fix: harden ReadOnly SQL validation and fix security-review findings - #154

Merged

daniel3303 merged 9 commits into

mainfrom

fix/security-review-hardening

Jul 7, 2026

Commits on Jul 7, 2026

fix(query): validate parenthesized statement heads in ReadOnly whitelist
daniel3303
committed
fdf17ac
fix(query): use provider-default transaction isolation instead of ReadUncommitted
daniel3303
committed
1157fda
perf(schema): cache the schema description for the application lifetime
daniel3303
committed
1e4ca26
fix(microsoft-ai): apply MaxOutputTokens and honor custom Anthropic endpoint
daniel3303
committed
1b389a6
fix(microsoft-ai): only skip injected reminders when extracting the question
daniel3303
committed
085fff5
docs(readme): document exclusion caveat and parenthesized-head validation
daniel3303
committed
aed1971
fix(query): bound recursion depth in ReadOnly statement validation
daniel3303
committed
8b4da79
fix(schema): key the schema cache by DbContext type
daniel3303
committed
f3c3680
chore(deps): pin SQLitePCLRaw.lib.e_sqlite3 above vulnerable 2.1.11
daniel3303
committed
341ea32