releases.shpreview
PlanetScalePlanetScale/PlanetScale CLI

OAuth token leak fixed; SQL injection vulnerabilities patched

v0.306.0

July 23, 2026PlanetScale CLIView original ↗
8 fixesThis release8 fixesBug fixesAI-tallied from the release notes
From the original release noteView original ↗

Changelog

  • 76d92dbb4553f33ba6fd4491ef66040b23a03897 Fix OAuth token leak on sibling-subdomain redirects
  • ba3dd4ae4bf513d89717c6cbcd04e571784b3a20 Fix Windows command injection when opening auth login URL
  • 9a456a8f15f80e5eb0706e4f96cdae0f2d562eef Fix auth token leak on cross-host API client redirects
  • d0168ff69ec5ea72eddd4990f74ce912a6a2033f Fix credential header leak on cross-domain API redirects
  • 7ed8c54e0ed0c7ad6b1a99ea7083bc291adb2d53 Fix destructive SQL gate bypass via MySQL executable comments
  • 082894c27917035ca451cb0018b0104edf1c427f Merge main and keep header-stripping on cross-host redirects
  • b770362af467cc4eba921a6dbb8ff6d7cbedeaa7 Omit OAuth client credentials from auth help text
  • 6f7cdf3ec0d4c8ffb7969422b6b1e2528ed11cba Remove unused OAuth client flags from auth check
  • 0d3d18ebbfa300778bd200da557b5165f0d7e116 Sanitize connection observability fields before terminal output
  • 4daaeb412fa8061bc2d046a02c06608403a88048 config: allowlist project .pscale.yml keys to block credential exfil
  • 8762d166ab37cd090140d19cfa72159c206fbc35 d1 import: keep literal comment gofmt-stable
  • 67d681a2acceac9f0cdb46f40c0ffa003c27cb90 d1 import: omit invalid table foreign keys
  • e1bc8c9b21949144b02b3cd2f2ed728ba3c4e6c5 d1 import: run injection assertions before optional Postgres skip
  • 98507d4466481e9a833deaa1c62284305308aa9f d1 import: stop emitting untrusted DEFAULT/REFERENCES SQL verbatim
  • 6bf3a549e4b229da4f18e4aa1d6cbfeb0d716859 d1 import: stop parseTableBody at balanced CREATE TABLE close

Fetched July 23, 2026

OAuth token leak fixed; SQL injection vulnerabilities… — releases.sh