v0.28.0: A Filter Panel You Can Click Through, Tables That Refresh Themselves, and a Read-Only MCP the Database Enforces

TabularisDB released v0.28.0, a database client update with more than 80 commits and close to 70 merged pull requests from nineteen external contributors, arriving five days after v0.27.0. The release rebuilds the structured filter panel around clicking rather than typing, adds interval-based table tab refresh, and fixes two security reports against the MCP server by moving read-only mode from a keyword check into the database session. Connection secrets now go to the keychain by default, and metadata fixes improve Generate SQL, routines and imports on MySQL 8, PostgreSQL and SQLite.

v0.28.0 comes five days after v0.27.0 https://tabularis.dev/blog/v0270-cell-value-filter-stable-columns-tsql-batches and is the largest release in a while: more than 80 commits and close to 70 merged pull requests from nineteen external contributors. Most of it arrived during the community giveaway https://tabularis.dev/contribute/leaderboard , which closes today. There is no single theme, so this post is grouped by where you will notice it. The structured filter panel is rebuilt around clicking instead of typing. Table tabs can refresh on an interval. Tabs can be reopened, duplicated and switched by recency, and a long query that finishes while you are elsewhere sends a notification. Two security reports against the MCP server are fixed by moving read-only mode from a keyword check into the database session. Connection secrets go to the keychain by default, and a long list of metadata fixes makes Generate SQL, routines and imports more faithful on MySQL 8, PostgreSQL and SQLite. Around the app, three new themes reached the registry, Tabularium shipped seven minor versions in five days, and the plugins got a round of fixes. A Structured Filter You Can Click Through The structured filter panel had grown features over several releases but still asked you to type values and % wildcards by hand, and it sat on top of the first rows of the grid it was filtering. Four pull requests change that. The panel is part of the layout. @gcapellib https://github.com/gcapellib moves it out of the overlay in PR 922 https://github.com/TabularisDB/tabularis/pull/922 : it now sits above the grid and pushes it down, with a maximum height and its own scroll for long filter lists, so the rows an applied filter returns are never hidden under it. Since it no longer covers anything, a click outside does not close it; Esc , the close button and the Filters button still do. The panel resets when you switch to another table tab, so filters do not leak from one table to the next. Match all or Match any. Also from @gcapellib https://github.com/gcapellib , PR 920 https://github.com/TabularisDB/tabularis/pull/920 adds a two-button toggle to the panel header. Match all joins the rows with AND , as before; Match any joins them with OR and wraps the result in parentheses so it combines safely with anything else in the WHERE . Operators for text. @Detoy https://github.com/Detoy adds contains , starts with , ends with , is empty and is not empty for string columns in PR 927 https://github.com/TabularisDB/tabularis/pull/927 , closing 852 https://github.com/TabularisDB/tabularis/issues/852 . The first three generate LIKE patterns with % , and the escape character escaped, so a value with an underscore matches literally. The escape character is on every driver, because ESCAPE '\' is a syntax error on MySQL and MariaDB under the default sql mode . is empty matches both NULL and '' . Pick values instead of typing them. In PR 956 https://github.com/TabularisDB/tabularis/pull/956 , closing 869 https://github.com/TabularisDB/tabularis/issues/869 , @Detoy https://github.com/Detoy puts a value picker next to the value field. It loads the column's 100 most frequent non- NULL values with their counts, narrowed by the panel's other complete rows when matching all, with a search box. One pick fills the field with = , several switch the operator to IN , and = / NOT IN stay negated. Nothing is applied until you press Apply . The query runs on the tab's connection, schema and session, goes through the same request guard as the table, and is discarded if the filter changes before it returns. It is not offered on BLOB, binary or JSON columns. Video unavailable Three fixes make the panel safer to leave half-filled. An empty row, which opening the panel adds, used to produce id = '' on close, which PostgreSQL rejects on numeric columns; incomplete rows are now skipped, both by Apply All and by the per-row Apply @gcapellib https://github.com/gcapellib , PR 941 https://github.com/TabularisDB/tabularis/pull/941 . IN and NOT IN values containing commas, escaped quotes or empty strings now survive the split @vivekyarra https://github.com/vivekyarra , PR 969 https://github.com/TabularisDB/tabularis/pull/969 . On MySQL and MariaDB, backslashes in typed and picked values are escaped when each clause is built. Tables That Refresh Themselves Watching a queue, a job table or a log table meant pressing refresh over and over. @Detoy https://github.com/Detoy closes 868 https://github.com/TabularisDB/tabularis/issues/868 with PR 915 https://github.com/TabularisDB/tabularis/pull/915 : table tabs get a refresh button with an interval select beside it, Off , 5s , 10s , 30s or 60s . New tabs start at Off, and each tab keeps its own interval. When a timer is running, the icon, the Auto-refresh label and the select switch to the accent color, so you can tell at a glance which tabs are live. Video unavailable Most of the work is in what refreshing must not do. A tick keeps the grid, the scroll position and the query settings, and a failure is shown inline while the last good rows stay on screen. The timer pauses while you edit a cell, have pending changes, or have rows selected, since selected rows are indexes and new data would shift them onto other records; a status line says Paused while editing or Paused while rows are selected . Inactive tabs stop polling, and coming back either waits the remaining time or refreshes once if the deadline has passed, without replaying missed ticks. Every table request goes through one queue per tab, so a manual run, a page change and a tick never overlap, and a late tick result is dropped if you edited, paged, changed the query or switched connection in the meantime. Tabs: Reopen, Duplicate, Switch by Recency Reopen the last closed tab. @M4Y4NK-V3RM4 https://github.com/M4Y4NK-V3RM4 adds Ctrl+Shift+T Cmd+Shift+T on macOS in PR 914 https://github.com/TabularisDB/tabularis/pull/914 , closing 866 https://github.com/TabularisDB/tabularis/issues/866 . Closed tabs go onto a stack of 20 per connection, kept in memory, and come back at their previous position with their SQL, title, filter, sort and parameters; results are not kept, so you run the query again. Every close path feeds the stack, including Close others and Close to the right . The tab context menu has a matching Reopen closed tab item, and the shortcut can be rebound. Duplicate a tab. @dyk1454683243-sudo https://github.com/dyk1454683243-sudo adds Duplicate tab to the tab context menu in PR 875 https://github.com/TabularisDB/tabularis/pull/875 . The copy opens right after the original with the same SQL and parameters; a duplicated materialized-view or read-only definition tab stays read-only. Switch by recency. With PR 1011 https://github.com/TabularisDB/tabularis/pull/1011 , closing 999 https://github.com/TabularisDB/tabularis/issues/999 , @Detoy https://github.com/Detoy makes Ctrl+Tab go back to the tab you used before instead of the next one in the bar: after visiting A, C and A again, Ctrl+Tab selects C. The order holds while Ctrl is held, repeated Tab presses walk through it, and Ctrl+Shift+Tab walks back. Each connection has its own history. Video unavailable Long Queries, Window Placement and Unsaved Edits A notification when a long query finishes. @M4Y4NK-V3RM4 https://github.com/M4Y4NK-V3RM4 closes 867 https://github.com/TabularisDB/tabularis/issues/867 with PR 928 https://github.com/TabularisDB/tabularis/pull/928 . If a query runs longer than a threshold and Tabularis is not the focused window when it ends, you get a desktop notification with the tab title, the outcome and the duration; Run All sends one notification for the whole batch with the count of succeeded and failed statements. Two settings under Settings → General → Query execution control it: Notify when long queries finish on and Notification threshold 20 seconds . Auto-refresh ticks never notify. @vivekyarra https://github.com/vivekyarra also fixes a quiet data loss in PR 970 https://github.com/TabularisDB/tabularis/pull/970 : an edit typed just before switching console tabs could be dropped by the debounce; it is now kept. And in PR 953 https://github.com/TabularisDB/tabularis/pull/953 , closing 534 https://github.com/TabularisDB/tabularis/issues/534 , the main window remembers its size and position across restarts, stays on a connected monitor, and still respects Start maximized . MCP Read-Only Mode, Enforced by the Database Two security advisories were reported against the built-in MCP server this cycle, both rated high, and both fixed in this release. The threat model is the one in our security policy: an AI client steered by untrusted content, or an untrusted MCP client, controls the text it sends. GHSA-vqmg-c6j7-6c3j https://github.com/TabularisDB/tabularis/security/advisories/GHSA-vqmg-c6j7-6c3j : side-effecting SELECT and PRAGMA statements. Read-only mode and the write-approval gate classified a query by its first keyword. Statements that start like a read can write: SELECT … INTO creates a table on PostgreSQL, SELECT … INTO OUTFILE writes a file on the MySQL server, SELECT setval ... resets a sequence, FOR UPDATE takes locks, and PRAGMA user version = 42 changes a SQLite database. All of them passed as reads, ran with read-only mode on, and skipped approval. It is the same class of bug as the EXPLAIN ANALYZE case fixed earlier. The fix has two layers. The classifier now treats SELECT … INTO , INTO OUTFILE / INTO DUMPFILE , FOR UPDATE / FOR SHARE / LOCK IN SHARE MODE , known side-effecting PostgreSQL functions, PRAGMA assignments and action pragmas as writes, including inside CTEs and EXPLAIN ANALYZE . More importantly, the database now enforces it: every query on a read-only connection, and every query that skips approval because it was classified as a read, runs through a new read-only path. PostgreSQL wraps it in BEGIN READ ONLY , MySQL in START TRANSACTION READ ONLY , SQLite turns on query only inside a transaction, and all three always roll back. If the reset fails or the call is dropped, the connection is closed instead of going back to the pool, so the setting cannot leak into your own editor session. Plugin drivers keep the existing path. A follow-up, PR 1054 https://github.com/TabularisDB/tabularis/pull/1054 , closes the cases a read-only transaction cannot: on PostgreSQL, lo export writes a file on the server even inside BEGIN READ ONLY , and the backend-signal and dblink functions act outside the transaction. For those the classifier is the only check, and two tricks hid them from it. Function names written as quoted identifiers, "lo export" ... , pg catalog."lo export" ... or U&"lo export" ... , were blanked before the deny list ran; and a quote inside a $$…$$ , $tag$…$tag$ or E'…' literal threw off the string scanner. Both literal forms are now skipped as whole strings, and any call through a quoted name is classified as unknown, which read-only mode blocks and the approval gate asks about. Quoted columns and aliases still classify as reads. GHSA-xrx3-j98v-67x9 https://github.com/TabularisDB/tabularis/security/advisories/GHSA-xrx3-j98v-67x9 : SQL injection through describe table on SQLite. The SQLite driver built its introspection queries as PRAGMA table xinfo '<name ' with the table name pasted in, and SQLite runs every statement in the string. A table name such as x' ; DROP TABLE users; -- sent to the MCP describe table tool executed the second statement, read-only mode or not. The driver now uses the table-valued forms with a bound parameter, SELECT FROM pragma table xinfo ?1 , for columns, foreign keys and indexes, in both the single and the batch paths, as the MySQL and PostgreSQL drivers already did. Thanks to @timharris777 https://github.com/timharris777 , @gh0stsh3ll56 https://github.com/gh0stsh3ll56 and @squeeze440 https://github.com/squeeze440 for the reports. If you use the MCP server with read-only connections, upgrade. See MCP read-only mode https://tabularis.dev/wiki/mcp-readonly-mode for how the setting works. Connections: Secrets, TLS and Imports Secrets go to the keychain by default. In PR 980 https://github.com/TabularisDB/tabularis/pull/980 , closing 971 https://github.com/TabularisDB/tabularis/issues/971 , @cestercian https://github.com/cestercian makes new database connections store their password in the OS keychain by default, as the SSH manager already did; existing connections keep their setting. With the box unticked, the form says "Passwords will be stored in plain text in the connection file." If the keychain refuses a write, the connection still saves, with the password in the file and that warning shown. On Unix, connections.json and the SSH and Kubernetes connection files are written with mode 0600 , and an existing file with looser permissions is tightened on the next save. An unknown SSL mode is an error. Before PR 974 https://github.com/TabularisDB/tabularis/pull/974 , also by @cestercian https://github.com/cestercian , a typo such as verfy-full fell through to no certificate verification on PostgreSQL and Required on MySQL. Unknown values now fail the connection with a message listing the accepted ones; matching is case-insensitive and blank still means the default. When the host is remote and the chosen mode does not verify the certificate, the form suggests verify-full or verify identity . JDBC URLs import. @vivekyarra https://github.com/vivekyarra extends the connection-string import in PR 952 https://github.com/TabularisDB/tabularis/pull/952 , closing 860 https://github.com/TabularisDB/tabularis/issues/860 : jdbc:postgresql:// and jdbc:mysql:// URLs are accepted, credentials in the query string are used when the authority has none, and PostgreSQL and MySQL SSL modes, sslMode spelled in any case included, land in the form. Drivers registered for raw JDBC passthrough keep their URL untouched. SSH on macOS without a system askpass. @tonypartridge https://github.com/tonypartridge fixes SSH tunnels that asked for a missing /usr/X11R6/bin/ssh-askpass in PR 848 https://github.com/TabularisDB/tabularis/pull/848 . The selected key, its passphrase and the account password now go through Tabularis's own askpass helper, which requires a per-launch token on every platform and hands out the key passphrase only for OpenSSH's own prompt for that key, never for a server-sent keyboard-interactive prompt. Kubernetes tunnels recover. @Detoy https://github.com/Detoy gives kubectl port-forward tunnels the lifecycle SSM tunnels already had in PR 942 https://github.com/TabularisDB/tabularis/pull/942 , closing 886 https://github.com/TabularisDB/tabularis/issues/886 : dead tunnels are detected and recreated on the same local port on reconnect, closing a pool never waits on an unreachable cluster, and all tunnels stop when the app exits. The SQL Editor Hidden characters in pasted SQL. Text copied from chat apps, PDFs and documents often carries zero-width spaces, non-breaking spaces, bidi markers or curly quotes, and the resulting syntax error points at something you cannot see. @vivekyarra https://github.com/vivekyarra closes 994 https://github.com/TabularisDB/tabularis/issues/994 with PR 1015 https://github.com/TabularisDB/tabularis/pull/1015 : the editor now highlights invisible and look-alike characters, and a context-menu action cleans them, on the selection or the whole document, in one undo step. Characters inside string literals and quoted identifiers are left alone, so data you meant to paste is not rewritten. The highlight can be turned off in Settings → Appearance . Autocomplete for CTEs and derived tables. Also from @vivekyarra https://github.com/vivekyarra , PR 963 https://github.com/TabularisDB/tabularis/pull/963 closes 506 https://github.com/TabularisDB/tabularis/issues/506 : typing c. after WITH c AS SELECT id, name FROM users or FROM SELECT … AS c suggests that query's columns, with explicit column lists, quoted aliases, SQL Server brackets and LATERAL handled, and a FROM alias winning over a same-named CTE. Keyword case. @njtherealss https://github.com/njtherealss adds a setting for the case of keywords autocomplete inserts in PR 881 https://github.com/TabularisDB/tabularis/pull/881 , closing 858 https://github.com/TabularisDB/tabularis/issues/858 : UPPER , lower , or match , where sel becomes select and Sel becomes SELECT . Table and column names are never recased. The Grid Jump to a column. @vivekyarra https://github.com/vivekyarra , PR 954 https://github.com/TabularisDB/tabularis/pull/954 , closes 871 https://github.com/TabularisDB/tabularis/issues/871 : Ctrl/Cmd+Shift+J in a grid opens a fuzzy column picker with types; Enter scrolls the column into view and returns focus to the grid. The shortcut can be rebound. Video unavailable Image previews on hover. @Totopo27 https://github.com/Totopo27 , PR 1008 https://github.com/TabularisDB/tabularis/pull/1008 , closes 998 https://github.com/TabularisDB/tabularis/issues/998 : hovering an image BLOB, or a text cell holding SVG markup, shows the image in a popover. SVG is rendered through an <img data URL, never inserted into the page, so scripts in it cannot run, and only data already loaded is used. Video unavailable JSON Viewer, Query History and Results - Links and colors in the JSON viewer @Totopo27 https://github.com/Totopo27 , PR 1007 https://github.com/TabularisDB/tabularis/pull/1007 , closes 997 https://github.com/TabularisDB/tabularis/issues/997 : http , https and mailto strings get a button that opens them in the browser, and hex, rgb and hsl strings get a color swatch. Values stay editable. - Query History filters @Detoy https://github.com/Detoy , PR 943 https://github.com/TabularisDB/tabularis/pull/943 , closes 859 https://github.com/TabularisDB/tabularis/issues/859 : Outcome any, succeeded, failed and Time range last hour, today, last 7 or 30 days combine with the search box, so "what failed today" is two clicks. - Copy all rows everywhere @verbaux https://github.com/verbaux , PRs 913 https://github.com/TabularisDB/tabularis/pull/913 , 958 https://github.com/TabularisDB/tabularis/pull/958 : copy-all works in multi-result panels, tabbed and stacked, and in the detached results window, re-running only the last executed statement in the tab's own session, so uncommitted rows of an open transaction are included. Detached windows are synced per tab. - PostgreSQL real without float noise @verbaux https://github.com/verbaux , PR 950 https://github.com/TabularisDB/tabularis/pull/950 : float4 values display as stored instead of 0.10000000149011612 , and editing and filtering such rows still matches them at the column's precision. Schema, Routines and Generate SQL - View definitions and DDL @cestercian https://github.com/cestercian , PR 1010 https://github.com/TabularisDB/tabularis/pull/1010 , closes 995 https://github.com/TabularisDB/tabularis/issues/995 : views get Show Definition and Copy DDL in the explorer, and materialized views gain Copy DDL . - PostgreSQL overloads, told apart @stroexd https://github.com/stroexd , PR 926 https://github.com/TabularisDB/tabularis/pull/926 , closes 893 https://github.com/TabularisDB/tabularis/issues/893 : four functions named f used to show as four identical rows, and View Definition, Parameters, Run, Edit and Drop picked whichever came back first. Each routine is now labeled and addressed by its signature, f a integer, b integer , in the sidebar and the command palette, and Drop works on an overloaded name. Tested on PostgreSQL 11 and 18. - Generate SQL keeps types @aesslinger https://github.com/aesslinger , PR 939 https://github.com/TabularisDB/tabularis/pull/939 , closes 840 https://github.com/TabularisDB/tabularis/issues/840 : a bigint identity column becomes BIGSERIAL instead of SERIAL , composite foreign keys come out as one multi-column constraint in the right order instead of several invalid duplicates, and numeric p,s and varchar n keep their modifiers on PostgreSQL and MySQL. - SQLite tables keep their key and defaults @tosinxt https://github.com/tosinxt , PRs 983 https://github.com/TabularisDB/tabularis/pull/983 , 982 https://github.com/TabularisDB/tabularis/pull/982 : Generate SQL dropped the PRIMARY KEY of every SQLite table, and every column looked as if it had a default, which printed DEFAULT , and offered Set DEFAULT everywhere. - MySQL 8 metadata @tosinxt https://github.com/tosinxt , PRs 944 https://github.com/TabularisDB/tabularis/pull/944 , 966 https://github.com/TabularisDB/tabularis/pull/966 , 968 https://github.com/TabularisDB/tabularis/pull/968 : MySQL 8 reports routine parameter positions, index column positions and column lengths with integer types the driver did not decode, so the Run… dialog listed no parameters, every index column had position 0, and short binary columns were treated as BLOBs. All three are read correctly on 8.x and 5.7, with integration tests running on both. - Triggers per dialect @1-DARK https://github.com/1-DARK , PR 955 https://github.com/TabularisDB/tabularis/pull/955 : the guided trigger editor offers only the events and options the driver supports, reads every event of a multi-event trigger, and no longer sends a schema on MySQL, which failed with error 1435. - New routine in every layout @tosinxt https://github.com/tosinxt , PR 909 https://github.com/TabularisDB/tabularis/pull/909 , closes 888 https://github.com/TabularisDB/tabularis/issues/888 : the PostgreSQL schema tree and the MySQL multi-database tree had no way to create a procedure or function; the new button targets the schema or database it sits in. - Import from Clipboard @tosinxt https://github.com/tosinxt , PRs 936 https://github.com/TabularisDB/tabularis/pull/936 , 937 https://github.com/TabularisDB/tabularis/pull/937 , 945 https://github.com/TabularisDB/tabularis/pull/945 , 967 https://github.com/TabularisDB/tabularis/pull/967 : the import uses the driver's identifier quote, so it works on MySQL without ANSI QUOTES ; sends TRUE / FALSE into MySQL boolean columns in strict mode; imports into the schema of the table you right-clicked; and refreshes the explorer tree so the new table shows up. Around the Ecosystem Themes Three theme packages reached the registry https://registry.tabularis.dev this week, and two of them come from the community. @Detoy https://github.com/Detoy published Catppuccin for Tabularis https://github.com/Detoy/tabularis-catppuccin-theme , with the Latte and Mocha flavours, and Tokyo Night https://github.com/Detoy/tabularis-tokyo-night-theme , with the Day and Night variants. We added Ayu https://github.com/TabularisDB/tabularis-ayu-theme , with Ayu Light, Ayu Mirage and Ayu Dark. All three cover the application, the data grid's semantic colors and the SQL editor, and are checked against the same WCAG AA contrast rules as the built-in themes; where an original palette color falls short, the nearest passing shade of the same hue replaces it. Install them from Settings → Plugins → Filter by type → Themes , or browse them on the themes page https://tabularis.dev/plugins/themes . The create-plugin theme template now uploads its .tabularium manifest with each release, which the registry requires @tosinxt https://github.com/tosinxt , PR 984 https://github.com/TabularisDB/tabularis/pull/984 . Tabularium Tabularium https://github.com/TabularisDB/tabularium , the open-source registry behind registry.tabularis.dev https://registry.tabularis.dev , went from 0.15 to 0.21 in five days. @NewtTheWolf https://github.com/NewtTheWolf added a remote MCP server at /mcp with OAuth authorization, PKCE and explicit consent 15 https://github.com/TabularisDB/tabularium/pull/15 , so an AI client can search the catalogue or manage your plugins with the permissions you grant it, along with the tutorials to set it up for Claude, Codex and other clients. The public site now has a theme matching tabularis.dev, a home page with search, live statistics and the most downloaded plugins, a ⌘K search palette, redesigned plugin pages with one download row per platform, and sorting by downloads. Plugin requests take a kind, so you can ask for a theme as well as a driver, and the bounty board https://tabularis.dev/plugins/bounties can now open a request on Tabularium directly. Maintainers get outbound notification webhooks for Discord and Slack. Plugins - ClickHouse 0.2.2 https://github.com/TabularisDB/tabularis-clickhouse-plugin/releases/tag/v0.2.2 : reads work on ClickHouse 26.9, by disabling native compression @Badabum https://github.com/Badabum , 7 https://github.com/TabularisDB/tabularis-clickhouse-plugin/pull/7 . 0.2.1 runs SHOW and DESCRIBE without a pagination wrapper @vivekyarra https://github.com/vivekyarra , 5 https://github.com/TabularisDB/tabularis-clickhouse-plugin/pull/5 . - DuckDB 0.2.2 https://github.com/TabularisDB/tabularis-duckdb-plugin/releases/tag/v0.2.2 : DATE values come back as ISO strings @vivekyarra https://github.com/vivekyarra , 10 https://github.com/TabularisDB/tabularis-duckdb-plugin/pull/10 , and table and column comments are exposed. - CSV 1.0.5 https://github.com/TabularisDB/tabularis-csv-plugin/releases/tag/v1.0.5 : results honor the host's page size @vivekyarra https://github.com/vivekyarra , 5 https://github.com/TabularisDB/tabularis-csv-plugin/pull/5 . - PostgreSQL 1.0.0-rc.7 https://github.com/TabularisDB/tabularis-postgresql-plugin/releases/tag/v1.0.0-rc.7 : a failed login no longer poisons the connection pool until it times out, and malformed JSON-RPC input gets an error instead of hanging the client @aesslinger https://github.com/aesslinger . - DynamoDB 0.1.8 https://github.com/TabularisDB/tabularis-dynamodb-plugin/releases/tag/v0.1.8 : unknown fields in native query bodies are rejected instead of ignored @fuleinist https://github.com/fuleinist , 93 https://github.com/TabularisDB/tabularis-dynamodb-plugin/pull/93 . - Every first-party plugin manifest now declares a stable id and a readable display name. On the host side, plugin drivers get several fixes: the selected Redis database is honored in every RPC call 960 https://github.com/TabularisDB/tabularis/pull/960 , in-flight calls drain during a bounded shutdown instead of being cut off 961 https://github.com/TabularisDB/tabularis/pull/961 , both by @vivekyarra https://github.com/vivekyarra ; UI extension slots receive their context fields again @Detoy https://github.com/Detoy , 951 https://github.com/TabularisDB/tabularis/pull/951 ; and error responses with a null id are accepted @SatvikMishra08 https://github.com/SatvikMishra08 , 924 https://github.com/TabularisDB/tabularis/pull/924 . Explain Plan and the Website explain.tabularis.dev https://explain.tabularis.dev was rebuilt by @wajrock https://github.com/wajrock 9 https://github.com/TabularisDB/explain-plan/pull/9 , 12 https://github.com/TabularisDB/explain-plan/pull/12 : a new home with a guide per engine, plan upload and auto-detection, and encrypted share links. The plan is compressed and encrypted in the browser, only the ciphertext is stored, and the key lives in the part of the link after , which never reaches a server; a link expires 30 days after it was last opened. On tabularis.dev, the new Contribute https://tabularis.dev/contribute page lists every open issue across the app and its plugins, and the leaderboard https://tabularis.dev/contribute/leaderboard ranks pull requests and issues over any date range. The Giveaway Closes Today The community giveaway that started on October 7 ends today, October 13, at 16:00 Europe/Rome time . Pull requests and issues opened in that window across every Tabularis project count, and the leaderboard https://tabularis.dev/contribute/leaderboard shows where things stand. The score orders the board but does not pick the winners: after the deadline we review every contribution for usefulness, quality and impact, and the top three win a prize. Translations, docs, themes, testing and help on Discord count too. To enter, reply to the giveaway announcement on Discord https://discord.com/invite/K2hmhfHRSt with your GitHub username; the prizes and the eligibility rules are in that announcement. If you have not picked an issue yet, start from the good first issues https://tabularis.dev/contribute?label=good+first+issue issues . Judging by this release, it worked. Thank you to everyone who took part. Smaller Things - WinGet @Detoy https://github.com/Detoy , PRs 975 https://github.com/TabularisDB/tabularis/pull/975 , 976 https://github.com/TabularisDB/tabularis/pull/976 , 929 https://github.com/TabularisDB/tabularis/pull/929 : releases publish an NSIS installer for WinGet, and a WinGet install, like Snap, Flatpak and AUR, leaves updates to its package manager. Homebrew keeps the in-app updater, since the cask is marked as auto-updating. - Logging @Detoy https://github.com/Detoy , PR 897 https://github.com/TabularisDB/tabularis/pull/897 ; @anshdadhich https://github.com/anshdadhich , PR 933 https://github.com/TabularisDB/tabularis/pull/933 : --debug now really raises the log level to Debug, in the app and in --mcp mode, and RUST LOG is honored. Log actions in Settings show an error when they fail, and Export Logs no longer claims it copied anything to the clipboard @tosinxt https://github.com/tosinxt , PRs 987 https://github.com/TabularisDB/tabularis/pull/987 , 910 https://github.com/TabularisDB/tabularis/pull/910 . - Settings that survive a restart @SahinurDEV https://github.com/SahinurDEV , PR 911 https://github.com/TabularisDB/tabularis/pull/911 , closes 883 https://github.com/TabularisDB/tabularis/issues/883 : column masking, its patterns and overrides, Row editor follows selection and the cell double-click action were reset on every restart. - AI Assist with Claude 5.5 @SatvikMishra08 https://github.com/SatvikMishra08 , PR 918 https://github.com/TabularisDB/tabularis/pull/918 : requests to Anthropic no longer send temperature , which the Claude 5.5 models reject. - Claude Desktop on Windows @Detoy https://github.com/Detoy , PR 902 https://github.com/TabularisDB/tabularis/pull/902 , closes 885 https://github.com/TabularisDB/tabularis/issues/885 : the one-click MCP install wrote its config to a folder Claude Desktop never reads; it now writes to %APPDATA%\Claude . - Linux @davidMendezG https://github.com/davidMendezG , PR 921 https://github.com/TabularisDB/tabularis/pull/921 ; @vivekyarra https://github.com/vivekyarra , PR 962 https://github.com/TabularisDB/tabularis/pull/962 : a crash when sending desktop notifications is fixed, and the stable AppImage keeps its wrapped launcher executable. - Connection string examples @DhruvShah-Dev https://github.com/DhruvShah-Dev , PR 925 https://github.com/TabularisDB/tabularis/pull/925 : the per-plugin presets added in v0.27.0 get tighter validation and clearer examples. - create-plugin @tosinxt https://github.com/tosinxt , PRs 985 https://github.com/TabularisDB/tabularis/pull/985 , 988 https://github.com/TabularisDB/tabularis/pull/988 : scaffolded driver plugins pass cargo fmt --check out of the box, and the theme guide points to Import theme → Local package . Thanks Nineteen external contributors land in this release. @Detoy https://github.com/Detoy built table auto-refresh, the text operators and the value picker for the filter panel, recency tab switching, Query History filters, the Kubernetes tunnel lifecycle, the WinGet installer and the logging fixes, and published two themes on top 915 https://github.com/TabularisDB/tabularis/pull/915 , 927 https://github.com/TabularisDB/tabularis/pull/927 , 956 https://github.com/TabularisDB/tabularis/pull/956 , 1011 https://github.com/TabularisDB/tabularis/pull/1011 , 943 https://github.com/TabularisDB/tabularis/pull/943 , 942 https://github.com/TabularisDB/tabularis/pull/942 . @vivekyarra https://github.com/vivekyarra added hidden-character cleanup, CTE autocomplete, jump to column, JDBC import and window placement, fixed plugin shutdown and Redis database routing, and sent fixes to three plugins 1015 https://github.com/TabularisDB/tabularis/pull/1015 , 963 https://github.com/TabularisDB/tabularis/pull/963 , 954 https://github.com/TabularisDB/tabularis/pull/954 , 952 https://github.com/TabularisDB/tabularis/pull/952 , 953 https://github.com/TabularisDB/tabularis/pull/953 . @tosinxt https://github.com/tosinxt went through MySQL 8 metadata, SQLite Generate SQL, Import from Clipboard and the create-plugin templates one bug at a time, with integration tests for each. @M4Y4NK-V3RM4 https://github.com/M4Y4NK-V3RM4 added reopen closed tab and long-query notifications 914 https://github.com/TabularisDB/tabularis/pull/914 , 928 https://github.com/TabularisDB/tabularis/pull/928 . @gcapellib https://github.com/gcapellib moved the filter panel inline, added Match any and made incomplete filters harmless 922 https://github.com/TabularisDB/tabularis/pull/922 , 920 https://github.com/TabularisDB/tabularis/pull/920 , 941 https://github.com/TabularisDB/tabularis/pull/941 . @cestercian https://github.com/cestercian moved secrets to the keychain by default, closed the unknown-SSL-mode downgrade and added view DDL 980 https://github.com/TabularisDB/tabularis/pull/980 , 974 https://github.com/TabularisDB/tabularis/pull/974 , 1010 https://github.com/TabularisDB/tabularis/pull/1010 . @stroexd https://github.com/stroexd untangled PostgreSQL overloads 926 https://github.com/TabularisDB/tabularis/pull/926 , @aesslinger https://github.com/aesslinger restored type fidelity in Generate SQL and shipped PostgreSQL plugin rc.7 939 https://github.com/TabularisDB/tabularis/pull/939 , @verbaux https://github.com/verbaux fixed copy-all and real values 913 https://github.com/TabularisDB/tabularis/pull/913 , 950 https://github.com/TabularisDB/tabularis/pull/950 , 958 https://github.com/TabularisDB/tabularis/pull/958 , and @Totopo27 https://github.com/Totopo27 added image previews and JSON links and swatches 1008 https://github.com/TabularisDB/tabularis/pull/1008 , 1007 https://github.com/TabularisDB/tabularis/pull/1007 . Thanks also to @tonypartridge https://github.com/tonypartridge for the macOS SSH askpass fix 848 https://github.com/TabularisDB/tabularis/pull/848 , @dyk1454683243-sudo https://github.com/dyk1454683243-sudo for Duplicate tab 875 https://github.com/TabularisDB/tabularis/pull/875 , @njtherealss https://github.com/njtherealss for keyword case 881 https://github.com/TabularisDB/tabularis/pull/881 , @1-DARK https://github.com/1-DARK for dialect-aware triggers 955 https://github.com/TabularisDB/tabularis/pull/955 , @SatvikMishra08 https://github.com/SatvikMishra08 for the Anthropic and JSON-RPC fixes 918 https://github.com/TabularisDB/tabularis/pull/918 , 924 https://github.com/TabularisDB/tabularis/pull/924 , @anshdadhich https://github.com/anshdadhich for RUST LOG 933 https://github.com/TabularisDB/tabularis/pull/933 , @davidMendezG https://github.com/davidMendezG for the Linux notification crash 921 https://github.com/TabularisDB/tabularis/pull/921 , @SahinurDEV https://github.com/SahinurDEV for settings persistence 911 https://github.com/TabularisDB/tabularis/pull/911 and @DhruvShah-Dev https://github.com/DhruvShah-Dev for connection string examples 925 https://github.com/TabularisDB/tabularis/pull/925 . In the wider ecosystem, @NewtTheWolf https://github.com/NewtTheWolf built Tabularium's MCP server, @wajrock https://github.com/wajrock rebuilt Explain Plan and the leaderboard page, @Badabum https://github.com/Badabum fixed ClickHouse 26.9 and @fuleinist https://github.com/fuleinist hardened the DynamoDB plugin. And thanks to @timharris777 https://github.com/timharris777 , @gh0stsh3ll56 https://github.com/gh0stsh3ll56 and @squeeze440 https://github.com/squeeze440 for reporting the MCP vulnerabilities privately. If you have ever typed % into a filter box, or let an AI client near a read-only connection, this is the upgrade. Download the latest published version from the download page https://tabularis.dev/download . Release notes and packages are available on GitHub Releases https://github.com/TabularisDB/tabularis/releases .