynamic search_path hijacking
  • no-unsafe-copy-from - Prevents COPY FROM file path exposure
  • no-transaction-on-pool - Prevents transaction commands on pool
  • no-missing-client-release - Ensures pool clients are released
  • prevent-double-release - Prevents double client.release()
  • no-floating-query - Ensures query promises are handled
  • check-query-params - Validates parameter count matches placeholders
  • no-select-all - Discourages SELECT \*
  • prefer-pool-query - Suggests pool.query() for simple queries
  • no-batch-insert-loop - Prevents N+1 mutation queries
  • recommended - Balanced security and quality settings
  • strict - All rules as errors
  • Full documentation for all 13 rules
  • AGENTS.md for AI assistant integration
  • Benchmark folder for capability demonstration

2.3.5

  • FixThe README logo now links to the plugin's own documentation.

1.4.9

  • Rewrite description and keywords on every published package for npm search discovery. npm ranks on name, description, and keywords, and the registry only picks up these fields at publish — so this is metadata-only and takes effect for each package on its next release. #294
  • DependenciesUpdated internal dependencies

1.4.8

  • Docsdocs: dual-logo README header (Interlace mark + ESLint mark side by side) and closing Interlace footer — refreshes the README rendered on npmjs.com. No runtime changes. #269
  • DependenciesUpdated internal dependencies

1.4.7

  • Fix Codecov badge showing "unknown" — switch from flag to component URL format #252

1.4.6

  • CI-only: pin all coverage thresholds at 100% (integration target, merges last). #225

1.4.5

  • Align every security rule's meta.docs.cvss to the CVSS its finding actually #213

1.4.4

  • Fixfix(no-missing-null-checks): eliminate 53 false positives via three new narrowing patterns #143
  • DependenciesUpdated internal dependencies
  • align codecov component IDs with full package names
  • resolve all benchmark FN/FP across security rules
  • fix changelog header format across all packages
  • Ofri Peretz

View on GitHub →

Building secure JavaScript with Interlace? Star the repo to get new rules and CWE coverage as we ship them — or follow the AI-code-security benchmarks behind them.

Follow the benchmarksStar on GitHub

eslint-plugin-postgresql-security

PostgreSQL security and best practices for the pg driver

Rules

All ESLint security rules provided by eslint-plugin-postgresql-security