[ajitpratap0]

Summary

v1.17.0 is being tagged on current main, which includes #888 and #889. This moves their CHANGELOG entries from [Unreleased] into 1.17.0, rewrites the Transpile cost note (now ~2.7 µs vs 2.0 µs in v1.16.0, instead of 5.2 µs), adds the [1.17.0] compare link, and sets the release date to 2026-10-31 in CHANGELOG, MIGRATION, the VS Code changelog and the regenerated blog post.

Also fixes a new Trivy failure that blocks every PR: CVE-2026-118764 in minimatch 5.1.9, bundled into the VS Code extension by vscode-languageclient 9. A scoped npm override moves that copy to 11.0.3; the client only uses minimatch.Minimatch, which 11 still exports.

Test Plan

• go run ./scripts/gen-readme-metrics --check passes
• Blog post regenerated with split-changelog.js; unrelated regenerated posts reverted
• Extension compiles; Minimatch resolved through vscode-languageclient matches **/*.sql correctly (extension lint has 12 existing errors in test files, unchanged)
• Trivy green
• Website CI (changelog test) green

Breaking Changes

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DnbRnTFErhoMJdAjVEeCg2

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
gosqlx-website	Ignored	Preview	Oct 31, 2026 1:30pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 13s —— View job

---

Review of PR #891

The PR is a docs-only release finalization, and it looks good. I read the diff but didn't run the website changelog test or gen-readme-metrics.

What I checked

• The [Unreleased] section is now empty, so there are no stray entries.
• The fix(playground): resolve the #877 review items #888 Playground entry and the perf(transpiler): cached reflection plans and source prefilters for Transpile #889 Transpile entry are in the 1.17.0 ### Fixed and ### Performance sections. The blog post matches CHANGELOG.md for both entries, which is what you'd expect from regenerating it.
• The Transpile numbers agree with each other: 5.2 µs before the fix, about 2.7 µs after, and 2.0 µs in v1.16.0. Allocations are 43 against 32 in v1.16.0.
• The date is 2026-10-31 in all four places: CHANGELOG.md, docs/MIGRATION.md, vscode-extension/CHANGELOG.md and the blog frontmatter.
• The compare links are right: [Unreleased] points at v1.17.0...HEAD, and the new [1.17.0] link points at v1.16.0...v1.17.0.

Minor notes (non-blocking)

1. The Transpile entry says "keeps most of its v1.16.0 speed", but 2.7 µs against 2.0 µs is about 35% slower. "Most" is defensible. If you want it more precise, say "about 35% slower than v1.16.0, down from 2.6x".
2. The "Costs of the correctness work" bullet now only describes the parse-stage baselines. It starts with a lowercase "the", which reads fine after the bold lead-in.
3. The compare link for v1.17.0 will 404 until the tag exists. That's expected, since the tag gets created after this merges, as CLAUDE.md describes.
4. The date is 2026-10-31, so merge and tag the same day. Otherwise the date goes stale again.

Open item: the "Website CI (changelog test) green" checkbox in the test plan is still unchecked. Check it before merging.

No bugs, security concerns or performance issues, and there are no code changes to test.
· branch docs/v1.17.0-final

[github-actions]

Claude finished @ajitpratap0's task in 20s —— View job

---

Review of PR #891 (updated after new commit)

This is a docs-only release finalization, plus one dependency override that arrived in the latest commit. I read the diff but didn't run the website changelog test, gen-readme-metrics, or npm install/npm audit.

Docs (unchanged from the previous review)

• The fix(playground): resolve the #877 review items #888 and perf(transpiler): cached reflection plans and source prefilters for Transpile #889 entries are now under 1.17.0, and [Unreleased] is empty.
• The Transpile numbers are consistent: 5.2 µs before the fix, about 2.7 µs after, 2.0 µs in v1.16.0.
• The date 2026-10-31 matches in CHANGELOG.md, docs/MIGRATION.md, vscode-extension/CHANGELOG.md and the blog frontmatter.
• The compare links are correct. The v1.16.0...v1.17.0 link will 404 until the tag exists, which is expected.

New in this push: vscode-languageclient minimatch override (CVE-2026-118764)

• package.json adds "vscode-languageclient": { "minimatch": "^11.0.1" } to overrides, next to the existing ^9.0.9 pins.
• The lockfile resolves the nested minimatch to 11.0.3. That pulls in @isaacs/nonrecursive-glob-match and the already-present brace-expansion 5.0.12 (satisfies ^5.0.12).
• The lockfile is consistent with the override.

Notes

1. Node engines: minimatch 11 requires node 18 || 20 || >=22, while the previous 5.x accepted >=10. This only affects the extension's build and test tooling. VS Code's extension host ships its own Node, and engines.vscode is ^1.85.0, so the bundled runtime is Node 18 or newer. This is probably fine, but confirm that the esbuild or vsce packaging step bundles the dependency and that the extension host still loads it.
2. Behavior change: the major jump from 5 to 11 changes minimatch's API and behavior. vscode-languageclient uses it for document selector and file-watcher globs. Smoke-test the extension: open a .sql file and check that the LSP starts, diagnostics appear, and file watching works.
3. Scope: this security fix isn't mentioned in the PR description or the CHANGELOG. The PR is titled and described as docs-only. Consider adding a line under 1.17.0 ### Security and updating the description, since the final commit changes shipped dependencies. Also note that the commit predates the "Breaking Changes: None" claim, which still holds.
4. Wording nit: Transpile "keeps most of its v1.16.0 speed" is about 35% slower (2.7 vs 2.0 µs). That is defensible, but you could state it more precisely.
5. Merge and tag on 2026-10-31, or the date goes stale.

Open items before merge

• Website CI (changelog test) green
• VS Code extension CI and a manual LSP smoke test pass with minimatch 11

I found no bugs or security concerns in the diff.
· branch docs/v1.17.0-final