fix: harden ReadOnly SQL validation and fix security-review findings#154

Merged

daniel3303 merged 9 commits into

mainfrom

fix/security-review-hardening

Jul 7, 2026

Commits on Jul 7, 2026

fix(query): validate parenthesized statement heads in ReadOnly whitelist
daniel3303
committed
fix(query): use provider-default transaction isolation instead of ReadUncommitted
daniel3303
committed
perf(schema): cache the schema description for the application lifetime
daniel3303
committed
fix(microsoft-ai): apply MaxOutputTokens and honor custom Anthropic endpoint
daniel3303
committed
fix(microsoft-ai): only skip injected reminders when extracting the question
daniel3303
committed
docs(readme): document exclusion caveat and parenthesized-head validation
daniel3303
committed
fix(query): bound recursion depth in ReadOnly statement validation
daniel3303
committed
fix(schema): key the schema cache by DbContext type
daniel3303
committed
chore(deps): pin SQLitePCLRaw.lib.e_sqlite3 above vulnerable 2.1.11
daniel3303
committed