[ajitpratap0]

Summary

Release preparation for v1.17.0 (Real-World Dialect Corpus, Dialect-Faithful Round Trips, Security Scanner & LSP Hardening). This PR now carries both the website feature docs drafted earlier and the release finalisation, so the site, docs and version surfaces change together in one production deploy.

• Version surfaces → 1.17.0: gosqlx.Version, CLI docs, server.json, Claude Code plugin + marketplace, glama.json, VS Code extension (package.json + lock), pygosqlx (pyproject.toml, __version__), performance_baselines.json version, llms.txt, CLAUDE.md, docs headers, website PROJECT.version; 1.17.0 entries in the CLI and package version-history comments.
• CHANGELOG: [Unreleased] → [1.17.0] - 2026-10-29 with a release summary; Behavior changes first (led by fix(parser)!: treat a GO line inside a SQL Server statement as an error #868, SQL Server GO inside a statement), new Security and Performance sections, duplicates merged, PR numbers on every entry, chore(mcp): register hosted server and automate registry publication #859 and the new formatter/gosqlx/transform *Checked APIs added. Performance records the measured costs: Transpile ≈2.0 → 5.2 µs on the CREATE TABLE benchmark, parse ≈+6% time / −8% allocs.
• MIGRATION: v1.16.0 → v1.17.0 checklist and companion versions. VS Code changelog: 1.17.0 entry.
• API reference: new docs/api/formatter.md (added to the docs sidebar); AST container fields, CTE/PIVOT fields, checked formatting, linter syntax errors, security scanner, tokenizer dialect lexing, LSP textDocumentSync + error handling, MCP parse_sql dialect, CLI security merge.
• Real-world corpus: re-measured at fda9a5ef — 2,813 statements, all passing (was 2,788); REALWORLD_CORPUS.released: true, SQL_COMPATIBILITY table and every mention updated.
• Release wording: "unreleased / on the main branch / next release" markers rewritten across the guides and API docs.
• Generated v1-17-0 release post (from CHANGELOG via split-changelog.js) and refreshed homepage sample AST.
• CI: /playground/ gets its own 4.2 MB total-size Lighthouse budget (measured 3.60 MB; the WASM module grows with the parser).
• Earlier commits on this branch: website feature docs, dialect corpus pages and playground Format/Transpile tabs (see the commit list).

Test Plan

• task check (fmt, vet, lint, full race suite) and task test:cbinding on the release head
• go test -run TestVersionManifestsMatchVersion ./pkg/gosqlx/
• Website: npm run build, typecheck, lint, test (34 pass), check:metrics, check:docs, check:docs-links, check:anchors, check:seo, check:rendered, check:layout
• scripts/dialect-audit on all 8 dialects: 2,813 / 2,813, failed=0
• Fuzz 45 s each, no crashers: FuzzScanSQL, FuzzParse, FuzzTokenizer, FuzzTokenizerStringLiterals, FuzzTokenizerComments, FuzzFormat
• Benchmarks vs v1.16.0 (-count=6, benchstat): parse baselines and Transpile, recorded in the CHANGELOG
• CI green incl. Vercel preview (42/42 on 99612aa; Lighthouse /playground/ performance passed on rerun)

Breaking Changes

None to the Go API: exported signatures are unchanged apart from additions. Runtime behaviour changes are listed under Behavior changes in the CHANGELOG and in docs/MIGRATION.md (SQL Server GO inside a statement and unquoted top are errors, per-dialect statement termination and numeric lexing, fingerprints keep quoting, LSP advertises textDocumentSync).

After merge (maintainer)

1. gh workflow run deploy-mcp.yml --ref main, then confirm https://mcp.gosqlx.dev/health reports 1.17.0 (needed by publish-mcp at tag time).
2. Tag v1.17.0 on main; release.yml (GoReleaser) creates the GitHub release — do not run gh release create.
3. Follow-up PR: bump integrations/*/go.mod and the @v1.16.0 install pins, add the v1.17.0 line to the root doc.go version history and run go run ./scripts/gen-readme-metrics (these track the latest tag, so they move after it).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DnbRnTFErhoMJdAjVEeCg2

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 29, 2026 6:40am UTC

[github-actions]

Claude finished @ajitpratap0's task in 23s —— View job

---

PR review: #877 (docs, dialect corpus, playground Format/Transpile)

I read the WASM bridge, wasm/main.go, the bridge tests and the start of the FormatTab refactor. I did not read the rest of the React changes, the docs or the generated JSON closely, and I did not run any tests or builds. Treat this as a partial review.

Overall: the Go side looks clean and well tested. I found no blocking issues.

What looks good

• bridge.Format and bridge.Transpile are thin wrappers over gosqlx.FormatWithDialect and gosqlx.Transpile. Format now uses the selected dialect. Before, main.go ignored it and called formatter.FormatString.
• transpileDialect returns an error for an unknown dialect instead of silently falling back to generic. That avoids showing a misleading result.
• transpile in main.go checks the argument count and that all three arguments are strings. The args[:3] slice is safe because of the length check.
• The tests cover dialect-sensitive Format (TOP is rejected in generic), unplaceable comments, escape retargeting, errors with and without spans, and the JSON contract. contract_test.go and bridgeContract.fixture.json are updated to match.

Suggestions (non-blocking)

1. Unknown dialects behave differently between the two exports. Format silently treats an unknown dialect as generic (Dialect()), while Transpile returns an error. The comment on Format says so, and the playground only sends known names. A one-line note in the gosqlxFormat JS-facing docs would still help anyone calling the export directly.
2. ErrorSpan is never shown in the UI. TextResponse documents that WasmLoader.parseResult throws on any non-empty error, so the Format and Transpile tabs never use error_span. If you don't plan to surface it, consider dropping it from the payload to save bytes and contract surface. If you do, a follow-up that highlights the error position would help. Parse errors in Format are the most likely place to want it.
3. Format and Transpile response handling is only covered by type fixtures. I saw no Vitest test that mounts SqlOutput or TranspileTab with an error payload. The error branch in SqlOutput is the new code path (data.error with result empty), so a small render test would be worth adding.
4. setTimeout in handleCopy is not cleared on unmount. This was already the case before the refactor. Because SqlOutput is now shared by two tabs that unmount on tab switch, it is slightly more likely to cause a "state update on unmounted component" warning. A useRef timer with cleanup would fix it.
5. Release gating is manual. The PR description says to flip REALWORLD_CORPUS.released to true and drop the "on main, next release" wording before merging. A checklist item or a CI check that fails while released: false on a release branch would keep this from being forgotten.
6. WASM size increased by 228KB. Please confirm that is acceptable for first-load on the playground. Check that the loader is lazy and that the file is served compressed.

Security and performance

• No security concerns. All inputs are plain strings passed to the parser, and the WASM runs in the browser sandbox.
• The pooled tokenizer and AST are managed inside gosqlx.FormatWithDialect and gosqlx.Transpile, so the bridge adds no pool-lifecycle risk.
  • branch docs/website-next-release

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

PR review: #877 (docs, dialect corpus, playground Format/Transpile)

I read the WASM bridge, wasm/main.go, the bridge tests and the playground components (FormatTab, TranspileTab, Playground). I skimmed the docs and generated JSON only. I did not run tests or builds, so treat this as a partial review.

Overall: I found no blocking issues. The Go side is thin, well tested and consistent with the JSON contract.

What looks good

• bridge.Format and bridge.Transpile wrap gosqlx.FormatWithDialect and gosqlx.Transpile. Format now honours the selected dialect, which main.go previously ignored.
• transpileDialect rejects unknown dialects instead of falling back to generic, so the playground never shows a misleading result.
• transpile in wasm/main.go checks the argument count and types before using args[:3].
• The tests cover dialect-sensitive Format, unplaceable comments, escape retargeting, errors with and without spans, and the JSON contract.
• SqlOutput is a sensible shared component for the Format and Transpile tabs. The tab bar is now scrollable on narrow screens.

Suggestions (non-blocking)

1. Unknown dialects differ between the two exports. Format treats an unknown dialect as generic, while Transpile returns an error. The Go comment says so. Put the same note in the JS-facing docs for gosqlxFormat, since the playground is not the only possible caller.
2. ErrorSpan is never shown in the UI. WasmLoader.parseResult throws on any non-empty error, so the Format and Transpile tabs never see error_span. Either drop it from the payload or surface it later, for example by marking the editor on a Format parse error.
3. Transpile runs on every keystroke. runAll calls format and transpile along with the other four exports, even when those tabs are hidden. This is fine for short SQL, but it adds work to each edit. If the run is already debounced, no change is needed. If it isn't, consider computing the active tab's result first, or only running what is visible.
4. Changing the From dialect changes the editor's dialect. TranspileTab binds from to the editor's dialect (onFromChange={setDialect}), so changing "From" also re-parses the AST, lint and analyze tabs. The comment in TranspileTab.tsx explains this, but it may surprise users, so consider a short hint in the UI.
5. No render test for the new error path. I saw no Vitest test that mounts SqlOutput or TranspileTab with an error payload (data.error set, result empty). A small render test would cover the new branch.
6. setTimeout in handleCopy is never cleared. It already behaved this way before the refactor. Both tabs share SqlOutput and unmount on tab switch, so a state update after unmount is now more likely. A useRef timer cleared in an effect cleanup would fix it.
7. Release gating is manual. The PR body asks to flip REALWORLD_CORPUS.released to true and drop the "on main, next release" wording before merging. A CI check that fails on the release branch while released: false would prevent forgetting this.
8. WASM grows by 228KB. Please confirm the loader is lazy and the file is served compressed (gzip or brotli).

Security and performance

• No security concerns. Inputs are plain strings parsed in the browser sandbox.
• Pooled tokenizer and AST lifecycles are handled inside gosqlx.FormatWithDialect and gosqlx.Transpile, so the bridge adds no pool risk.
  · branch docs/website-next-release

[github-actions]

Claude finished @ajitpratap0's task in 17s —— View job

---

Review of PR #877: prepare v1.17.0

This is a partial review. I checked the diff stat and grepped for leftover 1.16.0 references. I did not run tests or builds, and I did not read the docs or CHANGELOG line by line.

Overall: no blocking issues found. The version bump is consistent across the surfaces I checked. gosqlx.Version is 1.17.0, and the PR description says TestVersionManifestsMatchVersion passes.

Findings

1. Leftover 1.16.0 references (minor). The ones I found look intentional:
   • cmd/gosqlx/cmd/root.go:42 is the version-history comment, which keeps 1.16.0 as history. Confirm the new 1.17.0 entry is the one that heads that comment.
   • python/pygosqlx/core.py:261 and python/tests/test_dialect_and_analysis.py describe when a feature was introduced.
   • pkg/cbinding/cbinding.go:41 says "added in v1.16.0", which is correct.
   • doc.go:290 lists v1.16.0 as a history entry. Check whether a v1.17.0 line should be added there too, since the PR says package version-history comments were updated.
2. Release date. The CHANGELOG heading is [1.17.0] - 2026-10-29. Make sure it matches the actual tag date, because the tag is created after merge.
3. Carry-over suggestions from the earlier reviews, still open:
   • Add a render test for the SqlOutput and TranspileTab error path, where data.error is set and result is empty.
   • Clear the handleCopy setTimeout on unmount.
   • Format treats an unknown dialect as generic while Transpile returns an error. Document this in the JS-facing docs.
   • error_span is never surfaced in the UI. Either use it or drop it from the payload.
   • Confirm the +228KB WASM growth is lazy-loaded and served compressed.
4. Post-merge checklist. The "After merge" steps are sound. In particular, the deploy-mcp.yml health check needs to report 1.17.0 before the tag, because publish-mcp depends on it. The - [ ] CI green incl. Vercel preview box is still unchecked, so check it before merging.

Security and performance

• No security concerns in the version, docs and bridge changes I looked at.
• The CHANGELOG records the measured costs (Transpile ≈2.0 → 5.2 µs, parse ≈+6% time and −8% allocs). That is honest and sufficient for a release.
  · branch docs/website-next-release