This release fixes issues for SREs watching stability and regressions.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryFixed corruption of datasource connection strings when usernames or passwords contain special characters such as @, /, or :.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes connection string parsing for credentials containing @, /, or : characters. Fixes connection string parsing for credentials containing @, /, or : characters. Source: llm_adapter@2026-07-19 Confidence: low |
— |
| Bugfix | Medium |
Correctly handles datasource connection strings with special characters (@, /, :) in credentials. Correctly handles datasource connection strings with special characters (@, /, :) in credentials. Source: granite4.1:30b@2026-07-19-audit Confidence: low |
— |
Full changelog
SLayer 0.9.10
A small bug-fix release for datasource connection strings.
If your database username or password contains characters like @, /, or :, SLayer previously misread them as URL delimiters and built a broken connection string - corrupting the credentials, host, port, or database name before the connection was even attempted. This affected PostgreSQL, MySQL/MariaDB, ClickHouse, and any other dialect configured through individual connection fields.
Those credentials now round-trip correctly.
If you supply a full connection_string yourself, encode reserved characters within the credential components as before - SLayer treats that value as a complete URL and does not re-encode it.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Track SLayer, a semantic layer maintained by your agent
Get notified when new releases ship.
Sign up freeAbout SLayer, a semantic layer maintained by your agent
All releases →Related context
Related tools
Earlier breaking changes
- v0.7.1 Changes `search()` response to a single flat `results` list capped by `max_results`, removing separate `memories`, `example_queries`, and `entities` buckets.
- v0.7.1 Changes `search()` to return a single flat `results` list, removing per‑bucket caps.
- v0.6.3 Datasource names now reject dots, slashes, nulls, empty/whitespace; existing names containing '.' will fail validation on upgrade.
- v0.6.0 recall_memories surface entirely removed with no deprecation shim.
- v0.5.1 Two-mode reference semantics enforced: SQL mode accepts arbitrary SQL; DSL mode strictly resolves identifiers.
Beta — feedback welcome: [email protected]