# v2.0.0 — Major Release: Audit Logging, Breaking Schema Parity, and Cross-Server Feature Completeness

## Highlights

- 🔒 **Audit Logging & DDL Backup Snapshots** — Full JSONL audit trail with rotation, OAuth identity capture, and pre-mutation DDL snapshots for destructive operations
- ⚡ **5 New Core Convenience Tools** — `sqlite_upsert`, `sqlite_batch_insert`, `sqlite_count`, `sqlite_exists`, `sqlite_truncate` for postgres-mcp parity
- 🔍 **Anomaly Detection Suite** — 3 new stats tools: detect anomalies (z-score), detect bloat (fragmentation scoring), detect schema risks (missing FK indexes, wide tables)
- 🛡️ **JSON Security Scan** — Scans JSON columns for sensitive keys, SQL injection patterns, and XSS attack vectors
- 💥 **6 Breaking Changes** — Transaction group split, vector/text output schema standardization, migration parameter rename, default behavior changes (see below)

## ⚠️ Breaking Changes

- **Transaction Group Split**: 8 transaction tools moved from `admin` → dedicated `transactions` group. OAuth scope changed from `admin` to `write`.
- **Text `original` field removed**: 6 text tools no longer return the `original` string field in responses.
- **Vector output schema**: `sqlite.vector.search` returns `rows` (was `results`); `sqlite.vector.distance` returns `distance` (was `value`).
- **Query pagination default**: Unbounded SELECT safety limit lowered from 1000 → 50 rows.
- **Phonetic `includeRowData` default**: Changed from `true` to `false`.
- **Migration SQL property**: Standardized to `migrationSql` (was `sql`).

## Added

- **Audit Logging** — JSONL audit trail with async-buffered writes, 10MB log rotation (5-file cascade), `sqlite://audit` resource, OAuth identity capture
- **DDL Backup Snapshots** — Pre-mutation DDL capture for DROP/import/backup operations with gzip compression and retention policies
- **Token Burn-Rate** — `_meta.tokenEstimate` on every tool response for agent token awareness
- **Convenience Tools** — 5 core tools (`upsert`, `batch_insert`, `count`, `exists`, `truncate`)
- **Anomaly Detection** — `sqlite_stats_detect_anomalies`, `sqlite_stats_detect_bloat`, `sqlite_stats_detect_schema_risks`
- **JSON Security Scan** — `sqlite_json_security_scan` with SQL injection, XSS, and sensitive key detection
- **Text Sentiment** — `sqlite_text_sentiment` keyword-based analysis
- **FTS5 Headline** — `sqlite_fts_headline` highlighted search snippets (native only)
- **Introspection Resources** — `sqlite://compile_options` and `sqlite://pragma`
- **Initialization SQL** — `initializationSql` config for per-connection session setup
- **Progress Notifications** — MCP progress events for backup, migration, and analysis operations
- **Test Coverage Milestone** — 90.34% coverage with comprehensive new test suites

## Security

- **SLSA Build L3** — `--provenance` attestation on npm publish
- **CI/CD Hardening** — TruffleHog + Gitleaks secrets scanning, Dependabot auto-merge, Trivy container scanning
- **Vulnerability Remediation** — Resolved Vite, Hono, path-to-regexp, fast-uri, Picomatch, ip-address CVEs
- **Docker Image Hardening** — Pinned Alpine edge packages, patched npm-bundled brace-expansion

## Fixed

- 40+ bug fixes across all tool groups including Zod validation leaks, Code Mode error handling, resource error quality, transaction execution, schema aliasing, payload optimization, and E2E test stability

## Dependencies

- TypeScript 6.0.3, Zod 4.4.3, Vitest 4.1.7, Playwright 1.58.2
- GitHub Actions SHA-pinned to latest versions
- Dockerfile overrides updated (diff 9.0.0, tar 7.5.15, minimatch 10.2.5)

---

**Full Changelog**: [v1.1.1...v2.0.0](https://github.com/neverinfamous/db-mcp/compare/v1.1.1...v2.0.0)

**Install:**

```bash
npm install db-mcp@2.0.0
# or
docker pull writenotenow/db-mcp:v2.0.0
```
