Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NpgsqlRest/NpgsqlRest
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: efab11b
Choose a base ref
...
head repository: NpgsqlRest/NpgsqlRest
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: b909b4f
Choose a head ref
  • 5 commits
  • 37 files changed
  • 2 contributors

Commits on May 9, 2026

  1. perf: lower-alloc JSON conversion + rendering hardening (3.14.0) 

    Pool StringBuilders in the four PgConverters JSON-conversion routines
(PgArrayToJsonArray, PgCompositeArrayToJsonArray, PgTupleToJsonObject,
PgUnknownToJsonArray). Microbench shows -29% to -50% allocation per call;
GC pressure on array/composite-heavy responses drops by 1-2 MB per
100-row request. Convert Consts.Utf8* byte[] fields to ReadOnlySpan<byte>
u8 properties and collapse the writer CopyTo+GetSpan+Advance pattern to
the writer.Write(ROSpan<byte>) extension at 10 sites.

Hardening: ArrayPool rent/return now in try/finally (was leaked on
parse exception); multi-command mcRowBuilder/mcCompositeBuffer lifted
to method scope so the outer finally cleans them up on throw; proxy_out
MemoryStream now disposed in inner try/finally; silent column-decryption
catches now log at Trace via new Log.DecryptColumnFailed.

Add PgConverterAndWriterBenchmarks micro-benchmark and InternalsVisibleTo
for BenchmarkTests. All 1932 tests pass.

See changelog/v3.14.0.md for the full breakdown including extrapolated
impact on the 2026 benchmark workloads.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
    @vbilopav @claude
    vbilopav and claude committed May 9, 2026
    Configuration menu
    Copy the full SHA
    a2e38f1 View commit details
    Browse the repository at this point in the history

  2. fix: fail-fast non-text claim-bind param + WARN on req-value collision 

    A claim-mapped parameter declared with a known non-text PostgreSQL type
(e.g. `_company_id int` mapped to a `company_id` claim) now throws
ArgumentException at UseNpgsqlRest time instead of crashing every
authenticated request with a misleading `InvalidCastException` from
Npgsql ("Writing values of 'System.String' is not supported for
parameters having NpgsqlDbType 'Integer'"). NpgsqlDbType.Unknown is
allowed — the SqlFileSource path where param types are not inferred and
Npgsql resolves them server-side.

The runtime path also emits a LogLevel.Warning when a request body or
query string supplies a value for a parameter that is auto-bound from
a claim. The claim still wins (preserves security semantics for routines
that key off the caller's identity), but the silent override is now
visible in logs.

5 new tests, 1937/1937 passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
    @vbilopav @claude
    vbilopav and claude committed May 9, 2026
    Configuration menu
    Copy the full SHA
    b2181e2 View commit details
    Browse the repository at this point in the history

  3. feat: SSE @sse_publish/@sse_subscribe split + missed-publish warning 

    Splits the all-in-one @sse annotation into two independent halves so a
routine can be a publisher OR a subscriber without being forced into
both. Fully back-compat — existing @sse keeps both halves.

  @sse_publish    - this routine's RAISE feeds the SSE broadcaster;
                    no subscribe URL exposed (cleans up phantom /info
                    URLs on emitter procedures + drops unused
                    createXEventSource helpers from the TS client).
  @sse_subscribe  - exposes a subscribe URL for EventSource clients;
                    routine body is never executed when a client opens
                    the stream.
  @sse [path]     - shorthand for both; unchanged.

Adds a runtime warning when a RAISE whose severity matches the
configured SSE forwarding level fires in a routine that has no @sse or
@sse_publish — kills the silent-emitter footgun where forgetting the
annotation produces no error and no event delivery. Once-per-endpoint
dedupe; gated on the project actually using SSE somewhere; configurable
via the new WarnUnboundServerSentEventsNotices setting (default true).

Adds a "connected" handshake flush so SSE clients learn the connection
is established before any real event fires — makes "subscribe then
publish" sequencing reliable.

12 new tests including a reusable SseTestClient streaming-HTTP helper
that opens a connection, waits for the broadcaster to register the
subscriber, then reads events. End-to-end live delivery test verifies
RAISE in a publish-only procedure reaches a subscriber connected
through a separate subscribe-only procedure's URL.

1949/1949 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
    @vbilopav @claude
    vbilopav and claude committed May 9, 2026
    Configuration menu
    Copy the full SHA
    6c7ab45 View commit details
    Browse the repository at this point in the history

  4. refactor!: drop CrudSource from the standalone client app 

    Auto-generated CRUD over arbitrary tables and views is a different
product shape from the rest of NpgsqlRest. The project's core promise
is "your PostgreSQL routines become REST endpoints" — explicit,
version-controlled, comment-annotated procedures and functions where
the developer chose what to expose. Auto-CRUD inverts that, so it
no longer belongs in the standalone client's configuration surface.

The plugin itself still ships as a NuGet package and remains fully
functional for embedded use:

  using NpgsqlRest.CrudSource;
  ...
  sources.Add(new CrudSource())

Library consumers see zero change. Only NpgsqlRestClient's JSON-driven
path is affected.

Removed from NpgsqlRestClient:
  - ProjectReference to NpgsqlRest.CrudSource
  - using NpgsqlRest.CrudSource imports + version listing in
    --version and --version --json output
  - App.cs config-driven CrudSource registration block
  - The entire NpgsqlRest:CrudSource block in appsettings.json,
    ConfigTemplate.cs, ConfigDefaults.cs, and the description /
    enum-values entries in ConfigSchemaGenerator.cs

Migration for users who had `"CrudSource": { "Enabled": true }`:
  1. (recommended) Rewrite as PostgreSQL functions/procedures with
     HTTP annotations — explicit per-endpoint auth, validation,
     caching, rate limiting.
  2. Embed the library in a custom host and register CrudSource
     programmatically.

1949/1949 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
    @vbilopav @claude
    vbilopav and claude committed May 9, 2026
    Configuration menu
    Copy the full SHA
    5f537c4 View commit details
    Browse the repository at this point in the history

  5. bump v3.14.0 and harden http retry test

    @vbilopav
    vbilopav committed May 9, 2026
    Configuration menu
    Copy the full SHA
    b909b4f View commit details
    Browse the repository at this point in the history
Loading