From b531a1c2c157276c0a5ec33d616569a4b253bdf4 Mon Sep 17 00:00:00 2001 From: CJ Brewer Date: Mon, 2 Nov 2026 11:36:51 -0700 Subject: [PATCH 1/3] chore: prepare release v3.0.2 The v3.0.2 GitHub release was cut on a commit whose workspace version was still 3.0.1 and whose CHANGELOG had no 3.0.2 section, so the release workflow's verify-release job failed. Record the version and move the Unreleased notes under a 3.0.2 heading so the tag can be re-cut on this commit. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 5 ++++- Cargo.lock | 6 +++--- Cargo.toml | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 37c446dd..4cc01d5f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [3.0.2] - 2026-11-02 + ### Added - **Connection flags**: `--database-url` sets the database host, port, user, password and name from one PostgreSQL connection string, and `--db-port` (`-P`) and `--db-password` (`-W`) join the existing `--db-*` flags, which override matching parts of the URL. A URL sets only the parts it contains. Connection strings with any other option, such as `sslmode`, or with a Unix socket host or multiple hosts, are rejected, because Proxy cannot apply them. A password on the command line is exposed in shell history and the process list, so prefer `CS_DATABASE__PASSWORD`. @@ -454,7 +456,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - Integration with CipherStash ZeroKMS. - Encrypt Query Language (EQL) for indexing and searching encrypted data. -[Unreleased]: https://github.com/cipherstash/proxy/compare/v3.0.1...HEAD +[Unreleased]: https://github.com/cipherstash/proxy/compare/v3.0.2...HEAD +[3.0.2]: https://github.com/cipherstash/proxy/compare/v3.0.1...v3.0.2 [3.0.1]: https://github.com/cipherstash/proxy/compare/v3.0.0...v3.0.1 [3.0.0]: https://github.com/cipherstash/proxy/compare/v2.2.4...v3.0.0 [2.2.4]: https://github.com/cipherstash/proxy/compare/v2.2.3...v2.2.4 diff --git a/Cargo.lock b/Cargo.lock index b1cbaf2f..1008a458 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -839,7 +839,7 @@ dependencies = [ [[package]] name = "cipherstash-proxy" -version = "3.0.1" +version = "3.0.2" dependencies = [ "arc-swap", "async-trait", @@ -1633,7 +1633,7 @@ dependencies = [ [[package]] name = "eql-mapper-macros" -version = "3.0.1" +version = "3.0.2" dependencies = [ "pretty_assertions", "proc-macro2", @@ -4468,7 +4468,7 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" [[package]] name = "showcase" -version = "3.0.1" +version = "3.0.2" dependencies = [ "cipherstash-client", "cipherstash-config", diff --git a/Cargo.toml b/Cargo.toml index 91d8d148..6aa0b4c4 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,7 +3,7 @@ resolver = "2" members = ["packages/*"] [workspace.package] -version = "3.0.1" +version = "3.0.2" edition = "2021" # Minimum supported Rust version (MSRV). CI builds the production binary on # exactly this toolchain. See "Supported Rust versions" in DEVELOPMENT.md From 10e617ccffc70f7a5f75a44bee09503a1949c6ac Mon Sep 17 00:00:00 2001 From: Toby Hede Date: Tue, 3 Nov 2026 10:41:59 +1100 Subject: [PATCH 2/3] chore: renumber release as v3.1.0 and add announcement The release notes include changes that refuse previously accepted statements and raise the MSRV to 1.89.0, so this is a minor release, not a patch. Publishing it as 3.0.2 would move the floating cipherstash/proxy:3.0 Docker tag onto those changes. --- ANNOUNCEMENT.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++ CHANGELOG.md | 6 +++--- Cargo.lock | 6 +++--- Cargo.toml | 2 +- 4 files changed, 58 insertions(+), 7 deletions(-) create mode 100644 ANNOUNCEMENT.md diff --git a/ANNOUNCEMENT.md b/ANNOUNCEMENT.md new file mode 100644 index 00000000..e8924ad2 --- /dev/null +++ b/ANNOUNCEMENT.md @@ -0,0 +1,51 @@ +# CipherStash Proxy 3.1.0 + +CipherStash Proxy 3.1.0 makes Proxy safer behind connection poolers, closes several paths by which plaintext could reach PostgreSQL, and adds command-line flags for connecting to the database and requiring TLS. + +This release refuses some statements that earlier versions forwarded, so read [Before you upgrade](#before-you-upgrade) first. +The full list of changes is in the [CHANGELOG](https://github.com/cipherstash/proxy/blob/main/CHANGELOG.md#310---2026-11-02). + +## Before you upgrade + +Each of these changes refuses something that 3.0 accepted. +Check that your applications and drivers do not rely on them. + +- **Reserved EQL payload shapes**: on encrypted columns, JSON objects shaped like EQL storage or query payloads are now validated as EQL instead of being encrypted as plaintext, with no opt-out. Audit plaintext writes for these key combinations; [Invalid encrypted value](https://github.com/cipherstash/proxy/blob/main/docs/errors.md#encrypt-invalid-inbound-eql-payload) includes a `jsonb` scan predicate. +- **Settings commands Proxy cannot honour**: a simple query that changes a `CIPHERSTASH.*` setting and then needs encryption, unknown `CIPHERSTASH.*` setting names or values, `SET ALL`, and prepared statements made stale by a settings change are refused. +- **`SET LOCAL CIPHERSTASH.*`** now ends with the transaction instead of lasting for the connection. Use `SET` where a keyset must persist after `COMMIT`. +- **SQL `PREPARE` bound through the extended protocol** is refused with PostgreSQL's `26000` error. Prepare with Parse, or run with SQL `EXECUTE`. +- **Writes Proxy cannot resolve or type check** are refused while encrypted columns are configured, including `MERGE`, SQL `PREPARE` of a write, writes to views, foreign tables and schemas outside the loaded search path, and some bulk `UPDATE` and `INSERT` forms. +- **`COPY ... FROM` into encrypted columns** is refused. Load those columns with `INSERT`. +- **Default keyset**: when a connection selects no keyset, Proxy now uses `CS_DEFAULT_KEYSET_ID` rather than the account default. Verify the two are intended; values written under an unintended account default must be re-encrypted. +- **Building from source** requires Rust 1.89.0 or later. + +The floating `cipherstash/proxy:3.0` Docker tag does not move to this release. +Pin `cipherstash/proxy:3.1` or `cipherstash/proxy:3.1.0` once you are ready. + +## Highlights + +### Safer behind connection poolers + +`DISCARD ALL` and `RESET ALL` now return Proxy's per-connection keyset and mapping settings to their startup values, so a session-mode pooler no longer hands one client's keyset to the next. +`SET LOCAL CIPHERSTASH.KEYSET_ID`, `KEYSET_NAME` and `UNSAFE_DISABLE_MAPPING` give a setting that lasts for one transaction, which is the safe way to select a tenant's keyset behind a transaction-mode pooler. +[Connection poolers](https://github.com/cipherstash/proxy/blob/main/docs/reference/connection-poolers.md) documents which PgBouncer and PgCat versions and pool modes work with Proxy. + +### Fewer paths for plaintext to reach PostgreSQL + +Proxy now refuses writes it cannot type check, `COPY` into encrypted columns, and statements whose encryption results come back short, where it previously forwarded them as written. +Statements after `COPY ... FROM STDIN` in a simple query are now checked and encrypted like any other. + +### Application-generated EQL values + +Applications can send EQL v3 storage payloads and query operands they produced themselves. +Proxy authenticates each ciphertext, checks it names the destination column, and re-derives its search terms before forwarding it. + +### New command-line flags + +`--database-url` sets the database connection from one PostgreSQL connection string, and `--db-port` and `--db-password` join the existing `--db-*` flags. +`--tls` requires TLS from clients, and `--no-tls` forces a plaintext listener. +Run in a terminal, Proxy is now quiet by default and prints its listen address; pass `--debug` for debug logging. + +### Fixes + +This release also fixes query cancellation through Proxy, memory growth on long-lived connections that deallocate with SQL, schema-qualified table names, and the `--db-user` flag, which previously had no effect. diff --git a/CHANGELOG.md b/CHANGELOG.md index 4cc01d5f..46b4edbc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] -## [3.0.2] - 2026-11-02 +## [3.1.0] - 2026-11-02 ### Added @@ -456,8 +456,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). - Integration with CipherStash ZeroKMS. - Encrypt Query Language (EQL) for indexing and searching encrypted data. -[Unreleased]: https://github.com/cipherstash/proxy/compare/v3.0.2...HEAD -[3.0.2]: https://github.com/cipherstash/proxy/compare/v3.0.1...v3.0.2 +[Unreleased]: https://github.com/cipherstash/proxy/compare/v3.1.0...HEAD +[3.1.0]: https://github.com/cipherstash/proxy/compare/v3.0.1...v3.1.0 [3.0.1]: https://github.com/cipherstash/proxy/compare/v3.0.0...v3.0.1 [3.0.0]: https://github.com/cipherstash/proxy/compare/v2.2.4...v3.0.0 [2.2.4]: https://github.com/cipherstash/proxy/compare/v2.2.3...v2.2.4 diff --git a/Cargo.lock b/Cargo.lock index 1008a458..40fae3fe 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -839,7 +839,7 @@ dependencies = [ [[package]] name = "cipherstash-proxy" -version = "3.0.2" +version = "3.1.0" dependencies = [ "arc-swap", "async-trait", @@ -1633,7 +1633,7 @@ dependencies = [ [[package]] name = "eql-mapper-macros" -version = "3.0.2" +version = "3.1.0" dependencies = [ "pretty_assertions", "proc-macro2", @@ -4468,7 +4468,7 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" [[package]] name = "showcase" -version = "3.0.2" +version = "3.1.0" dependencies = [ "cipherstash-client", "cipherstash-config", diff --git a/Cargo.toml b/Cargo.toml index 6aa0b4c4..74664968 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -3,7 +3,7 @@ resolver = "2" members = ["packages/*"] [workspace.package] -version = "3.0.2" +version = "3.1.0" edition = "2021" # Minimum supported Rust version (MSRV). CI builds the production binary on # exactly this toolchain. See "Supported Rust versions" in DEVELOPMENT.md From 60f9f51d2089e7633d4fd25b0964a4d453f5851f Mon Sep 17 00:00:00 2001 From: CJ Brewer Date: Wed, 4 Nov 2026 12:31:09 -0700 Subject: [PATCH 3/3] docs: complete v3.1.0 upgrade notes and set release date Add the refused reads and the require_tls startup failure to the upgrade list, correct the claim that every listed change is a refusal, warn that the latest Docker tag moves to this release, and date the release for today. --- ANNOUNCEMENT.md | 11 +++++++---- CHANGELOG.md | 2 +- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/ANNOUNCEMENT.md b/ANNOUNCEMENT.md index e8924ad2..854cd8f1 100644 --- a/ANNOUNCEMENT.md +++ b/ANNOUNCEMENT.md @@ -3,23 +3,26 @@ CipherStash Proxy 3.1.0 makes Proxy safer behind connection poolers, closes several paths by which plaintext could reach PostgreSQL, and adds command-line flags for connecting to the database and requiring TLS. This release refuses some statements that earlier versions forwarded, so read [Before you upgrade](#before-you-upgrade) first. -The full list of changes is in the [CHANGELOG](https://github.com/cipherstash/proxy/blob/main/CHANGELOG.md#310---2026-11-02). +The full list of changes is in the [CHANGELOG](https://github.com/cipherstash/proxy/blob/main/CHANGELOG.md#310---2026-11-04). ## Before you upgrade -Each of these changes refuses something that 3.0 accepted. -Check that your applications and drivers do not rely on them. +Most of these changes refuse something that 3.0 accepted, and the rest change how Proxy behaves. +Check that your applications and drivers do not rely on the old behaviour. - **Reserved EQL payload shapes**: on encrypted columns, JSON objects shaped like EQL storage or query payloads are now validated as EQL instead of being encrypted as plaintext, with no opt-out. Audit plaintext writes for these key combinations; [Invalid encrypted value](https://github.com/cipherstash/proxy/blob/main/docs/errors.md#encrypt-invalid-inbound-eql-payload) includes a `jsonb` scan predicate. - **Settings commands Proxy cannot honour**: a simple query that changes a `CIPHERSTASH.*` setting and then needs encryption, unknown `CIPHERSTASH.*` setting names or values, `SET ALL`, and prepared statements made stale by a settings change are refused. - **`SET LOCAL CIPHERSTASH.*`** now ends with the transaction instead of lasting for the connection. Use `SET` where a keyset must persist after `COMMIT`. - **SQL `PREPARE` bound through the extended protocol** is refused with PostgreSQL's `26000` error. Prepare with Parse, or run with SQL `EXECUTE`. - **Writes Proxy cannot resolve or type check** are refused while encrypted columns are configured, including `MERGE`, SQL `PREPARE` of a write, writes to views, foreign tables and schemas outside the loaded search path, and some bulk `UPDATE` and `INSERT` forms. +- **Reads an encrypted column cannot support** are refused, including a comparison such as `<` on a column with no ordering index, and `ORDER BY`, `GROUP BY`, `DISTINCT` or `UNION` over a column without the ordering or equality index they need. - **`COPY ... FROM` into encrypted columns** is refused. Load those columns with `INSERT`. - **Default keyset**: when a connection selects no keyset, Proxy now uses `CS_DEFAULT_KEYSET_ID` rather than the account default. Verify the two are intended; values written under an unintended account default must be re-encrypted. +- **`require_tls` without a certificate** now fails at startup. Configure TLS, or unset `CS_SERVER__REQUIRE_TLS`. - **Building from source** requires Rust 1.89.0 or later. -The floating `cipherstash/proxy:3.0` Docker tag does not move to this release. +The floating `cipherstash/proxy:3.0` Docker tag does not move to this release, but `cipherstash/proxy:latest` does. +If you run `latest`, pin `cipherstash/proxy:3.0` until you have made these checks. Pin `cipherstash/proxy:3.1` or `cipherstash/proxy:3.1.0` once you are ready. ## Highlights diff --git a/CHANGELOG.md b/CHANGELOG.md index 46b4edbc..f8f77e68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] -## [3.1.0] - 2026-11-02 +## [3.1.0] - 2026-11-04 ### Added