bump version to 12.2.7

fix: Fix regression for schema cache reloading via NOTIFY on Windows
Upstream accidentally removed the fix, which was introduced for #2524. Fixed again. (cherry picked from commit b285f5fba6)
2025-02-03 18:38:41 +01:00 · 2025-02-03 18:35:24 +01:00 · 2025-01-29 15:22:22 -05:00 · 2025-01-29 15:14:05 -05:00 · 2025-01-25 12:01:21 +01:00 · 2025-01-25 11:12:46 +01:00
34 changed files with 464 additions and 551 deletions
@@ -1,5 +1,5 @@
 freebsd_instance:
-  image_family: freebsd-14-0
+  image_family: freebsd-14-1

 build_task:
  # Don't change this name without adjusting .github/workflows/build.yaml
@@ -0,0 +1,5 @@
+# TODO: Remove this once a new actionlint release has been cut
+# and made its way to us through nixpkgs.
+self-hosted-runner:
+  labels:
+    - ubuntu-24.04-arm
@@ -112,7 +112,7 @@ runs:
        echo "artifacts=${artifacts}" >> "$GITHUB_OUTPUT"
    - name: Save artifact to GitHub Actions
      if: steps.find-task.outputs.task_found
-      uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
      with:
        name: ${{ inputs.upload }}
        path: ${{ steps.download.outputs.artifacts }}
@@ -19,14 +19,14 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+    - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      if: ${{ startsWith(github.ref, 'refs/heads/') || (inputs.save-prs && startsWith(github.ref, 'refs/pull/')) }}
      with:
        path: ${{ inputs.path }}
        key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
        restore-keys: |
          ${{ runner.os }}-${{ inputs.prefix }}-
-    - uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+    - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
      if: ${{ !startsWith(github.ref, 'refs/heads/') && !(inputs.save-prs && startsWith(github.ref, 'refs/pull/'))  }}
      with:
        path: ${{ inputs.path }}
@@ -11,7 +11,7 @@ inputs:
 runs:
  using: composite
  steps:
-    - uses: nixbuild/nix-quick-install-action@60e9c39264d4714139af3cdf15f691b19eec3530 # v28
+    - uses: nixbuild/nix-quick-install-action@25aff27c252e0c8cdda3264805f7b6bcd92c8718 # v29
      with:
        nix_conf: |-
          always-allow-substitutes = true
@@ -20,6 +20,7 @@ runs:
      with:
        name: postgrest
        authToken: ${{ inputs.authToken }}
+        skipPush: ${{ inputs.authToken == '' }}
    - if: ${{ inputs.tools }}
      run: nix-env -f default.nix -iA ${{ inputs.tools }}
      shell: bash
@@ -1,72 +0,0 @@
-#!/bin/bash
-set -Eeuo pipefail
-
-# This script builds PostgREST in a remote ARM server
-
-[ -z "$1" ] && { echo "Missing 1st argument: PostgREST github commit SHA"; exit 1; }
-[ -z "$2" ] && { echo "Missing 2nd argument: Build environment directory name"; exit 1; }
-[ -z "$3" ] && { echo "Missing 3rd argument: GHC version"; exit 1; }
-
-PGRST_GITHUB_COMMIT="$1"
-SCRIPT_DIR="$2"
-
-DOCKER_BUILD_DIR="$SCRIPT_DIR/docker-env"
-# latest is a shortcut documented on https://www.haskell.org/ghcup/guide/#tags-and-shortcuts
-CABAL_VERSION="latest"
-GHC_VERSION="$3"
-
-install_packages() {
-  sudo apt-get update -y
-  sudo apt-get upgrade -y
-  sudo apt-get install -y git build-essential curl libffi-dev libffi7 libgmp-dev libgmp10 libncurses-dev libncurses5 libtinfo5 llvm libnuma-dev zlib1g-dev libpq-dev jq gcc
-  sudo apt-get clean
-}
-
-install_ghcup() {
-  export BOOTSTRAP_HASKELL_NONINTERACTIVE=1
-  export BOOTSTRAP_HASKELL_MINIMAL=1
-  curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
-  source ~/.ghcup/env
-}
-
-install_cabal() {
-  ghcup upgrade
-  ghcup install cabal $CABAL_VERSION
-  ghcup set cabal $CABAL_VERSION
-}
-
-install_ghc() {
-  ghcup upgrade
-  ghcup install ghc $GHC_VERSION
-  ghcup set ghc $GHC_VERSION
-}
-
-install_packages
-
-# Add ghcup to the PATH for this session
-[ -f ~/.ghcup/env ] && source ~/.ghcup/env
-
-ghcup --version || install_ghcup
-ghcup set cabal $CABAL_VERSION || install_cabal
-ghcup set ghc $GHC_VERSION || install_ghc
-
-cd ~/$SCRIPT_DIR
-
-# Clone the repository and build the project
-git clone https://github.com/PostgREST/postgrest.git
-cd postgrest
-git checkout $PGRST_GITHUB_COMMIT
-cabal v2-update && cabal v2-build
-
-# Strip unused symbols from executable
-PGRST_BIN=$(cabal exec which postgrest | tail -1)
-strip $PGRST_BIN
-
-# Copy the built binary to the Dockerfile directory
-cp $PGRST_BIN ~/$DOCKER_BUILD_DIR
-
-# Move and compress the built binary
-mkdir -p ~/$SCRIPT_DIR/result
-mv $PGRST_BIN ~/$SCRIPT_DIR/result
-cd ~/$SCRIPT_DIR
-tar -cJf result.tar.xz result
@@ -1,50 +0,0 @@
-#!/bin/bash
-set -Eeuo pipefail
-
-# This script publishes the Docker ARM images to Docker Hub.
-
-[ -z "$1" ] && { echo "Missing 1st argument: PostgREST github commit SHA"; exit 1; }
-[ -z "$2" ] && { echo "Missing 2nd argument: Docker repo"; exit 1; }
-[ -z "$3" ] && { echo "Missing 3rd argument: Docker username"; exit 1; }
-[ -z "$4" ] && { echo "Missing 4th argument: Docker password"; exit 1; }
-[ -z "$5" ] && { echo "Missing 5th argument: Build environment directory name"; exit 1; }
-[ -z "$6" ] && { echo "Missing 6th argument: PostgREST version"; exit 1; }
-
-PGRST_GITHUB_COMMIT="$1"
-DOCKER_REPO="$2"
-DOCKER_USER="$3"
-DOCKER_PASS="$4"
-SCRIPT_DIR="$5"
-PGRST_VERSION="$6"
-
-DOCKER_BUILD_DIR="$SCRIPT_DIR/docker-env"
-
-clean_env()
-{
-    sudo docker logout
-}
-
-# Login to Docker
-sudo docker logout
-{ echo $DOCKER_PASS | sudo docker login -u $DOCKER_USER --password-stdin; } || { echo "Couldn't login to docker"; exit 1; }
-
-trap clean_env sigint sigterm exit
-
-# Move to the docker build environment
-cd ~/$DOCKER_BUILD_DIR
-
-# Push final images to Docker hub
-# NOTE: This command publishes a separate ARM image because the builds cannot
-#       be added to the manifest if they are not in the registry beforehand.
-#       This image must be manually deleted from Docker Hub at the end of the process.
-sudo docker buildx build --build-arg PGRST_GITHUB_COMMIT=$PGRST_GITHUB_COMMIT \
-                         -t $DOCKER_REPO/postgrest:$PGRST_VERSION-arm \
-                         --push .
-
-# Add the arm images to the manifest
-# NOTE: This assumes that there already is a `postgrest:<version>` image
-#       for the amd64 architecture pushed to Docker Hub
-sudo docker buildx imagetools create --append -t $DOCKER_REPO/postgrest:$PGRST_VERSION $DOCKER_REPO/postgrest:$PGRST_VERSION-arm
-[ "$PGRST_VERSION" != "devel" ] && sudo docker buildx imagetools create --append -t $DOCKER_REPO/postgrest:latest $DOCKER_REPO/postgrest:$PGRST_VERSION-arm
-
-sudo docker logout
@@ -30,10 +30,10 @@ concurrency:

 jobs:
  static:
-    name: Nix - Linux static
-    runs-on: ubuntu-22.04
+    name: Nix - Linux x86-64 static
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -42,27 +42,27 @@ jobs:
      - name: Build static executable
        run: nix-build -A postgrestStatic
      - name: Save built executable as artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
-          name: postgrest-linux-static-x64
+          name: postgrest-linux-static-x86-64
          path: result/bin/postgrest
          if-no-files-found: error

      - name: Build Docker image
        run: nix-build -A docker.image --out-link postgrest-docker.tar.gz
      - name: Save built Docker image as artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
-          name: postgrest-docker-x64
+          name: postgrest-docker-x86-64
          path: postgrest-docker.tar.gz
          if-no-files-found: error


  macos:
    name: Nix - MacOS
-    runs-on: macos-12
+    runs-on: macos-14
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -87,39 +87,38 @@ jobs:
      fail-fast: false
      matrix:
        include:
-          - name: Linux
-            runs-on: ubuntu-22.04
+          - name: Linux aarch64
+            runs-on: ubuntu-24.04-arm
            cache: |
              ~/.stack/pantry
              ~/.stack/snapshots
              ~/.stack/stack.sqlite3
-            # no artifact for Linux, because we use the static build
+            artifact: postgrest-ubuntu-aarch64
+            deps: sudo apt-get update && sudo apt-get install libpq-dev

          - name: MacOS
-            runs-on: macos-12
+            runs-on: macos-14
            cache: |
              ~/.stack/pantry
              ~/.stack/snapshots
              ~/.stack/stack.sqlite3
-            artifact: postgrest-macos-x64
+            artifact: postgrest-macos-aarch64
+            deps: brew link --force libpq

          - name: Windows
            runs-on: windows-2022
            cache: |
-              ~\AppData\Roaming\stack\pantry
-              ~\AppData\Local\Programs\stack\pantry
-              ~\AppData\Roaming\stack\snapshots
-              ~\AppData\Local\Programs\stack\snapshots
-              ~\AppData\Roaming\stack\stack.sqlite3
-              ~\AppData\Local\Programs\stack\stack.sqlite3
+              C:\sr\pantry
+              C:\sr\snapshots
+              C:\sr\stack.sqlite3
            deps: Add-Content $env:GITHUB_PATH $env:PGBIN
-            artifact: postgrest-windows-x64
+            artifact: postgrest-windows-x86-64

    name: Stack - ${{ matrix.name }}
    runs-on: ${{ matrix.runs-on }}
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: haskell-actions/setup@bbd90a29996ac33b1c644a42206e312fc0379748 # v2.7.9
        with:
          # This must match the version in stack.yaml's resolver
          ghc-version: 9.6.5
@@ -147,8 +146,7 @@ jobs:
      - name: Strip Executable
        run: strip result/postgrest*
      - name: Save built executable as artifact
-        if: matrix.artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: ${{ matrix.artifact }}
          path: |
@@ -159,15 +157,15 @@ jobs:

  freebsd:
    name: Stack - FreeBSD from CirrusCI
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/artifact-from-cirrus
        with:
          token: ${{ github.token }}
          task: Build FreeBSD (Stack)
          download: bin
-          upload: postgrest-freebsd-x64
+          upload: postgrest-freebsd-x86-64


  cabal:
@@ -175,11 +173,11 @@ jobs:
      matrix:
        ghc: ['9.6.4', '9.8.2']
      fail-fast: false
-    name: Cabal - Linux GHC ${{ matrix.ghc }}
-    runs-on: ubuntu-22.04
+    name: Cabal - Linux x86-64 - GHC ${{ matrix.ghc }}
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: haskell-actions/setup@bbd90a29996ac33b1c644a42206e312fc0379748 # v2.7.9
        with:
          ghc-version: ${{ matrix.ghc }}
      - name: Cache .cabal
@@ -18,9 +18,9 @@ concurrency:
 jobs:
  lint-style:
    name: Lint & Style
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -5,21 +5,10 @@ on:
    branches:
      - main
      - v[0-9]+
-    tags:
-      - devel
-      - v*
-
-concurrency:
-  # Terminate all previous runs of the same workflow for the same tag, but never
-  # cancel for the main / release branch pipelines.
-  group: ci-${{ (github.ref_type == 'tag' && github.ref) || github.run_id }}
-  # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
-  cancel-in-progress: false

 jobs:
  check:
    name: Check
-    if: startsWith(github.ref, 'refs/heads/')
    uses: ./.github/workflows/check.yaml
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
@@ -27,7 +16,6 @@ jobs:

  docs:
    name: Docs
-    if: startsWith(github.ref, 'refs/heads/')
    uses: ./.github/workflows/docs.yaml
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
@@ -35,7 +23,6 @@ jobs:

  test:
    name: Test
-    if: startsWith(github.ref, 'refs/heads/')
    uses: ./.github/workflows/test.yaml
    secrets:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
@@ -49,87 +36,21 @@ jobs:
      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}


-  arm:
-    name: Build / Cabal - aarch64 GHC 9.4.8
-    if: vars.SSH_ARM_ENABLED
-    runs-on: ubuntu-22.04
-    outputs:
-      remotepath: ${{ steps.Remote-Dir.outputs.remotepath }}
-    env:
-      GITHUB_COMMIT: ${{ github.sha }}
-      GHC_VERSION: '9.4.8'
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - id: Remote-Dir
-        name: Unique directory name for the remote build
-        run: echo "remotepath=postgrest-build-$(uuidgen)" >> "$GITHUB_OUTPUT"
-      - name: Copy script files to the remote server
-        uses: appleboy/scp-action@master
-        with:
-          host: ${{ secrets.SSH_ARM_HOST }}
-          username: ubuntu
-          key: ${{ secrets.SSH_ARM_PRIVATE_KEY }}
-          fingerprint: ${{ secrets.SSH_ARM_FINGERPRINT }}
-          source: ".github/scripts/arm/*"
-          target: ${{ steps.Remote-Dir.outputs.remotepath }}
-          strip_components: 3
-      - name: Build ARM
-        uses: appleboy/ssh-action@master
-        env:
-          REMOTE_DIR: ${{ steps.Remote-Dir.outputs.remotepath }}
-        with:
-          host: ${{ secrets.SSH_ARM_HOST }}
-          username: ubuntu
-          key: ${{ secrets.SSH_ARM_PRIVATE_KEY }}
-          fingerprint: ${{ secrets.SSH_ARM_FINGERPRINT }}
-          command_timeout: 120m
-          script_stop: true
-          envs: GITHUB_COMMIT,REMOTE_DIR,GHC_VERSION
-          script: bash ~/$REMOTE_DIR/build.sh "$GITHUB_COMMIT" "$REMOTE_DIR" "$GHC_VERSION"
-      - name: Download binaries from remote server
-        uses: nicklasfrahm/scp-action@main
-        with:
-          direction: download
-          host: ${{ secrets.SSH_ARM_HOST }}
-          username: ubuntu
-          key: ${{ secrets.SSH_ARM_PRIVATE_KEY }}
-          fingerprint: ${{ secrets.SSH_ARM_FINGERPRINT }}
-          source: "${{ steps.Remote-Dir.outputs.remotepath }}/result.tar.xz"
-          target: "result.tar.xz"
-      - name: Extract downloaded binaries
-        run: tar -xvf result.tar.xz && rm result.tar.xz
-      - name: Save aarch64 executable as artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
-        with:
-          name: postgrest-ubuntu-aarch64
-          path: result/postgrest
-          if-no-files-found: error
-
-
  tag:
-    name: Release / Tag
+    name: Tag
    concurrency:
      # Never tag outdated commits on the main branch by skipping superseded commits
      group: ci-tag-${{ (github.ref == 'refs/heads/main' && github.ref) || github.run_id }}
      # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
      cancel-in-progress: false
-    if: |
-      vars.RELEASE_ENABLED &&
-      startsWith(github.ref, 'refs/heads/') &&
-      needs.docs.result == 'success' &&
-      needs.test.result == 'success' &&
-      needs.build.result == 'success' &&
-      (needs.arm.result == 'skipped' || success())
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
+    if: vars.RELEASE_ENABLED
+    runs-on: ubuntu-24.04
    needs:
      - docs
      - test
      - build
-      - arm
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ssh-key: ${{ secrets.POSTGREST_SSH_KEY }}
      - name: Tag latest commit
@@ -147,216 +68,3 @@ jobs:
            git tag -f "devel"
            git push -f origin "devel"
          fi
-
-
-  prepare:
-    name: Release / Prepare
-    if: |
-      startsWith(github.ref, 'refs/tags/') &&
-      needs.build.result == 'success' &&
-      (needs.arm.result == 'skipped' || success())
-    runs-on: ubuntu-22.04
-    needs:
-      - build
-      - arm
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Check the version to be released
-        run: |
-          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-
-          if [ "${GITHUB_REF_NAME}" != "devel" ] && [ "${GITHUB_REF_NAME}" != "v$cabal_version" ]; then
-            echo "Tagged version ($GITHUB_REF_NAME) does not match the one in postgrest.cabal (v$cabal_version). Aborting release..."
-            exit 1
-          fi
-      - name: Identify changes from CHANGELOG.md
-        run: |
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            echo "Getting unreleased changes..."
-            sed -n "1,/## Unreleased/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          else
-            version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-            echo "Propper release, getting changes for version $version ..."
-            sed -n "1,/## \[$version\]/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          fi
-
-          echo "Relevant extract from CHANGELOG.md:"
-          cat CHANGES.md
-      - name: Save CHANGES.md as artifact
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
-        with:
-          name: release-changes
-          path: CHANGES.md
-          if-no-files-found: error
-
-
-  github:
-    name: Release / GitHub
-    permissions:
-      contents: write
-    runs-on: ubuntu-22.04
-    needs:
-      - prepare
-    if: success() || needs.prepare.result == 'success'
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Download all artifacts
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          path: artifacts
-      - name: Create release bundle with archives for all builds
-        run: |
-          find artifacts -type f -iname postgrest -exec chmod +x {} \;
-
-          mkdir -p release-bundle
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-x64.tar.xz" \
-            -C artifacts/postgrest-linux-static-x64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-macos-x64.tar.xz" \
-            -C artifacts/postgrest-macos-x64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-freebsd-x64.tar.xz" \
-            -C artifacts/postgrest-freebsd-x64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-ubuntu-aarch64.tar.xz" \
-            -C artifacts/postgrest-ubuntu-aarch64 postgrest
-
-          zip "release-bundle/postgrest-${GITHUB_REF_NAME}-windows-x64.zip" \
-            artifacts/postgrest-windows-x64/postgrest.exe
-
-      - name: Save release bundle
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
-        with:
-          name: release-bundle
-          path: release-bundle
-          if-no-files-found: error
-
-      - name: Publish release on GitHub
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Releasing version ${GITHUB_REF_NAME} on GitHub..."
-
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            # To replace the existing release, we must first delete the old assets,
-            # then modify the release, then add the new assets.
-            gh release view devel --json assets \
-              | jq -r '.assets[] | .name' \
-              | xargs -rn1 \
-              gh release delete-asset -y devel
-            gh release edit devel \
-              -t devel \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              --prerelease
-            gh release upload --clobber devel release-bundle/*
-          else
-            gh release create "${GITHUB_REF_NAME}" \
-              -t "${GITHUB_REF_NAME}" \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              release-bundle/*
-          fi
-
-
-  docker:
-    name: Release / Docker Hub
-    runs-on: ubuntu-22.04
-    needs:
-      - prepare
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER &&
-      (success() || needs.prepare.result == 'success')
-    env:
-      DOCKER_REPO: ${{ vars.DOCKER_REPO }}
-      DOCKER_USER: ${{ vars.DOCKER_USER }}
-      DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Download Docker image
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: postgrest-docker-x64
-      - name: Publish images on Docker Hub
-        run: |
-          docker login -u "$DOCKER_USER" -p "$DOCKER_PASS"
-          docker load -i postgrest-docker.tar.gz
-
-          docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-
-          # Only tag 'latest' for full releases
-          if [ "${GITHUB_REF_NAME}" != "devel" ]; then
-            echo "Pushing to 'latest' tag for full release of ${GITHUB_REF_NAME} ..."
-            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
-            docker push "$DOCKER_REPO"/postgrest:latest
-          else
-            echo "Skipping push to 'latest' tag for pre-release..."
-          fi
-
-
-  docker-description:
-    name: Release / Docker Hub Description
-    runs-on: ubuntu-22.04
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER &&
-      github.ref == 'refs/tags/devel'
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
-        with:
-          username: ${{ vars.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASS }}
-          repository: ${{ vars.DOCKER_REPO }}/postgrest
-          short-description: ${{ github.event.repository.description }}
-          readme-filepath: ./docker-hub-readme.md
-
-
-  docker-arm:
-    name: Release / Docker Hub Arm
-    runs-on: ubuntu-22.04
-    needs:
-      - arm
-      - docker
-    env:
-      GITHUB_COMMIT: ${{ github.sha }}
-      DOCKER_REPO: ${{ vars.DOCKER_REPO }}
-      DOCKER_USER: ${{ vars.DOCKER_USER }}
-      DOCKER_PASS: ${{ secrets.DOCKER_PASS }}
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Publish images for ARM builds on Docker Hub
-        uses: appleboy/ssh-action@master
-        env:
-          REMOTE_DIR: ${{ needs.arm.outputs.remotepath }}
-        with:
-          host: ${{ secrets.SSH_ARM_HOST }}
-          username: ubuntu
-          key: ${{ secrets.SSH_ARM_PRIVATE_KEY }}
-          fingerprint: ${{ secrets.SSH_ARM_FINGERPRINT }}
-          script_stop: true
-          envs: GITHUB_COMMIT,DOCKER_REPO,DOCKER_USER,DOCKER_PASS,REMOTE_DIR,GITHUB_REF_NAME
-          script: bash ~/$REMOTE_DIR/docker-publish.sh "$GITHUB_COMMIT" "$DOCKER_REPO" "$DOCKER_USER" "$DOCKER_PASS" "$REMOTE_DIR" "$GITHUB_REF_NAME"
-
-
-  clean-arm:
-    name: Build / Cleanup
-    needs:
-      - arm
-      - docker-arm
-    if: ${{ always() && vars.SSH_ARM_ENABLED }}
-    runs-on: ubuntu-22.04
-    env:
-      REMOTE_DIR: ${{ needs.arm.outputs.remotepath }}
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Remove uploaded files from server
-        uses: appleboy/ssh-action@master
-        with:
-          host: ${{ secrets.SSH_ARM_HOST }}
-          username: ubuntu
-          key: ${{ secrets.SSH_ARM_PRIVATE_KEY }}
-          fingerprint: ${{ secrets.SSH_ARM_FINGERPRINT }}
-          envs: REMOTE_DIR
-          script: rm -rf $REMOTE_DIR
@@ -25,9 +25,9 @@ concurrency:
 jobs:
  build:
    name: Build
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Setup Nix Environment
      uses: ./.github/actions/setup-nix
      with:
@@ -39,9 +39,9 @@ jobs:

  spellcheck:
    name: Spellcheck
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Setup Nix Environment
      uses: ./.github/actions/setup-nix
      with:
@@ -56,9 +56,9 @@ jobs:
  linkcheck:
    name: Linkcheck
    if: github.base_ref == 'main'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Setup Nix Environment
      uses: ./.github/actions/setup-nix
      with:
@@ -0,0 +1,202 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - devel
+      - v*
+
+concurrency:
+  # Terminate all previous runs of the same workflow for the same tag.
+  group: release-${{ github.ref }}
+  # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build
+    uses: ./.github/workflows/build.yaml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
+
+  prepare:
+    name: Prepare
+    runs-on: ubuntu-24.04
+    needs:
+      - build
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Check the version to be released
+        run: |
+          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
+
+          if [ "${GITHUB_REF_NAME}" != "devel" ] && [ "${GITHUB_REF_NAME}" != "v$cabal_version" ]; then
+            echo "Tagged version ($GITHUB_REF_NAME) does not match the one in postgrest.cabal (v$cabal_version). Aborting release..."
+            exit 1
+          fi
+      - name: Identify changes from CHANGELOG.md
+        run: |
+          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
+            echo "Getting unreleased changes..."
+            sed -n "1,/## Unreleased/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
+          else
+            version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
+            echo "Propper release, getting changes for version $version ..."
+            sed -n "1,/## \[$version\]/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
+          fi
+
+          echo "Relevant extract from CHANGELOG.md:"
+          cat CHANGES.md
+      - name: Save CHANGES.md as artifact
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: release-changes
+          path: CHANGES.md
+          if-no-files-found: error
+
+
+  github:
+    name: GitHub
+    permissions:
+      contents: write
+    runs-on: ubuntu-24.04
+    needs:
+      - prepare
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Download all artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          path: artifacts
+      - name: Create release bundle with archives for all builds
+        run: |
+          find artifacts -type f -iname postgrest -exec chmod +x {} \;
+
+          mkdir -p release-bundle
+
+          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-x86-64.tar.xz" \
+            -C artifacts/postgrest-linux-static-x86-64 postgrest
+
+          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-macos-aarch64.tar.xz" \
+            -C artifacts/postgrest-macos-aarch64 postgrest
+
+          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-freebsd-x86-64.tar.xz" \
+            -C artifacts/postgrest-freebsd-x86-64 postgrest
+
+          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-ubuntu-aarch64.tar.xz" \
+            -C artifacts/postgrest-ubuntu-aarch64 postgrest
+
+          zip --junk-paths "release-bundle/postgrest-${GITHUB_REF_NAME}-windows-x86-64.zip" \
+            artifacts/postgrest-windows-x86-64/postgrest.exe
+
+      - name: Save release bundle
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: release-bundle
+          path: release-bundle
+          if-no-files-found: error
+
+      - name: Publish release on GitHub
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          echo "Releasing version ${GITHUB_REF_NAME} on GitHub..."
+
+          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
+            # To replace the existing release, we must first delete the old assets,
+            # then modify the release, then add the new assets.
+            gh release view devel --json assets \
+              | jq -r '.assets[] | .name' \
+              | xargs -rn1 \
+              gh release delete-asset -y devel
+            gh release edit devel \
+              -t devel \
+              --verify-tag \
+              -F artifacts/release-changes/CHANGES.md \
+              --prerelease
+            gh release upload --clobber devel release-bundle/*
+          else
+            gh release create "${GITHUB_REF_NAME}" \
+              -t "${GITHUB_REF_NAME}" \
+              --verify-tag \
+              -F artifacts/release-changes/CHANGES.md \
+              release-bundle/*
+          fi
+
+
+  docker:
+    name: Docker Hub
+    runs-on: ubuntu-24.04-arm
+    needs:
+      - prepare
+    if: |
+      vars.DOCKER_REPO && vars.DOCKER_USER
+    env:
+      DOCKER_REPO: ${{ vars.DOCKER_REPO }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Download x86-64 Docker image
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: postgrest-docker-x86-64
+      - name: Download aarch64 binary
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: postgrest-ubuntu-aarch64
+      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
+      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          username: ${{ vars.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+      - name: Build aarch64 Docker image
+        run: |
+          # This only pushes the image via digest, not a tag. This will not appear
+          # in the image list on Docker Hub, yet. It will be later added to the main
+          # tag's manifest.
+          docker buildx build \
+            -t "$DOCKER_REPO/postgrest" \
+            --platform linux/arm64 \
+            --output push-by-digest=true,type=image,push=true \
+            --metadata-file metadata.json \
+            .
+          echo "SHA256_ARM=$(jq -r '."containerimage.digest"' metadata.json)" >> "$GITHUB_ENV"
+      - name: Publish images on Docker Hub
+        run: |
+          docker load -i postgrest-docker.tar.gz
+
+          docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
+          docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
+          docker buildx imagetools create --append \
+            -t "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}" \
+            "$DOCKER_REPO/postgrest@$SHA256_ARM"
+
+          # Only tag 'latest' for full releases
+          if [ "${GITHUB_REF_NAME}" != "devel" ]; then
+            echo "Pushing to 'latest' tag for full release of ${GITHUB_REF_NAME} ..."
+            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
+            docker push "$DOCKER_REPO"/postgrest:latest
+            docker buildx imagetools create --append \
+              -t "$DOCKER_REPO/postgrest:latest" \
+              "$DOCKER_REPO/postgrest@$SHA256_ARM"
+          else
+            echo "Skipping push to 'latest' tag for pre-release..."
+          fi
+
+
+  docker-description:
+    name: Docker Hub Description
+    runs-on: ubuntu-24.04
+    if: |
+      vars.DOCKER_REPO && vars.DOCKER_USER &&
+      github.ref == 'refs/tags/devel'
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
+        with:
+          username: ${{ vars.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASS }}
+          repository: ${{ vars.DOCKER_REPO }}/postgrest
+          short-description: ${{ github.event.repository.description }}
+          readme-filepath: ./docker-hub-readme.md
+
@@ -1,39 +0,0 @@
-name: Upload Reports
-
-on:
-  workflow_run:
-    workflows:
-      - CI
-      - Test
-    branches-ignore:
-      - devel
-      - v[0-9]+
-      - v[0-9]+.[0-9]+.[0-9]+
-    types:
-      - completed
-
-jobs:
-  loadtest:
-    name: Loadtest
-    permissions:
-      checks: write
-    runs-on: ubuntu-22.04
-    if: github.event.workflow_run.conclusion == 'success' || github.event.workflow_run.conclusion == 'failure'
-    steps:
-      - name: Download from Artifacts
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          github-token: ${{ github.token }}
-          run-id: ${{ github.event.workflow_run.id }}
-          name: loadtest.md
-          path: artifacts
-      - name: Upload to GitHub Checks
-        uses: LouisBrunner/checks-action@6b626ffbad7cc56fd58627f774b9067e6118af23 # v2.0.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          sha: ${{ github.event.workflow_run.head_sha }}
-          name: Loadtest Results
-          conclusion: neutral
-          output: |
-            {"summary":""}
-          output_text_description_file: artifacts/loadtest.md
@@ -32,14 +32,14 @@ concurrency:
 jobs:
  coverage:
    name: Coverage
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    defaults:
      run:
        # Hack for enabling color output, see:
        # https://github.com/actions/runner/issues/241#issuecomment-842566950
        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -49,7 +49,7 @@ jobs:
      - name: Run coverage (IO tests and Spec tests against PostgreSQL 15)
        run: postgrest-coverage
      - name: Upload coverage to codecov
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
        with:
          files: ./coverage/codecov.json
          token: ${{ secrets.CODECOV_TOKEN }}
@@ -69,14 +69,14 @@ jobs:
      matrix:
        pgVersion: ["9_6", 10, 11, 12, 13, 14, 15, 16]
    name: PG ${{ matrix.pgVersion }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    defaults:
      run:
        # Hack for enabling color output, see:
        # https://github.com/actions/runner/issues/241#issuecomment-842566950
        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -98,9 +98,9 @@ jobs:

  memory:
    name: Memory
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Setup Nix Environment
        uses: ./.github/actions/setup-nix
        with:
@@ -112,9 +112,9 @@ jobs:

  loadtest:
    name: Loadtest
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Setup Nix Environment
@@ -129,10 +129,4 @@ jobs:
      - name: Run loadtest
        run: |
          postgrest-loadtest-against main ${{ steps.get-latest-tag.outputs.tag }}
-          postgrest-loadtest-report > loadtest/loadtest.md
-      - name: Upload report
-        uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
-        with:
-          name: loadtest.md
-          path: loadtest/loadtest.md
-          if-no-files-found: error
+          postgrest-loadtest-report >> "$GITHUB_STEP_SUMMARY"
@@ -5,6 +5,31 @@ This project adheres to [Semantic Versioning](http://semver.org/).

 ## Unreleased

+## [12.2.7] - 2025-02-03
+
+### Fixed
+
+ - #2524, Fix schema reloading notice on windows - @diogob
+
+## [12.2.6] - 2025-01-29
+
+### Fixed
+
+ - #3788, Fix jwt cache does not remove expired entries - @taimoorzaeem
+
+## [12.2.5] - 2025-01-20
+
+### Fixed
+
+ - #3867, Fix startup for arm64 docker image - @wolfgangwalther
+
+## [12.2.4] - 2025-01-18
+
+### Fixed
+
+ - #3779, Always log the schema cache load time - @steve-chavez
+ - #3706, Fix insert with `missing=default` uses default value of domain instead of column - @taimoorzaeem
+
 ## [12.2.3] - 2024-08-01

 ### Fixed
@@ -1,6 +1,8 @@
-# PostgREST docker hub image
+# PostgREST Docker Hub image for aarch64.
+# The x86-64 is a single-static-binary image built via Nix, see:
+# nix/tools/docker/README.md

-FROM ubuntu:noble@sha256:2e863c44b718727c860746568e1d54afd13b2fa71b160f5cd9058fc436217b30 AS postgrest
+FROM ubuntu:noble@sha256:80dd3c3b9c6cecb9f1667e9290b3bc61b78c2678c02cbdae5f0fea92cc6734ab AS postgrest

 RUN apt-get update -y \
    && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \
@@ -8,6 +10,7 @@ RUN apt-get update -y \
    && rm -rf /var/lib/apt/lists/*

 COPY postgrest /usr/bin/postgrest
+RUN chmod +x /usr/bin/postgrest

 EXPOSE 3000

@@ -1 +1 @@
-index-state: hackage.haskell.org 2024-05-17T23:41:49Z
+index-state: hackage.haskell.org 2025-02-01T14:59:33Z
@@ -218,7 +218,6 @@ Here are some companies that use PostgREST in production.
  - See how Nimbus uses PostgREST in `Paul Copplestone's blog post <https://paul.copplest.one/blog/nimbus-tech-2019-04.html>`_.
 * `OpenBooking <https://openbooking.ch>`_
 * `Redsmin <https://www.redsmin.com>`_
-* `Sompani <https://www.sompani.com>`_
 * `Supabase <https://supabase.com>`_

 .. Failing links
@@ -71,6 +71,40 @@ The function parameter names match the JSON object keys in the POST case, for th

 .. _function_single_json:

+Functions with an array of JSON objects
+----------------------------------------------
+
+If you want to pass multiple JSON objects to a Postgres function (an array of objects), you can create a function with a parameter of type ``json`` or ``jsonb``.
+
+Within the curl request, this JSON must be embedded in an object where they key matches the same name as the function's ``json`` or ``jsonb`` parameter.
+This will allow you to loop over the array of JSON objects within the Postgres function.
+
+This practice may allow you to reduce the number of ``curl`` requests required to accomplish a task.
+
+For instance, assume we have created this function in the database.
+
+.. code-block:: postgres
+
+  CREATE FUNCTION update_data(p_json jsonb)
+  RETURNS void AS $$
+  DECLARE
+    json_item json;
+  BEGIN
+    FOR json_item IN SELECT jsonb_array_elements(p_json) LOOP
+      UPDATE data_table SET data_text_column = (json_item->>'data_text')::text 
+        WHERE data_int_column = (json_item->>'data_int')::integer;
+    END LOOP;
+  END;
+  $$ LANGUAGE SQL IMMUTABLE;
+
+A ``curl`` request using the POST method would look like the following:
+
+.. code-block:: bash
+
+  curl "http://localhost:3000/rpc/update_data" \
+    -X POST -H "Content-Type: application/json" \
+    -d '{ "p_json": [ { "data_text": "one", "data_int": "1" }, { "data_text": "two", "data_int": "2" } ] }'
+
 Functions with a single unnamed JSON parameter
 ----------------------------------------------

@@ -623,18 +623,34 @@ You can make an upsert with :code:`POST` and the :code:`Prefer: resolution=merge

 .. code-block:: bash

-  curl "http://localhost:3000/employees" \
+  curl "http://localhost:3000/products" \
    -X POST -H "Content-Type: application/json" \
    -H "Prefer: resolution=merge-duplicates" \
    -d @- << EOF
    [
-      { "id": 1, "name": "Old employee 1", "salary": 30000 },
-      { "id": 2, "name": "Old employee 2", "salary": 42000 },
-      { "id": 3, "name": "New employee 3", "salary": 50000 }
+      { "sku": "CL2031", "name": "Existing T-shirt", "price": 35 },
+      { "sku": "CL2040", "name": "Existing Hoodie", "price": 60 },
+      { "sku": "AC1022", "name": "New Cap", "price": 30 }
    ]
  EOF

-By default, upsert operates based on the primary key columns, you must specify all of them. You can also choose to ignore the duplicates with :code:`Prefer: resolution=ignore-duplicates`. This works best when the primary key is natural, but it's also possible to use it if the primary key is surrogate (example: "id serial primary key"). For more details read `this issue <https://github.com/PostgREST/postgrest/issues/1118>`_.
+By default, upsert operates based on the primary key columns, so you must specify all of them.
+You can also choose to ignore the duplicates with :code:`Prefer: resolution=ignore-duplicates`.
+Upsert works best when the primary key is natural (e.g. ``sku``).
+However, it can work with surrogate primary keys (e.g. ``id serial primary key``), if you also do a :ref:`bulk_insert_default`:
+
+.. code-block:: bash
+
+  curl "http://localhost:3000/employees?colums=id,name,salary" \
+    -X POST -H "Content-Type: application/json" \
+    -H "Prefer: resolution=merge-duplicates, missing=default" \
+    -d @- << EOF
+    [
+      { "id": 1, "name": "Existing employee 1", "salary": 30000 },
+      { "id": 2, "name": "Existing employee 2", "salary": 42000 },
+      { "name": "New employee 3", "salary": 50000 }
+    ]
+  EOF

 .. important::
  After creating a table or changing its primary key, you must refresh PostgREST schema cache for upsert to work properly. To learn how to refresh the cache see :ref:`schema_reloading`.
@@ -6,4 +6,4 @@ sphinx-rtd-dark-mode>=1.3.0
 sphinx-tabs>=3.2.0
 sphinx>=5.0.2
 sphinxext-opengraph==0.9.1
-urllib3==2.2.2
+urllib3==2.2.3
@@ -2,7 +2,7 @@
 {
  owner = "NixOS";
  repo = "nixpkgs";
-  date = "2024-04-20";
-  rev = "92d295f588631b0db2da509f381b4fb1e74173c5";
-  tarballHash = "162w28y4i5c8g5qhjvs827qxphf2a8n4c8fwhcywzl1j1a35h2im";
+  date = "2024-05-29";
+  rev = "a15e8d1b3d9e6496c4a3214e2104f6d28dfa7df7";
+  tarballHash = "sha256:0r4a4165f4n1zlpnyjrdrwrg86n1b6g3axsdh3j5iizpmjrlxmd7";
 }
@@ -57,7 +57,14 @@ let
          }
          { });

-      hasql-pool = lib.dontCheck prev.hasql-pool_1_0_1;
+      hasql-pool = lib.dontCheck (prev.callHackageDirect
+        {
+          pkg = "hasql-pool";
+          ver = "1.0.1";
+          sha256 = "sha256-Hf1f7lX0LWkjrb25SDBovCYPRdmUP1H6pAxzi7kT4Gg=";
+        }
+        { }
+      );

      postgresql-libpq = lib.dontCheck
        (prev.postgresql-libpq.override {
@@ -67,8 +74,8 @@ let
      hasql-notifications = lib.dontCheck (prev.callHackageDirect
        {
          pkg = "hasql-notifications";
-          ver = "0.2.2.0";
-          sha256 = "sha256-73OQ9/su2qvO7HavF3xuuNWLXSXyB9reBUQDaHys06I=";
+          ver = "0.2.2.2";
+          sha256 = "sha256-myKwlug7OgTa/qP6mHfCD+5Q8IhM17JvpJBfSo+M01k=";
        }
        { }
      );
@@ -1,5 +1,5 @@
 name:               postgrest
-version:            12.2.3
+version:            12.2.7
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                    for tables, views, and functions, supporting all HTTP methods that security
@@ -110,7 +110,7 @@ library
                    , gitrev                    >= 1.2 && < 1.4
                    , hasql                     >= 1.6.1.1 && < 1.7
                    , hasql-dynamic-statements  >= 0.3.1 && < 0.4
-                    , hasql-notifications       >= 0.2.2.0 && < 0.3
+                    , hasql-notifications       >= 0.2.2.2 && < 0.2.3
                    , hasql-pool                >= 1.0.1 && < 1.1
                    , hasql-transaction         >= 1.0.1 && < 1.1
                    , heredoc                   >= 0.2 && < 0.3
@@ -135,10 +135,33 @@ getJWTFromCache appState token maxLifetime parseJwt utc = do
  authResult <- maybe parseJwt (pure . Right) checkCache

  case (authResult,checkCache) of
-    (Right res, Nothing) -> C.insert' (getJwtCache appState) (getTimeSpec res maxLifetime utc) token res
+    -- From comment:
+    -- https://github.com/PostgREST/postgrest/pull/3801#discussion_r1857987914
+    --
+    -- We purge expired cache entries on a cache miss
+    -- The reasoning is that:
+    --
+    -- 1. We expect it to be rare (otherwise there is no point of the cache)
+    -- 2. It makes sure the cache is not growing (as inserting new entries
+    --    does garbage collection)
+    -- 3. Since this is time expiration based cache there is no real risk of
+    --    starvation - sooner or later we are going to have a cache miss.
+
+    (Right res, Nothing) -> do -- cache miss
+
+      let timeSpec = getTimeSpec res maxLifetime utc
+
+      -- purge expired cache entries
+      C.purgeExpired jwtCache
+
+      -- insert new cache entry
+      C.insert' jwtCache timeSpec token res
+
    _                    -> pure ()

  return authResult
+    where
+      jwtCache = getJwtCache appState

 -- Used to extract JWT exp claim and add to JWT Cache
 getTimeSpec :: AuthResult -> Int -> UTCTime -> Maybe TimeSpec
@@ -87,9 +87,6 @@ observationLogger loggerState logLevel obs = case obs of
  o@(HasqlPoolObs _) -> do
    when (logLevel >= LogDebug) $ do
      logWithZTime loggerState $ observationMessage o
-  o@(SchemaCacheLoadedObs _) -> do
-    when (logLevel >= LogDebug) $ do
-      logWithZTime loggerState $ observationMessage o
  PoolRequest ->
    pure ()
  PoolRequestFullfilled ->
@@ -818,20 +818,20 @@ tablesSqlQuery pgVer =
    columnDefault -- typbasetype and typdefaultbin handles `CREATE DOMAIN .. DEFAULT val`,  attidentity/attgenerated handles generated columns, pg_get_expr gets the default of a column
      | pgVer >= pgVersion120 = [q|
          CASE
-            WHEN t.typbasetype  != 0  THEN pg_get_expr(t.typdefaultbin, 0)
+            WHEN (t.typbasetype != 0) AND (ad.adbin IS NULL) THEN pg_get_expr(t.typdefaultbin, 0)
            WHEN a.attidentity  = 'd' THEN format('nextval(%s)', quote_literal(seqsch.nspname || '.' || seqclass.relname))
            WHEN a.attgenerated = 's' THEN null
            ELSE pg_get_expr(ad.adbin, ad.adrelid)::text
          END|]
      | pgVer >= pgVersion100 = [q|
          CASE
-            WHEN t.typbasetype  != 0  THEN pg_get_expr(t.typdefaultbin, 0)
+            WHEN (t.typbasetype != 0) AND (ad.adbin IS NULL) THEN pg_get_expr(t.typdefaultbin, 0)
            WHEN a.attidentity = 'd' THEN format('nextval(%s)', quote_literal(seqsch.nspname || '.' || seqclass.relname))
            ELSE pg_get_expr(ad.adbin, ad.adrelid)::text
          END|]
      | otherwise  = [q|
          CASE
-            WHEN t.typbasetype  != 0  THEN pg_get_expr(t.typdefaultbin, 0)
+            WHEN (t.typbasetype != 0) AND (ad.adbin IS NULL) THEN pg_get_expr(t.typdefaultbin, 0)
            ELSE pg_get_expr(ad.adbin, ad.adrelid)::text
          END|]

@@ -19,6 +19,6 @@ nix:
 extra-deps:
  - configurator-pg-0.2.10
  - fuzzyset-0.2.4
-  - hasql-notifications-0.2.2.0
+  - hasql-notifications-0.2.2.2
  - hasql-pool-1.0.1
  - postgresql-libpq-0.10.1.0
@@ -19,12 +19,12 @@ packages:
  original:
    hackage: fuzzyset-0.2.4
 - completed:
-    hackage: hasql-notifications-0.2.2.0@sha256:a4e591ef3f06647b056567d3b66948c4a85371f05deb5434edb6ce190f7c845d,2021
+    hackage: hasql-notifications-0.2.2.2@sha256:d1d6bc0d3ee5e418fc12ea023b78739e0decba6c34e2b43bec55b89e18bd4412,2025
    pantry-tree:
-      sha256: bd7192a5e82ef6dbac711c3433408a0330c8db1cd3482be1ccd4fbd0a63bc2f6
+      sha256: 83a9cbb179b1efd0b2acd6509583c7afcdbe63469ab033d8581d48d675a80b44
      size: 452
  original:
-    hackage: hasql-notifications-0.2.2.0
+    hackage: hasql-notifications-0.2.2.2
 - completed:
    hackage: hasql-pool-1.0.1@sha256:3cfb4c7153a6c536ac7e126c17723e6d26ee03794954deed2d72bcc826d05a40,2302
    pantry-tree:
@@ -11,5 +11,5 @@ nix:

 extra-deps:
  - fuzzyset-0.2.4
-  - hasql-notifications-0.2.2.0
+  - hasql-notifications-0.2.2.2
  - hasql-pool-1.0.1
@@ -12,12 +12,12 @@ packages:
  original:
    hackage: fuzzyset-0.2.4
 - completed:
-    hackage: hasql-notifications-0.2.2.0@sha256:a4e591ef3f06647b056567d3b66948c4a85371f05deb5434edb6ce190f7c845d,2021
+    hackage: hasql-notifications-0.2.2.2@sha256:d1d6bc0d3ee5e418fc12ea023b78739e0decba6c34e2b43bec55b89e18bd4412,2025
    pantry-tree:
-      sha256: bd7192a5e82ef6dbac711c3433408a0330c8db1cd3482be1ccd4fbd0a63bc2f6
+      sha256: 83a9cbb179b1efd0b2acd6509583c7afcdbe63469ab033d8581d48d675a80b44
      size: 452
  original:
-    hackage: hasql-notifications-0.2.2.0
+    hackage: hasql-notifications-0.2.2.2
 - completed:
    hackage: hasql-pool-1.0.1@sha256:3cfb4c7153a6c536ac7e126c17723e6d26ee03794954deed2d72bcc826d05a40,2302
    pantry-tree:
@@ -1596,3 +1596,51 @@ def test_schema_cache_startup_load_with_in_db_config(defaultenv, metapostgrest):
    response = metapostgrest.session.post("/rpc/reset_db_schemas_config")
    assert response.text == ""
    assert response.status_code == 204
+
+
+def test_jwt_cache_purges_expired_entries(defaultenv):
+    "test expired cache entries are purged on cache miss"
+
+    # The verification of actual cache size reduction is done manually, see https://github.com/PostgREST/postgrest/pull/3801#issuecomment-2620776041
+    # This test is written for code coverage of purgeExpired function
+
+    relativeSeconds = lambda sec: int(
+        (datetime.now(timezone.utc) + timedelta(seconds=sec)).timestamp()
+    )
+
+    headers = lambda sec: jwtauthheader(
+        {"role": "postgrest_test_author", "exp": relativeSeconds(sec)},
+        SECRET,
+    )
+
+    env = {
+        **defaultenv,
+        "PGRST_JWT_CACHE_MAX_LIFETIME": "86400",
+        "PGRST_JWT_SECRET": SECRET,
+        "PGRST_DB_CONFIG": "false",
+    }
+
+    with run(env=env) as postgrest:
+
+        # Generate two unique JWT tokens
+        # The 1 second sleep is needed for it generate a unique token
+        hdrs1 = headers(5)
+        postgrest.session.get("/authors_only", headers=hdrs1)
+
+        time.sleep(1)
+
+        hdrs2 = headers(5)
+        postgrest.session.get("/authors_only", headers=hdrs2)
+
+        # Wait 5 seconds for the tokens to expire
+        time.sleep(5)
+
+        hdrs3 = headers(5)
+
+        # Make another request which should cause a cache miss and so
+        # the purgeExpired function will be triggered.
+        #
+        # This should remove the 2 expired tokens but adds another to cache
+        response = postgrest.session.get("/authors_only", headers=hdrs3)
+
+        assert response.status_code == 200
@@ -579,6 +579,15 @@ spec actualPgVersion = do
              , matchHeaders = ["Preference-Applied" <:> "missing=default, return=representation"]
              }

+        it "inserts a COLUMN default before a DOMAIN default with missing=default" $
+          request methodPost "/evil_friends_with_column_default?columns=id,name" [("Prefer", "return=representation"), ("Prefer", "missing=default")]
+              [json| { "name": "Demon" } |]
+            `shouldRespondWith`
+              [json| [{"id": 420, "name": "Demon"}] |]
+              { matchStatus  = 201
+              , matchHeaders = ["Preference-Applied" <:> "missing=default, return=representation"]
+              }
+
    it "inserts json that has duplicate keys" $ do
      request methodPost "/tbl_w_json" [("Prefer", "return=representation")]
          [json| { "data": { "a": 1, "a": 2 }, "id": 3 } |]
@@ -3319,6 +3319,11 @@ create table evil_friends(
 , name text
 );

+create table evil_friends_with_column_default(
+  id   devil_int default 420
+, name text
+);
+
 create table bets (
  id int
 , data_json  json
Author	SHA1	Message	Date
Wolfgang Walther	ec83d08be6	bump version to 12.2.7	2025-02-03 18:38:41 +01:00
Diogo BiazusandWolfgang Walther	c026d0752f	fix: Fix regression for schema cache reloading via NOTIFY on Windows Upstream accidentally removed the fix, which was introduced for #2524. Fixed again. (cherry picked from commit `b285f5fba6`)	2025-02-03 18:35:24 +01:00
steve-chavez	dc96cdb0c3	bump version to 12.2.6	2025-01-29 15:22:22 -05:00
Taimoor Zaeemandsteve-chavez	89be285e6a	fix: jwt cache is not purged (#3801 )	2025-01-29 15:14:05 -05:00
renovate[bot]andWolfgang Walther	c6b4fca160	chore(deps): update codecov/codecov-action action to v5.3.1	2025-01-25 12:01:21 +01:00
renovate[bot]andWolfgang Walther	31cccd3264	chore(deps): update codecov/codecov-action action to v5.3.0	2025-01-25 11:12:46 +01:00
Wolfgang Walther	0bec15fb71	bump version to 12.2.5	2025-01-20 18:24:51 +01:00
Wolfgang Walther	cc22da5a02	fix: Make postgrest binary in arm64 docker image executable This happened in `06aebfaa` and caused the arm64 docker image to not start up properly. Resolves #3867	2025-01-20 18:24:06 +01:00
Wolfgang Walther	4d477d6e12	bump version to 12.2.4	2025-01-18 19:01:16 +01:00
Wolfgang Walther	aff2a78aac	Revert "ci: Remove brew install libpq for macos-14 stack build" This partially reverts commit `53164453d8`.	2025-01-18 19:01:16 +01:00
Wolfgang Walther	868f4a066b	ci: Fix stack cache on Windows Apparently the STACK_ROOT has been moved to C:\sr - for unknown reasons, at least to me. This should enable caching again and make the stack on windows builds much faster than recently.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	2c04b98dd9	ci: Split ci into ci and release workflows This is now possible, after we moved to the ARM build to the GitHub runners.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	71c73b20ca	ci: Remove left-over permissions setting from tag job This has been replaced by using the SSH key.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	0160b6f370	ci: Display loadtest results in step summary Much easier to implement and should be easier to find, too.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	038c05447a	ci: Build the ubuntu-aarch64 binary with new ARM runners The new GitHub arm runners are available, so we can use them to build the ubuntu aarch64 binary instead of our custom machine.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	5d5ee71dce	ci: Skip cachix push when no cachix token is set This happens in forks.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	f09b4f4b7d	ci: Remove brew install libpq for macos-14 stack build When macos-14 was rolled out libpq was not installed, but by now it is by default. Thus, we don't need to do that, it only creates a warning annotation right now.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	d3f9de528c	ci: Fix release name of x86-64 binaries This should have been x86-64, only x64 is not a thing.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	c3f88d7a1d	ci: Fix release name of macos binary This is built on macos-14, which is running on new arm based hardware, not the old x86_64 ones.	2025-01-18 17:54:42 +01:00
Wolfgang Walther	164e6a601f	ci: Update stack builder to ubuntu 24.04 Renovate doesn't seem to pick this up, because it's in a matrix specification.	2025-01-18 17:54:42 +01:00
Andrei DziahelandWolfgang Walther	c135a30515	ci: drop directories from windows release Puts windows release in line with others which have the executable on the top level	2025-01-18 17:54:32 +01:00
renovate[bot]andWolfgang Walther	7515eb5490	chore(deps): update all dependencies	2025-01-17 20:59:24 +01:00
renovate[bot]andWolfgang Walther	629b57337c	chore(deps): update haskell-actions/setup action to v2.7.8	2024-12-30 16:31:53 +01:00
M. Taimoor ZaeemandWolfgang Walther	9fcbf994cb	fix: insert with missing=default uses column default before using domain default	2024-12-25 11:43:34 +01:00
renovate[bot]andWolfgang Walther	7b9027ea0a	chore(deps): update all dependencies	2024-12-20 20:00:36 +01:00
renovate[bot]andWolfgang Walther	0a7ae1815c	chore(deps): update dependency macos to v14	2024-12-18 13:52:31 +01:00
renovate[bot]andWolfgang Walther	06014047cb	chore(deps): update actions/upload-artifact action to v4.5.0	2024-12-18 12:56:42 +01:00
renovate[bot]andWolfgang Walther	7feb755521	chore(deps): update all dependencies	2024-12-06 09:48:27 +01:00
renovate[bot]andWolfgang Walther	a0e7c4f591	chore(deps): update ubuntu:noble docker digest to 80dd3c3	2024-12-04 08:45:16 +01:00
renovate[bot]andWolfgang Walther	572f24901e	chore(deps): update codecov/codecov-action action to v5.0.7	2024-11-21 21:26:15 +01:00
renovate[bot]andWolfgang Walther	1e599a2319	chore(deps): update codecov/codecov-action action to v5.0.5	2024-11-20 19:36:28 +01:00
steve-chavezandWolfgang Walther	4e9601d155	fix: always show schema cache load time It used to be that this was only enabled with log-level=debug. But the default log-level is misleading, for example: ``` $ PGRST_DB_SCHEMAS="apflora" postgrest-with-postgresql-16 -f test/io/big_schema.sql postgrest-run ... 13/Nov/2024:22:08:20 -0500: Config reloaded 13/Nov/2024:22:08:20 -0500: Schema cache queried in 36.3 milliseconds 13/Nov/2024:22:08:20 -0500: Schema cache loaded 326 Relations, 305 Relationships, 7 Functions, 0 Domain Representations, 4 Media Type Handlers, 1194 Timezones ``` The "Schema cache loaded" can take a while to appear, yet the 22:08:20 time is the same. If we reveal the load time this is clarified: ``` 13/Nov/2024:22:08:37 -0500: Schema cache loaded in 16770.1 milliseconds ```	2024-11-16 22:41:44 +01:00
renovate[bot]andWolfgang Walther	53ce2df33a	chore(deps): update ubuntu:noble docker digest to 278628f	2024-11-16 22:41:14 +01:00
Laurence IslaandWolfgang Walther	c7152787b9	docs: clarify usage of upsert with surrogate primary keys	2024-11-16 13:16:35 +01:00
renovate[bot]andWolfgang Walther	4d4f93da40	chore(deps): update codecov/codecov-action action to v5.0.2	2024-11-15 18:54:10 +01:00
renovate[bot]andWolfgang Walther	cb22931015	chore(deps): update codecov/codecov-action action to v5	2024-11-14 19:39:58 +01:00
renovate[bot]andWolfgang Walther	4cc09c6b42	chore(deps): update all dependencies	2024-11-06 19:43:33 +01:00
Wolfgang WaltherandWolfgang Walther	3379ee3483	chore(deps): Update nixpkgs to unstable 2024-05-29 This makes actionlint happy about the new ubuntu runners.	2024-11-06 17:35:55 +01:00
Wolfgang Walther	fc7f715aeb	ci: Update cirrus' freebsd image to 14.1 This should fix CI which is failing lately like this: https://cirrus-ci.com/task/4665005218463744 ld-elf.so.1: /lib/libc.so.7: version FBSD_1.8 required by /usr/local/bin/stack not found	2024-10-26 14:52:13 +02:00
renovate[bot]andWolfgang Walther	ec568efd06	chore(deps): update all dependencies	2024-10-24 05:10:55 +02:00
Wolfgang Walther	5b755b2877	docs: Remove broken link https://github.com/PostgREST/postgrest/actions/runs/11136795565/job/30949162312	2024-10-04 16:02:33 +02:00
renovate[bot]andWolfgang Walther	f1453f3c37	chore(deps): update ubuntu:noble docker digest to dfc1087	2024-09-18 20:01:57 +02:00
renovate[bot]andWolfgang Walther	9100ba3b70	chore(deps): update dependency urllib3 to v2.2.3	2024-09-12 21:01:08 +02:00
renovate[bot]andWolfgang Walther	6fe82d9e94	chore(deps): update actions/upload-artifact action to v4.4.0	2024-09-04 13:29:55 +02:00
Jason CloseandGitHub	1fff248c78	docs: rpc example for array of json objects This change adds an explanation of how to handle an array of JSON objects within an RPC call. To pass multiple objects, an array of JSON objects must be the JSON value, with the key being the json or jsonb variable name of the Postgres function. For people who want to perform multiple tasks/inserts/updates within a single API call, this is a needed explanation for that use-case.	2024-08-23 13:00:19 -05:00
renovate[bot]andWolfgang Walther	f5264c5aa3	chore(deps): update ubuntu:noble docker digest to 8a37d68	2024-08-18 14:04:26 +02:00
renovate[bot]andLaurence Isla	5de55ea141	chore(deps): update all dependencies	2024-08-13 13:25:12 -05:00
renovate[bot]andWolfgang Walther	1ef83d3732	chore(deps): update actions/upload-artifact action to v4.3.5	2024-08-02 21:07:44 +02:00