Security hardening: path traversal, resource limits, and documentation#42

Merged

jjhafer merged 10 commits intosilvermine:masterfrom

pmorris-dev:vulnerabilities-audit

Feb 25, 2026

Commits on Feb 25, 2026

fix: harden SQL identifier handling against injection
pmorris-dev
committed
fix: prevent path traversal in database path resolution

pmorris-dev
and
claude
committed
feat: add configurable timeout for interruptible transactions

pmorris-dev
and
claude
committed
fix: cap observer channel_capacity to prevent memory exhaustion

pmorris-dev
and
claude
committed
feat: add configurable limit on loaded database count

pmorris-dev
and
claude
committed
feat: add limits on observed table count and subscriptions

pmorris-dev
and
claude
committed
docs: document cross-window access and unbounded fetchAll

pmorris-dev
and
claude
committed
chore: bump internal crate versions to 0.8.7

pmorris-dev
and
claude
committed
fix: auto-create intermediate directories for nested database paths

pmorris-dev
and
claude
committed
fix: reject zero values for max_databases and transaction_timeout

pmorris-dev
and
claude
committed