chore(deps): update actions/checkout action to v7.0.1

This was used by CI, which is disabled on this branch.

Removing to prevent useless auto-updates by renovate.

.cirrus.yml

@@ -1,5 +1,5 @@
 freebsd_instance:
-  image_family: freebsd-14-3
+  image_family: freebsd-14-2
 
 build_task:
   # Don't change this name without adjusting .github/workflows/build.yaml
@@ -35,7 +35,7 @@ build_task:
       - find main src -type f -iname '*.hs' -exec md5sum "{}" +
 
   build_script: |
-    stack build -j 1 --local-bin-path . --copy-bins
+    stack build -j 1 --local-bin-path . --copy-bins --stack-yaml stack-21.7.yaml
     strip postgrest
 
   bin_artifacts:

.editorconfig

@@ -1,9 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_size = 2
-indent_style = space
-insert_final_newline = true
-trim_trailing_whitespace = true

.github/CONTRIBUTING.md

@@ -0,0 +1,55 @@
+# Contributing to PostgREST
+
+**First:** if you're unsure or afraid of _anything_, just ask or
+submit the issue or pull request anyways. You won't be yelled at
+for giving your best effort. The worst that can happen is that
+you'll be politely asked to change something. We appreciate any
+sort of contributions, and don't want a wall of rules to get in the
+way of that.
+
+However, for those individuals who want a bit more guidance on the
+best way to contribute to the project, read on. This document will
+cover what we're looking for. By addressing all the points we're
+looking for, it raises the chances we can quickly merge or address
+your contributions.
+
+## Issues
+
+For questions on how to use PostgREST, please use
+[GitHub discussions](https://github.com/PostgREST/postgrest/discussions).
+
+### Reporting an Issue
+
+* Make sure you test against the latest [stable release](https://github.com/PostgREST/postgrest/releases/latest)
+  and also against the latest [nightly release](https://github.com/PostgREST/postgrest/releases/tag/nightly).
+  It is possible we already fixed the bug you're experiencing.
+
+* Provide steps to reproduce the issue, including your OS version and
+  the specific database schema that you are using.
+
+* Please include SQL logs for issues involving runtime problems. To obtain logs first
+  [enable logging all statements](http://www.microhowto.info/howto/log_all_queries_to_a_postgresql_server.html),
+  then [find your logs](http://blog.endpoint.com/2014/11/dear-postgresql-where-are-my-logs.html).
+
+* If your database schema has changed while the PostgREST server is running,
+  [send the server a `SIGUSR1` signal](http://postgrest.org/en/latest/admin.html#schema-reloading) or restart it to ensure the schema cache
+  is not stale. This sometimes fixes apparent bugs.
+
+## Code
+
+We have a fully nix-based development environment with many tools for a smooth development workflow available.
+Check the [development docs](https://github.com/PostgREST/postgrest/blob/main/nix/README.md) on how to set it up and use it.
+
+### Haskell Conventions
+
+* All contributions must pass the tests before being merged. When
+  you create a pull request your code will automatically be tested.
+
+* All code must also pass [hlint](http://community.haskell.org/~ndm/hlint/) and [stylish-haskell](https://github.com/jaspervdj/stylish-haskell)
+  with no warnings. This helps enforce a uniform style for all committers. Continuous integration will check this as well on every
+  pull request. There are useful tools in the nix-shell that help with checking this locally. You can run `postgrest-check` to do this manually but
+  we recommend adding it to `.git/hooks/pre-commit` as `nix-shell --run postgrest-check` to automatically check this before doing a commit.
+
+### Running Tests
+
+For instructions on running tests, see the [development docs](https://github.com/PostgREST/postgrest/blob/main/nix/README.md#testing).

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,17 @@
+<!--
+Before reporting a bug:
+If your database schema has changed while the PostgREST server is running,
+send the server a SIGUSR1 signal or restart it(http://postgrest.org/en/stable/admin.html#schema-reloading)
+to ensure the schema cache is not stale. This sometimes fixes apparent bugs.
+-->
+### Environment
+
+* PostgreSQL version: (if using docker, specify the image)
+* PostgREST version: (if using docker, specify the image)
+* Operating system:
+
+### Description of issue
+
+(Expected behavior vs actual behavior)
+
+(Steps to reproduce: Include a minimal SQL definition plus how you make the request to PostgREST and the response body)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,28 +0,0 @@
----
-name: Bug report
-about: Create a bug report to help us improve
-type: Bug
-title: ''
-labels: ''
-assignees: ''
-
----
-
-<!--
-Before reporting a bug:
-If your database schema has changed while the PostgREST server is running,
-send the server a SIGUSR1 signal or restart it (http://postgrest.org/en/stable/admin.html#schema-reloading) to ensure the schema cache is not stale. This sometimes fixes apparent bugs.
--->
-### Environment
-
-* PostgreSQL version: (if using docker, specify the image)
-* PostgREST version: (if using docker, specify the image)
-* Operating system:
-
-### Description of issue
-
-Describe the behavior you expected vs the actual behavior. Include:
-
-- A minimal SQL definition.
-- How you make the request to PostgREST (curl command preferred).
-- The PostgREST response.

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +0,0 @@
-blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,17 +0,0 @@
----
-name: Feature request
-about: Suggest an enhancement for this project
-type: Feature
-title: ''
-labels: ''
-assignees: ''
-
----
-
-## Problem
-
-A clear and concise description of what the problem is.
-
-## Solution
-
-A clear and concise description of what you want to happen.

.github/PULL_REQUEST_TEMPLATE.md

@@ -4,18 +4,17 @@ When submitting a new feature or fix:
 - Add a new entry to the CHANGELOG - https://github.com/PostgREST/postgrest/blob/main/CHANGELOG.md#unreleased
 - If relevant, update the docs
 - Use a prefix for the PR title or commits, e.g. "fix: description of the fix".
-  + `add`, Add a new feature
-  + `amend`, To amend an unrealease commit
-  + `change`, Breaking changes
-  + `chore`, Maintenance, update sponsors, changelog, readme etc
-  + `ci`, CI configuration files and scripts
-  + `docs`, Documentation
-  + `fix`, Bug fix
-  + `nix`, Related to Nix
-  + `perf`, Performance improvements
-  + `refactor`, Refactoring code
-  + `remove`, Remove a feature or fix
-  + `test`, Adding tests
+  + `fix`, bug fixes
+  + `feat`, new features added
+  + `perf`, performance improvements
+  + `docs`, updating the documentation
+  + `nix`, related to the Nix development environment
+  + `ci`, related to the Continuous Integration modules
+  + `test`, related to the testing modules
+  + `refactor`, refactoring code
+  + `deprecate`, deprecating a feature
+  + `changelog`, updating the CHANGELOG
+  + `chore`, maintenance (build process, updating sponsors, etc.)
   + Other prefixes may be used if necessary
 - If there's a breaking change, add `BREAKING CHANGE` and an explanation to your commit message
 -->

.github/actions/artifact-from-cirrus/action.yaml

@@ -1,119 +0,0 @@
-name: Artifact from Cirrus
-
-description: Waits for a specific Cirrus CI run to complete, then downloads the artifact and uploads it to the current workflow. This will silently succeed if Cirrus CI did not schedule a task within 2 minutes.
-
-inputs:
-  download:
-    description: Name of Artifact to download from Cirrus CI
-    required: true
-  task:
-    description: Name of Cirrus Task
-    required: true
-  token:
-    description: GitHub Token
-    required: true
-  upload:
-    description: Name of Artifact to upload on GitHub Actions
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - shell: bash
-      run: echo "GH_TOKEN=${{ inputs.token }}" >> "$GITHUB_ENV"
-    - name: Wait for Check Suite to be created
-      id: check-suite
-      env:
-        # GITHUB_SHA does weird things for pull request, so we roll our own:
-        COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
-      shell: bash
-      run: |
-        get_check_runs_url() {
-          gh api "repos/{owner}/{repo}/commits/${COMMIT}/check-suites" \
-            | jq -r '.check_suites[] | select(.app.slug == "cirrus-ci") | .check_runs_url'
-        }
-        for _ in $(seq 1 12); do
-          check_runs_url="$(get_check_runs_url)"
-          if [ -z "$check_runs_url" ]; then
-            echo "Cirrus CI task has not started, yet. Waiting..."
-            sleep 10
-          else
-            echo "check_runs_url=$check_runs_url" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-        done
-        >&2 echo "Cirrus CI check suite not found. Is Cirrus CI enabled for this repo?"
-    - name: Find task by name
-      id: find-task
-      if: steps.check-suite.outputs.check_runs_url
-      shell: bash
-      run: |
-        get_number_of_tasks() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs | map(select(.name == "${{ inputs.task }}")) | length'
-        }
-        tasks="$(get_number_of_tasks)"
-        case "$tasks" in
-          0)
-            echo "Task not found, assuming it's skipped intentionally..."
-            exit 0
-            ;;
-          1)
-            echo "task_found=1" >> "$GITHUB_OUTPUT"
-            exit 0
-            ;;
-          *)
-            >&2 echo "More than 1 task with the same name found. Don't know what to do..."
-            exit 1
-            ;;
-        esac
-    - name: Wait for Cirrus CI to complete task
-      if: steps.find-task.outputs.task_found
-      shell: bash
-      run: |
-        get_conclusion() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -r '.check_runs[] | select(.name == "${{ inputs.task }}" and .status == "completed") | .conclusion'
-        }
-        while true; do
-          conclusion="$(get_conclusion)"
-          if [ -z "$conclusion" ]; then
-            echo "Cirrus CI task has not completed, yet. Waiting..."
-            sleep 30
-          else
-            if [ "$conclusion" == "success" ]; then
-              break
-            else
-              exit 1
-            fi
-          fi
-        done
-    - name: Download artifact from Cirrus CI
-      if: steps.find-task.outputs.task_found
-      id: download
-      shell: bash
-      run: |
-        get_external_id() {
-          gh api "${{ steps.check-suite.outputs.check_runs_url }}" \
-            | jq -er '.check_runs[] | select(.name == "${{ inputs.task }}") | .external_id'
-        }
-        archive="$(mktemp)"
-        artifacts="$(mktemp -d)"
-        until curl --no-progress-meter --fail -o "${archive}" \
-                "https://api.cirrus-ci.com/v1/artifact/task/$(get_external_id)/${{ inputs.download }}.zip"
-        do
-          # This happens when a tag is pushed on the same commit. In this case the
-          # job is immediately marked as "completed" for us, so we end up here after a few
-          # seconds - but the actual Cirrus CI task is still running and didn't produce its artifact, yet.
-          echo "Artifact not found on Cirrus CI, yet. Waiting..."
-          sleep 30
-        done
-        unzip "${archive}" -d "${artifacts}"
-        echo "artifacts=${artifacts}" >> "$GITHUB_OUTPUT"
-    - name: Save artifact to GitHub Actions
-      if: steps.find-task.outputs.task_found
-      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-      with:
-        name: ${{ inputs.upload }}
-        path: ${{ steps.download.outputs.artifacts }}
-        if-no-files-found: error

.github/actions/cache-on-main/action.yaml

@@ -1,35 +0,0 @@
-name: Cache on main
-
-description: Stores caches on main and release branches only, but restores them on all branches.
-
-inputs:
-  path:
-    description: Path(s) to cache
-    required: true
-  save-prs:
-    description: Whether to additionally store the cache in a pull request, too. Should only be used for very small caches.
-    type: boolean
-  prefix:
-    description: Cache key prefix to be used in both primary key and restore-keys.
-    required: true
-  suffix:
-    description: Cache key suffix to be used only in primary key.
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-      if: ${{ startsWith(github.ref, 'refs/heads/') || (inputs.save-prs && startsWith(github.ref, 'refs/pull/')) }}
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
-        restore-keys: |
-          ${{ runner.os }}-${{ inputs.prefix }}-
-    - uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
-      if: ${{ !startsWith(github.ref, 'refs/heads/') && !(inputs.save-prs && startsWith(github.ref, 'refs/pull/'))  }}
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ runner.os }}-${{ inputs.prefix }}-${{ inputs.suffix }}
-        restore-keys: |
-          ${{ runner.os }}-${{ inputs.prefix }}-

.github/actions/setup-nix/action.yaml

@@ -11,12 +11,12 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
+    - uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35
       with:
         nix_conf: |-
           always-allow-substitutes = true
           max-jobs = auto
-    - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
+    - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
       with:
         name: postgrest
         authToken: ${{ inputs.authToken }}

.github/renovate.json

@@ -3,67 +3,23 @@
   "extends": [
     "config:best-practices"
   ],
-  "baseBranchPatterns": [
+  "baseBranches": [
     "main",
     "/^v[0-9]+/"
   ],
   "rebaseWhen": "conflicted",
-  "pip_requirements": {
-    "enabled": false
-  },
   "packageRules": [
     {
-      "matchBaseBranches": [
-        "/^v[0-9]+/"
-      ],
-      "matchManagers": [
-        "haskell-cabal"
-      ],
-      "enabled": false
-    },
-    {
-      "matchBaseBranches": [
-        "/^v[0-9]+/"
-      ],
+      "matchBaseBranches": [ "/^v[0-9]+/" ],
       "groupName": "all dependencies"
     },
     {
-      "matchManagers": [
-        "haskell-cabal"
-      ],
-      "matchPackageNames": [
-        "base",
-        "bytestring",
-        "containers",
-        "directory",
-        "mtl",
-        "parsec",
-        "process",
-        "text"
-      ],
-      "groupName": "GHC dependencies"
+      "matchPackageNames": ["docutils"],
+      "allowedVersions": "<0.21.0"
     },
     {
-      "matchManagers": [
-        "haskell-cabal"
-      ],
-      "matchPackageNames": [
-        "hasql",
-        "hasql-dynamic-statements",
-        "hasql-notifications",
-        "hasql-transaction",
-        "hasql-pool"
-      ],
-      "groupName": "hasql"
-    },
-    {
-      "matchManagers": [
-        "haskell-cabal"
-      ],
-      "matchPackageNames": [
-        "fuzzyset"
-      ],
-      "allowedVersions": "<0.3"
+      "matchPackageNames": ["macos"],
+      "allowedVersions": "<13"
     }
   ]
 }

.github/workflows/backport.yaml

@@ -1,52 +0,0 @@
-name: Backport
-
-on:
-  pull_request_target:
-    types:
-      - closed
-      - labeled
-
-jobs:
-  backport:
-    name: Backport
-    runs-on: ubuntu-24.04
-    # It triggers only when PR is already merged on either:
-    #
-    # - The merge event itself (action != labeled) or
-    # - A label event with the right label (backport ...).
-    #
-    # The result will be that we can add the label before or after merge,
-    # but the workflow will only run once the PR had been merged.
-    if: >
-      github.event.pull_request.merged &&
-      (
-        github.event.action != 'labeled' ||
-        startsWith(github.event.label.name, 'backport')
-      )
-    steps:
-
-      # This actions creates the github token using the postgrest app secrets
-      - name: Create Github App Token
-        id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
-        with:
-          app-id: ${{ vars.POSTGREST_CI_APP_ID }}
-          private-key: ${{ secrets.POSTGREST_CI_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-          permission-workflows: write # required when backporting CI changes
-
-      # This is required for backport action to cherry-pick the PR
-      - name: Fetch PR ref
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ steps.app-token.outputs.token }}
-
-      # Backport action that creates the PR with given settings
-      - name: Create backport PR
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
-        with:
-          github_token: ${{ steps.app-token.outputs.token }}
-          pull_description: 'Backport for #${pull_number}.'
-          pull_title: '${target_branch}: ${pull_title}'

.github/workflows/build.yaml

@@ -1,201 +0,0 @@
-name: Build
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-    paths:
-      - .github/workflows/build.yaml
-      - .github/actions/**
-      - .github/scripts/**
-      - .github/*
-      - '*.nix'
-      - nix/**
-      - .cirrus.yml
-      - cabal.project*
-      - postgrest.cabal
-      - stack.yaml*
-      - '**.hs'
-      - '!**.md'
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: build-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  static:
-    name: Nix - Linux x86-64 static
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Build static executable
-        run: nix-build -A postgrestStatic -A postgrestStatic.tests
-      - name: Save built executable as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: postgrest-linux-static-x86-64
-          path: result/bin/postgrest
-          if-no-files-found: error
-
-      - name: Build Docker image
-        run: nix-build -A docker.image --out-link postgrest-docker.tar.gz
-      - name: Save built Docker image as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: postgrest-docker-x86-64
-          path: postgrest-docker.tar.gz
-          if-no-files-found: error
-
-
-  macos:
-    name: Nix - MacOS
-    runs-on: macos-15
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Install gnu sed
-        run: brew install gnu-sed
-
-      - name: Build everything
-        run: |
-          # The --dry-run will give us a list of derivations to download from cachix and
-          # derivations to build. We only take those that would have to be built and then build
-          # those explicitly. This has the advantage that pure verification will not include
-          # a download anymore, making it much faster. If something needs to be built, only
-          # the dependencies required to do so will be downloaded, but not everything.
-          nix-build --dry-run 2>&1 \
-            | gsed -e '1,/derivations will be built:$/d' -e '/paths will be fetched/Q' \
-            | xargs nix-build
-
-
-  stack:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Linux aarch64
-            runs-on: ubuntu-24.04-arm
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-ubuntu-aarch64
-            deps: sudo apt-get update && sudo apt-get install libpq-dev
-
-          - name: MacOS aarch64
-            runs-on: macos-14
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-macos-aarch64
-            deps: brew link --force libpq
-
-          - name: Windows
-            runs-on: windows-2022
-            cache: |
-              C:\sr\pantry
-              C:\sr\snapshots
-              C:\sr\stack.sqlite3
-            deps: Add-Content $env:GITHUB_PATH $env:PGBIN
-            artifact: postgrest-windows-x86-64
-
-    name: Stack - ${{ matrix.name }}
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: haskell-actions/setup@f9150cb1d140e9a9271700670baa38991e6fa25c # v2.10.3
-        with:
-          # This must match the version in stack.yaml's resolver
-          ghc-version: 9.6.7
-          enable-stack: true
-          stack-no-global: true
-          stack-setup-ghc: true
-      - name: Cache ~/.stack
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: ${{ matrix.cache }}
-          prefix: stack
-          suffix: ${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
-      - name: Cache .stack-work
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: .stack-work
-          save-prs: true
-          prefix: stack-work-${{ hashFiles('postgrest.cabal', 'stack.yaml.lock') }}
-          suffix: ${{ hashFiles('main/**/*.hs', 'src/**/*.hs') }}
-      - name: Install dependencies
-        if: matrix.deps
-        run: ${{ matrix.deps }}
-      - name: Build with Stack
-        run: stack build --lock-file error-on-write --local-bin-path result --copy-bins
-      - name: Strip Executable
-        run: strip result/postgrest*
-      - name: Save built executable as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: ${{ matrix.artifact }}
-          path: |
-            result/postgrest
-            result/postgrest.exe
-          if-no-files-found: error
-
-
-  freebsd:
-    name: Stack - FreeBSD from CirrusCI
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: ./.github/actions/artifact-from-cirrus
-        with:
-          token: ${{ github.token }}
-          task: Build FreeBSD (Stack)
-          download: bin
-          upload: postgrest-freebsd-x86-64
-
-
-  cabal:
-    strategy:
-      matrix:
-        ghc: ['9.6.7', '9.8.4']
-      fail-fast: false
-    name: Cabal - Linux x86-64 - GHC ${{ matrix.ghc }}
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: haskell-actions/setup@f9150cb1d140e9a9271700670baa38991e6fa25c # v2.10.3
-        with:
-          ghc-version: ${{ matrix.ghc }}
-      - name: Cache .cabal
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: |
-            ~/.cabal/packages
-            ~/.cabal/store
-          prefix: cabal-${{ matrix.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-          suffix: ${{ hashFiles('postgrest.cabal', 'cabal.project') }}
-      - name: Cache dist-newstyle
-        uses: ./.github/actions/cache-on-main
-        with:
-          path: dist-newstyle
-          save-prs: true
-          prefix: cabal-${{ matrix.ghc }}-dist-newstyle-${{ hashFiles('postgrest.cabal', 'cabal.project', 'cabal.project.freeze') }}
-          suffix: ${{ hashFiles('**/*.hs') }}
-      - name: Install dependencies
-        run: cabal build --only-dependencies --enable-tests --enable-benchmarks
-      - name: Build
-        run: cabal build --enable-tests --enable-benchmarks all

.github/workflows/check.yaml

@@ -1,53 +0,0 @@
-name: Check
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: style-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  lint-style:
-    name: Lint & Style
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: style.lint.bin style.styleCheck.bin
-      - name: Run linter (check locally with `nix-shell --run postgrest-lint`)
-        run: postgrest-lint
-      - name: Run style check (auto-format with `nix-shell --run postgrest-style`)
-        run: postgrest-style-check
-
-  commit:
-    if: github.event_name != 'push'  # we don't run this on a push, a failure on push disrupts the release workflow
-    name: Commit
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 100  # fetch history (last 100 commits) instead of default shallow clone history, this is deemed enough for a PR history
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: gitTools.commitCheck.bin
-      - name: Run commitlint (check locally with `nix-shell --run postgrest-commitlint`)
-        run: |
-          # Fetch target branch explicitly
-          git fetch origin ${{ github.base_ref }}
-
-          # Run commitlint
-          postgrest-commitlint --from origin/${{ github.base_ref }} --to HEAD

.github/workflows/ci.yaml

@@ -1,70 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - main
-      - v[0-9]+
-
-jobs:
-  check:
-    name: Check
-    uses: ./.github/workflows/check.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  docs:
-    name: Docs
-    uses: ./.github/workflows/docs.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  test:
-    name: Test
-    uses: ./.github/workflows/test.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-
-  build:
-    name: Build
-    uses: ./.github/workflows/build.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  tag:
-    name: Tag
-    concurrency:
-      # Never tag outdated commits on the main branch by skipping superseded commits
-      group: ci-tag-${{ (github.ref == 'refs/heads/main' && github.ref) || github.run_id }}
-      # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
-      cancel-in-progress: false
-    if: vars.RELEASE_ENABLED
-    runs-on: ubuntu-24.04
-    needs:
-      - docs
-      - test
-      - build
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ssh-key: ${{ secrets.POSTGREST_SSH_KEY }}
-      - name: Tag latest commit
-        run: |
-          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-
-          if [[ "$cabal_version" == *.* ]]; then
-            git fetch --tags
-
-            if [ -z "$(git tag --list "v$cabal_version")" ]; then
-              git tag "v$cabal_version"
-              git push origin "v$cabal_version"
-            fi
-          else
-            git tag -f "devel"
-            git push -f origin "devel"
-          fi

.github/workflows/docs.yaml

@@ -1,10 +1,10 @@
 name: Docs
 
 on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
+  push:
+    branches:
+      - main
+      - v[0-9]+
   pull_request:
     branches:
       - main
@@ -27,7 +27,7 @@ jobs:
     name: Build
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Nix Environment
       uses: ./.github/actions/setup-nix
       with:
@@ -41,7 +41,7 @@ jobs:
     name: Spellcheck
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Setup Nix Environment
       uses: ./.github/actions/setup-nix
       with:
@@ -51,3 +51,17 @@ jobs:
       run: postgrest-docs-spellcheck
     - name: Run dictcheck
       run: postgrest-docs-dictcheck
+
+
+  linkcheck:
+    name: Linkcheck
+    if: github.base_ref == 'main'
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Setup Nix Environment
+      uses: ./.github/actions/setup-nix
+      with:
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+        tools: docs.linkcheck.bin
+    - run: postgrest-docs-linkcheck

.github/workflows/linkcheck.yaml

@@ -1,18 +0,0 @@
-name: Linkcheck
-
-on:
-  schedule:
-    - cron: '1 2 * * 3'
-  workflow_dispatch:
-
-jobs:
-  linkcheck:
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - name: Setup Nix Environment
-      uses: ./.github/actions/setup-nix
-      with:
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-        tools: docs.linkcheck.bin
-    - run: postgrest-docs-linkcheck

.github/workflows/release.yaml

@@ -1,202 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - devel
-      - v*
-
-concurrency:
-  # Terminate all previous runs of the same workflow for the same tag.
-  group: release-${{ github.ref }}
-  # TODO: Enable this once https://github.com/orgs/community/discussions/13015 is solved
-  cancel-in-progress: false
-
-jobs:
-  build:
-    name: Build
-    uses: ./.github/workflows/build.yaml
-    secrets:
-      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
-
-  prepare:
-    name: Prepare
-    runs-on: ubuntu-24.04
-    needs:
-      - build
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Check the version to be released
-        run: |
-          cabal_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-
-          if [ "${GITHUB_REF_NAME}" != "devel" ] && [ "${GITHUB_REF_NAME}" != "v$cabal_version" ]; then
-            echo "Tagged version ($GITHUB_REF_NAME) does not match the one in postgrest.cabal (v$cabal_version). Aborting release..."
-            exit 1
-          fi
-      - name: Identify changes from CHANGELOG.md
-        run: |
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            echo "Getting unreleased changes..."
-            sed -n "1,/## Unreleased/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          else
-            version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
-            echo "Propper release, getting changes for version $version ..."
-            sed -n "1,/## \[$version\]/d;/## \[/q;p" CHANGELOG.md > CHANGES.md
-          fi
-
-          echo "Relevant extract from CHANGELOG.md:"
-          cat CHANGES.md
-      - name: Save CHANGES.md as artifact
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-changes
-          path: CHANGES.md
-          if-no-files-found: error
-
-
-  github:
-    name: GitHub
-    permissions:
-      contents: write
-    runs-on: ubuntu-24.04
-    needs:
-      - prepare
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Download all artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          path: artifacts
-      - name: Create release bundle with archives for all builds
-        run: |
-          find artifacts -type f -iname postgrest -exec chmod +x {} \;
-
-          mkdir -p release-bundle
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-x86-64.tar.xz" \
-            -C artifacts/postgrest-linux-static-x86-64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-macos-aarch64.tar.xz" \
-            -C artifacts/postgrest-macos-aarch64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-freebsd-x86-64.tar.xz" \
-            -C artifacts/postgrest-freebsd-x86-64 postgrest
-
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-ubuntu-aarch64.tar.xz" \
-            -C artifacts/postgrest-ubuntu-aarch64 postgrest
-
-          zip --junk-paths "release-bundle/postgrest-${GITHUB_REF_NAME}-windows-x86-64.zip" \
-            artifacts/postgrest-windows-x86-64/postgrest.exe
-
-      - name: Save release bundle
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
-        with:
-          name: release-bundle
-          path: release-bundle
-          if-no-files-found: error
-
-      - name: Publish release on GitHub
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "Releasing version ${GITHUB_REF_NAME} on GitHub..."
-
-          if [ "${GITHUB_REF_NAME}" == "devel" ]; then
-            # To replace the existing release, we must first delete the old assets,
-            # then modify the release, then add the new assets.
-            gh release view devel --json assets \
-              | jq -r '.assets[] | .name' \
-              | xargs -rn1 \
-              gh release delete-asset -y devel
-            gh release edit devel \
-              -t devel \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              --prerelease
-            gh release upload --clobber devel release-bundle/*
-          else
-            gh release create "${GITHUB_REF_NAME}" \
-              -t "${GITHUB_REF_NAME}" \
-              --verify-tag \
-              -F artifacts/release-changes/CHANGES.md \
-              release-bundle/*
-          fi
-
-
-  docker:
-    name: Docker Hub
-    runs-on: ubuntu-24.04-arm
-    needs:
-      - prepare
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER
-    env:
-      DOCKER_REPO: ${{ vars.DOCKER_REPO }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Download x86-64 Docker image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: postgrest-docker-x86-64
-      - name: Download aarch64 binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: postgrest-ubuntu-aarch64
-      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-      - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          username: ${{ vars.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASS }}
-      - name: Build aarch64 Docker image
-        run: |
-          # This only pushes the image via digest, not a tag. This will not appear
-          # in the image list on Docker Hub, yet. It will be later added to the main
-          # tag's manifest.
-          docker buildx build \
-            -t "$DOCKER_REPO/postgrest" \
-            --platform linux/arm64 \
-            --output push-by-digest=true,type=image,push=true \
-            --metadata-file metadata.json \
-            .
-          echo "SHA256_ARM=$(jq -r '."containerimage.digest"' metadata.json)" >> "$GITHUB_ENV"
-      - name: Publish images on Docker Hub
-        run: |
-          docker load -i postgrest-docker.tar.gz
-
-          docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker buildx imagetools create --append \
-            -t "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}" \
-            "$DOCKER_REPO/postgrest@$SHA256_ARM"
-
-          # Only tag 'latest' for full releases
-          if [ "${GITHUB_REF_NAME}" != "devel" ]; then
-            echo "Pushing to 'latest' tag for full release of ${GITHUB_REF_NAME} ..."
-            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
-            docker push "$DOCKER_REPO"/postgrest:latest
-            docker buildx imagetools create --append \
-              -t "$DOCKER_REPO/postgrest:latest" \
-              "$DOCKER_REPO/postgrest@$SHA256_ARM"
-          else
-            echo "Skipping push to 'latest' tag for pre-release..."
-          fi
-
-
-  docker-description:
-    name: Docker Hub Description
-    runs-on: ubuntu-24.04
-    if: |
-      vars.DOCKER_REPO && vars.DOCKER_USER &&
-      github.ref == 'refs/tags/devel'
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ vars.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASS }}
-          repository: ${{ vars.DOCKER_REPO }}/postgrest
-          short-description: ${{ github.event.repository.description }}
-          readme-filepath: ./docker-hub-readme.md
-

.github/workflows/test.yaml

@@ -1,174 +0,0 @@
-name: Test
-
-on:
-  workflow_call:
-    secrets:
-      CACHIX_AUTH_TOKEN:
-        required: false
-      CODECOV_TOKEN:
-        required: false
-  pull_request:
-    branches:
-      - main
-      - v[0-9]+
-    paths:
-      - .github/workflows/test.yaml
-      - .github/workflows/report.yaml
-      - .github/actions/setup-nix/**
-      - default.nix
-      - nix/**
-      - .stylish-haskell.yaml
-      - cabal.project
-      - postgrest.cabal
-      - '**.hs'
-      - test/**
-      - '!**.md'
-
-concurrency:
-  # Terminate all previous runs of the same workflow for pull requests
-  group: test-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  coverage:
-    name: Coverage
-    runs-on: ubuntu-24.04
-    defaults:
-      run:
-        # Hack for enabling color output, see:
-        # https://github.com/actions/runner/issues/241#issuecomment-842566950
-        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.coverage.bin tests.testDoctests.bin tests.testSpecIdempotence.bin cabalTools.update.bin
-
-      - run: postgrest-cabal-update
-
-      - name: Run coverage (IO tests and Spec tests against PostgreSQL 15)
-        run: postgrest-coverage
-      - name: Upload coverage to codecov
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
-        with:
-          files: ./coverage/codecov.json
-          token: ${{ secrets.CODECOV_TOKEN }}
-
-      - name: Run doctests
-        if: always()
-        run: postgrest-test-doctests
-
-      - name: Check the spec tests for idempotence
-        if: always()
-        run: postgrest-test-spec-idempotence
-
-
-  postgres:
-    strategy:
-      fail-fast: false
-      matrix:
-        pgVersion: [13, 14, 15, 16, 17]
-    name: PG ${{ matrix.pgVersion }}
-    runs-on: ubuntu-24.04
-    defaults:
-      run:
-        # Hack for enabling color output, see:
-        # https://github.com/actions/runner/issues/241#issuecomment-842566950
-        shell: script -qec "bash --noprofile --norc -eo pipefail {0}"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.testSpec.bin tests.testObservability.bin tests.testIO.bin tests.testBigSchema.bin withTools.pg-${{ matrix.pgVersion }}.bin cabalTools.update.bin
-
-      - run: postgrest-cabal-update
-
-      - name: Run spec tests
-        if: always()
-        run: postgrest-with-pg-${{ matrix.pgVersion }} postgrest-test-spec
-
-      - name: Run observability tests
-        if: always()
-        run: postgrest-with-pg-${{ matrix.pgVersion }} postgrest-test-observability
-
-      - name: Run IO tests
-        if: always()
-        run: postgrest-with-pg-${{ matrix.pgVersion }} postgrest-test-io -vv
-
-      - name: Run IO tests on a big schema
-        if: always()
-        run: postgrest-with-pg-${{ matrix.pgVersion }} postgrest-test-big-schema -vv
-
-
-  memory:
-    name: Memory
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: tests.testMemory.bin cabalTools.update.bin
-
-      - run: postgrest-cabal-update
-
-      - name: Run memory tests
-        run: postgrest-test-memory
-
-
-  loadtest:
-    strategy:
-      matrix:
-        kind: ['mixed', 'jwt-hs', 'jwt-hs-cache', 'jwt-hs-cache-worst', 'jwt-rsa', 'jwt-rsa-cache', 'jwt-rsa-cache-worst']
-    name: Loadtest
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          tools: loadtest.loadtestAgainst.bin loadtest.report.bin cabalTools.update.bin
-
-      - run: postgrest-cabal-update
-
-      - name: Run loadtest
-        env:
-          TARGET_BRANCH: ${{ github.base_ref || github.ref_name }}
-        run: |
-          if [ "$TARGET_BRANCH" = "main" ]; then
-            latest_tag=$(git tag --sort=-creatordate --list "v*" | head -n1)
-          else
-            latest_tag=$(git tag --merged HEAD --sort=-creatordate "v*" | head -n1)
-          fi
-          postgrest-loadtest-against -k ${{ matrix.kind }} "$TARGET_BRANCH" "$latest_tag"
-          postgrest-loadtest-report -g ${{ matrix.kind }} >> "$GITHUB_STEP_SUMMARY"
-
-  flake:
-    strategy:
-      fail-fast: false
-      matrix:
-        runs-on:
-          - macos-14 # aarch64-darwin
-          - ubuntu-24.04 # x86_64-linux
-          - ubuntu-24.04-arm # aarch64-linux
-    name: Flake Check
-    runs-on: ${{ matrix.runs-on }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-      - name: Setup Nix Environment
-        uses: ./.github/actions/setup-nix
-        with:
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - name: Run flake check
-        run: |
-          nix flake check

.gitignore

@@ -14,7 +14,7 @@ site
 .#*
 *.swp
 result*
-dist-*
+dist-newstyle
 postgrest.hp
 postgrest.prof
 __pycache__
@@ -24,5 +24,3 @@ coverage
 loadtest
 .history
 .docs-build
-gen_targets.http
-gen_jwk.json

.readthedocs.yaml

@@ -5,6 +5,6 @@ python:
    install:
    - requirements: docs/requirements.txt
 build:
-  os: ubuntu-24.04
+  os: ubuntu-22.04
   tools:
     python: "3.11"

BACKERS.md

@@ -13,26 +13,31 @@ PostgREST ongoing development is only possible thanks to our Sponsors and Backer
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="static/supabase.svg">
+        <a href="https://gnuhost.eu/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/gnuhost.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.euronodes.com/postgrest" target="_blank">
-          <img width="296px" src="static/euronodes.svg">
+        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/neon.jpg">
         </a>
       </td>
     </tr>
     <tr></tr>
     <tr>
       <td align="center" valign="middle">
-        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="static/neon.jpg">
+        <a href="https://code.build/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/code-build.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.bytebase.com/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="static/bytebase.svg">
+        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
+          <img width="296px" src="static/supabase.svg">
+        </a>
+      </td>
+      <td align="center" valign="middle">
+        <a href="https://tembo.io/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/tembo.png">
         </a>
       </td>
     </tr>
@@ -88,16 +93,6 @@ PostgREST ongoing development is only possible thanks to our Sponsors and Backer
           <img width="222px" src="static/oblivious.jpg">
         </a>
       </td>
-      <td align="center" valign="middle">
-        <a href="https://code.build/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="222px" src="static/code-build.png">
-        </a>
-      </td>
-      <td align="center" valign="middle">
-        <a href="https://tembo.io/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="static/tembo.png">
-        </a>
-      </td>
     </tr>
   </tbody>
 </table>

CHANGELOG.md

@@ -1,218 +1,10 @@
 # Change Log
 
-All notable changes to this project will be documented in this file. From version `14.0` onwards PostgREST follows a `MAJOR.PATCH` two-part versioning. Only even-numbered MAJOR versions will be released, reserving odd-numbered MAJOR versions for development.
+All notable changes to this project will be documented in this file.
+This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
-## [14.8] - 2026-04-03
-
-### Added
-
-- Log a `HINT` when the LISTEN channel stops working due to a PostgreSQL bug by @laurenceisla in #4581
-
-### Fixed
-
-- Fix invalid OpenAPI 2.0 format for integer types (`smallint`, `integer`, `bigint`) by @arturbent0 in #4641
-
-## [14.7] - 2026-03-20
-
-### Fixed
-
-- Fix not logging SIGTERM and SIGINT by @steve-chavez in #4728
-
-## [14.6] - 2026-03-06
-
-### Fixed
-
-- Fix leaking table and function names when calculating error hint by @taimoorzaeem in #4675
-
-## [14.5] - 2026-02-12
-
-### Fixed
-
-- Don't hide async exceptions in logs by @stevechavez in #4646
-
-## [14.4] - 2026-01-29
-
-### Fixed
-
-- Ensure Listener connections are released by @mkleczek in #4614
-- Fix incorrectly filtering the returned representation for PATCH requests when using `or/and` filters by @laurenceisla in #3707
-- Fix listener running with exception masked after first failure by @mkleczek #4615
-
-## [14.3] - 2026-01-03
-
-### Fixed
-
-- Fix performance and high memory usage of relation hint calculation by @mkleczek in #4462, #4463
-
-## [14.2] - 2025-12-18
-
-### Fixed
-
-- Fix `hasSingleUnnamedParam` incorrectly matching functions with named parameters by @joelonsql in #4553
-  + Functions with a single named parameter (e.g., `foo(data json)`) no longer incorrectly match the single-param fallback, returning a clean `PGRST202` error instead of a confusing PostgreSQL `42883` error.
-- Fix misleading logs on unsupported PostgreSQL versions by @taimoorzaeem in #4519
-- Fix regression where the `PGRST103` error response was truncated by @laurenceisla in #4455
-  + Happened when an `offset` was greater than the rows requested and `Prefer: count=exact` was sent.
-- Fix not returning `Content-Length` on empty HTTP `201` responses by @laurenceisla in #4518
-- Fix inaccurate Server-Timing header durations by @steve-chavez in #4522
-- Fix inaccurate "Schema cache queried" logs by @steve-chavez in #4522
-
-## [14.1] - 2025-11-05
-
-## Fixed
-
-- Fix `db-pre-config` function failing when function names are pg reserved words by @taimoorzaeem in #4380
-- Fix `server-host=!6` incorrectly binds to IPv4 address by @taimoorzaeem in #3202
-
-## [14.0] - 2025-10-24
-
-### Added
-
-- Bounded JWT cache using the SIEVE algorithm by @mkleczek in #4084
-  + It now uses a fixed size cache instead of arbitrary sized cache.
-- Add `--ready` flag for postgrest healthcheck by @taimoorzaeem in #4239
-
-### Fixed
-
-- Fix not logging OpenAPI queries when `log-query=main-query` is enabled by @steve-chavez in #4226
-- Fix not logging explain query when `log-query=main-query` is enabled by @steve-chavez in #4319
-- Fix not logging transaction variables and db-pre-request function when `log-query=main-query` is enabled by @steve-chavez in #3934
-- Fix not logging the JSON message to stderr on a `PGRST002` error by @laurenceisla in #4129
-- Fix reloading the Schema Cache unnecessarily on a `PGRST002` error by @laurenceisla in #4367
-- Fix schema cache loading taking a long time for large schemas by @mkleczek in #4360, #3704
-
-### Changed
-
-- Drop support for PostgreSQL EOL version 12 by @wolfgangwalther in #3865
-- From now on PostgREST will follow a `MAJOR.PATCH` two-part versioning. Only even-numbered MAJOR versions will be released, reserving odd-numbered MAJOR versions for development.
-- Replaced `jwt-cache-max-lifetime` config with `jwt-cache-max-entries` by @mkleczek in #4084
-- `log-query` config now takes a boolean instead of a string value by @steve-chavez in #3934
-
-## [13.0.8] - 2025-10-24
-
-### Fixed
-
-- Fix loading utf-8 config files with `ASCII` locale set by @taimoorzaeem in #4386
-
-## [13.0.7] - 2025-09-14
-
-### Added
-
-- Improve the `PGRST106` error when the requested schema is invalid by @laurenceisla in #4089
-  + It now shows the invalid schema in the `message` field.
-  + The exposed schemas are now listed in the `hint` instead of the `message` field.
-- Improve error details of `PGRST301` error by @taimoorzaeem in #4051
-
-## [13.0.6] - 2025-08-30
-
-### Fixed
-
-- Fix logging the Haskell type instead of the listener error message directly by @laurenceisla in #3588
-- Fix format of `IPv6` address logged at PostgREST startup by @taimoorzaeem in #4291
-- Fix empty enum in `preferParams` OpenAPI parameter by @laurenceisla in #4292
-
-## [13.0.5] - 2025-08-24
-
-### Fixed
-
-- Fix OpenAPI broken docs link by @taimoorzaeem in #4080
-- Fix OpenAPI specification incorrectly exposing GET methods for volatile functions by @joelonsql in #4174
-- Fix empty spread embeddings return unexpected SQL error by @taimoorzaeem in #3887
-- Fix `/metrics` endpoint not responding with `Content-Type` header by @taimoorzaeem in #4271
-
-## [13.0.4] - 2025-06-17
-
-### Fixed
-
-- Fix regression that makes full-text search not work on domain types based on `tsvector` by @laurenceisla in #4135
-- Fix `jwt-aud` config not failing when set to an invalid URI by @taimoorzaeem in #4132
-
-## [13.0.3] - 2025-06-16
-
-- Fix `max-affected` preference not failing with RPC when `handling=strict` by @taimoorzaeem in #4100
-- Fix a property definition's type in OpenAPI not showing the correct base type of a recursive domain by @laurenceisla in #4136
-
-### Fixed
-
-## [13.0.2] - 2025-06-02
-
-### Fixed
-
-- Fix regression that makes `ORDER BY` with nulls-order not work alongside limits by @laurenceisla in #4109
-
-## [13.0.1] - 2025-06-01
-
-### Fixed
-
-- Fix jwt error returning HTTP status `400` for invalid role by @taimoorzaeem in #3601
-- Fix `db-extra-search-path` cannot be set to nothing by @taimoorzaeem in #4074
-  + It can now be disabled by setting it to empty string.
-  + Schema Cache load error is now logged including `db-schemas` and `db-extra-search-path` config values.
-
-## [13.0.0] - 2025-05-08
-
-### Added
-
- - #3558, Add the `admin-server-host` config to set the host for the admin server - @develop7
- - #3607, Log to stderr when the JWT secret is less than 32 characters long - @laurenceisla
- - #2858, Performance improvements when calling RPCs via GET using indexes in more cases - @wolfgangwalther
- - #3560, Log resolved host in "Listening on ..." messages - @develop7
- - #3727, Log maximum pool size - @steve-chavez
- - #1536, Add string comparison feature for jwt-role-claim-key - @taimoorzaeem
- - #3747, Allow `not_null` value for the `is` operator - @taimoorzaeem
- - #2255, Apply `to_tsvector()` explicitly to the full-text search filtered column (excluding `tsvector` types) - @laurenceisla
- - #1578, Log the main SQL query to stderr at the current `log-level` when `log-query=main-query` - @laurenceisla
- - #3903, Log connection pool borrows on `log-level=debug` - @taimoorzaeem
- - #3041, Allow spreading one-to-many and many-to-many embedded resources - @laurenceisla
-   + The selected columns in the embedded resources are aggregated into arrays
-   + Aggregates are not supported
- - #2967, Add `Proxy-Status` header for better error response - @taimoorzaeem
- - #4016, Add `Content-Length` response header - @laurenceisla
-
-### Fixed
-
- - #3693, Prevent spread embedding to allow aggregates when they are disabled - @laurenceisla
- - #3693, A nested spread embedding now correctly groups by the fields of its top parent relationship - @laurenceisla
- - #3693, Fix spread embedding errors when using the `count()` aggregate without a field - @laurenceisla
-   + Fixed `"column reference <col> is ambiguous"` error when selecting `?select=...table(col,count())`
-   + Fixed `"column <json_aggregate>.<alias> does not exist"` error when selecting `?select=...table(aias:count())`
- - #3727, Clarify "listening" logs - @steve-chavez
- - #3795, Clarify `Accept: vnd.pgrst.object` error message - @steve-chavez
- - #3697, #3602, Handle queries on non-existing table gracefully - @taimoorzaeem
- - #3600, #3926, Improve JWT errors - @taimoorzaeem
- - #3013, Fix `order=` with POST, PATCH, PUT and DELETE requests - @taimoorzaeem
- - #3965, Fix filter on unselected columns in a table-valued function - @taimoorzaeem
- - #4052, Fix schema cache load duplicate objects with different object type but same oid - @taimoorzaeem
-
-### Changed
-
- - #2052, Dropped support for PostgreSQL 9.6 - @wolfgangwalther
- - #2052, Dropped support for PostgreSQL 10 - @wolfgangwalther
- - #2052, Dropped support for PostgreSQL 11 - @wolfgangwalther
- - #3508, PostgREST now fails to start when `server-port` and `admin-server-port` config options are the same - @develop7
- - #3607, PostgREST now fails to start when the JWT secret is less than 32 characters long - @laurenceisla
- - #3644, Fail schema cache lookup with invalid `db-schemas` or `db-extra-search-path` config - @wolfgangwalther
-   - Previously, this would silently return 200 - OK on the root endpoint, but don't provide any usable endpoints.
-   - Note: This also applies when deleting the `public` schema - both config options default to that.
- - #3757, Remove support for `Prefer: params=single-object` - @joelonsql
-   + This preference was deprecated in favor of Functions with an array of JSON objects
- - #3013, Drop support for Limited updates/deletes
-   + The feature was complicated and largely unused.
- - #3956, Drop `/config` endpoint of admin server - @steve-chavez
-   + The endpoint was at risk of being left unprotected when exposing it.
-   + The accompanying `admin-server-config-enabled` config was also dropped.
- - #3598, PostgREST now validates the `kid` parameter of the JWT - @wolfgangwalther
-   + If the JWT contains a ``kid`` parameter, then PostgREST will look for the JSON Web Key in the `jwt-secret`.
-   + If the JWT doesn't contain a `kid`, the behavior should be backwards compatible. PostgREST  will try each key in the `jwt-secret` one by one until it finds one that works.
- - #3697, #3602, Querying non-existent table now returns `PGRST205` error instead of empty json - @taimoorzaeem
- - #3600, #3926, Improve JWT errors - @taimoorzaeem
-   + Return `PGRST301` error when `Bearer` in auth header is sent empty
-   + Diagnostic error messages instead of exposed internals
-   + Return new `PGRST303` error when jwt claims decoding fails
- - #3906, Return `PGRST125` and `PGRST126` errors instead of empty json - @taimoorzaeem
-
 ## [12.2.12] - 2025-05-01
 
 ### Fixed
@@ -220,11 +12,11 @@ All notable changes to this project will be documented in this file. From versio
 - #3956, Fix exposing admin server `/config` by default - @steve-chavez
   + The above endpoint is now disabled unless the `admin-server-config-enabled` config is set to `true`
 
-## [12.2.11] - 2025-04-22
+## [12.2.11] - 2025-04-21
 
 ### Fixed
 
- - #4030, Fix regression with parameter `charset=utf-8` in mediatype - @taimoorzaeem
+- #4030, Fix regression with parameter `charset=utf-8` in mediatype - @taimoorzaeem
 
 ## [12.2.10] - 2025-04-18
 

CONTRIBUTING.md

@@ -1,55 +1,3 @@
-# Contributing to PostgREST
+This repository follows the same contribution guidelines as the main PostgREST repository contribution guidelines:
 
-**First:** if you're unsure or afraid of _anything_, just ask or
-submit the issue or pull request anyways. You won't be yelled at
-for giving your best effort. The worst that can happen is that
-you'll be politely asked to change something. We appreciate any
-sort of contributions, and don't want a wall of rules to get in the
-way of that.
-
-However, for those individuals who want a bit more guidance on the
-best way to contribute to the project, read on. This document will
-cover what we're looking for. By addressing all the points we're
-looking for, it raises the chances we can quickly merge or address
-your contributions.
-
-## Issues
-
-For questions on how to use PostgREST, please use
-[GitHub discussions](https://github.com/PostgREST/postgrest/discussions).
-
-### Reporting an Issue
-
-* Make sure you test against the latest [stable release](https://github.com/PostgREST/postgrest/releases/latest)
-  and also against the latest [devel release](https://github.com/PostgREST/postgrest/releases/tag/devel).
-  It is possible we already fixed the bug you're experiencing.
-
-* Provide steps to reproduce the issue, including your OS version and
-  the specific database schema that you are using.
-
-* Please include SQL logs for issues involving runtime problems. To obtain logs first
-  [enable logging all statements](http://www.microhowto.info/howto/log_all_queries_to_a_postgresql_server.html),
-  then [find your logs](http://blog.endpoint.com/2014/11/dear-postgresql-where-are-my-logs.html).
-
-* If your database schema has changed while the PostgREST server is running,
-  [send the server a `SIGUSR1` signal](http://postgrest.org/en/latest/admin.html#schema-reloading) or restart it to ensure the schema cache
-  is not stale. This sometimes fixes apparent bugs.
-
-## Code
-
-We have a fully nix-based development environment with many tools for a smooth development workflow available.
-Check the [development docs](https://github.com/PostgREST/postgrest/blob/main/nix/README.md) on how to set it up and use it.
-
-### Haskell Conventions
-
-* All contributions must pass the tests before being merged. When
-  you create a pull request your code will automatically be tested.
-
-* All code must also pass [hlint](http://community.haskell.org/~ndm/hlint/) and [stylish-haskell](https://github.com/jaspervdj/stylish-haskell)
-  with no warnings. This helps enforce a uniform style for all committers. Continuous integration will check this as well on every
-  pull request. There are useful tools in the nix-shell that help with checking this locally. You can run `postgrest-check` to do this manually but
-  we recommend adding it to `.git/hooks/pre-commit` as `nix-shell --run postgrest-check` to automatically check this before doing a commit.
-
-### Running Tests
-
-For instructions on running tests, see the [development docs](https://github.com/PostgREST/postgrest/blob/main/nix/README.md#testing).
+https://github.com/PostgREST/postgrest/blob/main/.github/CONTRIBUTING.md

Dockerfile

@@ -1,21 +0,0 @@
-# PostgREST Docker Hub image for aarch64.
-# The x86-64 is a single-static-binary image built via Nix, see:
-# nix/tools/docker/README.md
-
-FROM ubuntu:noble@sha256:186072bba1b2f436cbb91ef2567abca677337cfc786c86e107d25b7072feef0c AS postgrest
-
-RUN apt-get update -y \
-    && apt install -y --no-install-recommends libpq-dev zlib1g-dev jq gcc libnuma-dev \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY postgrest /usr/bin/postgrest
-RUN chmod +x /usr/bin/postgrest
-
-EXPOSE 3000
-
-USER 1000
-
-# Use the array form to avoid running the command using bash, which does not handle `SIGTERM` properly. 
-# See https://docs.docker.com/compose/faq/#why-do-my-services-take-10-seconds-to-recreate-or-stop 
-CMD ["postgrest"]

README.md

@@ -22,26 +22,31 @@ API than you are likely to write from scratch.
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="static/supabase.svg">
+        <a href="https://gnuhost.eu/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/gnuhost.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.euronodes.com/postgrest" target="_blank">
-          <img width="296px" src="static/euronodes.svg">
+        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/neon.jpg">
         </a>
       </td>
     </tr>
     <tr></tr>
     <tr>
       <td align="center" valign="middle">
-        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="static/neon.jpg">
+        <a href="https://code.build/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/code-build.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.bytebase.com/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="static/bytebase.svg">
+        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
+          <img width="296px" src="static/supabase.svg">
+        </a>
+      </td>
+      <td align="center" valign="middle">
+        <a href="https://tembo.io/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="static/tembo.png">
         </a>
       </td>
     </tr>
@@ -52,8 +57,8 @@ Big thanks to our sponsors! You can join them by supporting PostgREST on [Patreo
 
 ## Usage
 
-1. See the docs for [how to install PostgREST on your platform](https://docs.postgrest.org/en/stable/explanations/install.html). You can also [use Docker](https://docs.postgrest.org/en/stable/explanations/install.html#docker).
-
+1. Download the binary ([latest release](https://github.com/PostgREST/postgrest/releases/latest))
+   for your platform.
 2. Invoke for help:
 
     ```bash
@@ -142,10 +147,6 @@ You can help PostgREST ongoing maintenance and development by making a regular d
 
 Every donation will be spent on making PostgREST better for the whole community.
 
-## Contributing
-
-Contributions are always welcome and appreciated. Please see the [Contributing guidelines](https://github.com/PostgREST/postgrest/blob/main/CONTRIBUTING.md).
-
 ## Thanks
 
 The PostgREST organization is grateful to:

cabal.project

@@ -1,2 +1,4 @@
 packages: postgrest.cabal
 tests: true
+package *
+  ghc-options: -split-sections

cabal.project.freeze

@@ -1 +1 @@
-index-state: hackage.haskell.org 2025-10-29T04:02:18Z
+index-state: hackage.haskell.org 2025-02-01T14:59:33Z

default.nix

@@ -3,15 +3,7 @@
 , compiler ? "ghc948"
 
 , # Commit of the Nixpkgs repository that we want to use.
-  # It defaults to reading the inputs from flake.lock, which serves
-  # as a compatibility layer for non-flake builds / default.nix / shell.nix.
-  nixpkgsVersion ? let
-    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
-  in
-  {
-    inherit (lock.nodes.nixpkgs.locked) owner repo rev;
-    tarballHash = lock.nodes.nixpkgs.locked.narHash;
-  }
+  nixpkgsVersion ? import nix/nixpkgs-version.nix
 
 , # Nix files that describe the Nixpkgs repository. We evaluate the expression
   # using `import` below.
@@ -27,7 +19,7 @@ let
     "postgrest";
 
   # PostgREST source files, filtered based on the rules in the .gitignore files
-  # and file extensions. We want to include as little as possible, as the files
+  # and file extensions. We want to include as litte as possible, as the files
   # added here will increase the space used in the Nix store and trigger the
   # build of new Nix derivations when changed.
   src =
@@ -43,6 +35,10 @@ let
       allOverlays.build-toolbox
       allOverlays.checked-shell-script
       allOverlays.gitignore
+      allOverlays.postgresql-libpq
+      allOverlays.postgresql-legacy
+      allOverlays.postgresql-future
+      allOverlays.postgis
       (allOverlays.haskell-packages { inherit compiler; })
       allOverlays.slocat
     ];
@@ -53,23 +49,19 @@ let
 
   postgresqlVersions =
     [
-      { name = "pg-17"; postgresql = pkgs.postgresql_17.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
-      { name = "pg-16"; postgresql = pkgs.postgresql_16.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
-      { name = "pg-15"; postgresql = pkgs.postgresql_15.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
-      { name = "pg-14"; postgresql = pkgs.postgresql_14.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
-      { name = "pg-13"; postgresql = pkgs.postgresql_13.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-16"; postgresql = pkgs.postgresql_16.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-15"; postgresql = pkgs.postgresql_15.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-14"; postgresql = pkgs.postgresql_14.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-13"; postgresql = pkgs.postgresql_13.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-12"; postgresql = pkgs.postgresql_12.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-11"; postgresql = pkgs.postgresql_11.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-10"; postgresql = pkgs.postgresql_10.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
+      { name = "postgresql-9_6"; postgresql = pkgs.postgresql_9_6.withPackages (p: [ p.postgis p.pg_safeupdate ]); }
     ];
 
-  haskellPackages = pkgs.haskell.packages."${compiler}";
-
   # Dynamic derivation for PostgREST
-  postgrest = pkgs.lib.pipe (haskellPackages.callCabal2nix name src { }) [
-    # To allow ghc-datasize to be used.
-    lib.disableLibraryProfiling
-    # We are never going to use dynamic haskell libraries anyway. "Dynamic" refers to how
-    # non-haskell deps are linked. All haskell dependencies are always statically linked.
-    lib.disableSharedLibraries
-  ];
+  postgrest =
+    pkgs.haskell.packages."${compiler}".callCabal2nix name src { };
 
   staticHaskellPackage = import nix/static.nix { inherit compiler name pkgs src; };
 
@@ -77,6 +69,15 @@ let
   devCabalOptions =
     "-f dev --test-show-detail=direct";
 
+  profiledHaskellPackages =
+    pkgs.haskell.packages."${compiler}".extend (_: super:
+      {
+        mkDerivation =
+          args:
+          super.mkDerivation (args // { enableLibraryProfiling = true; });
+      }
+    );
+
   inherit (pkgs.haskell) lib;
 in
 rec {
@@ -84,21 +85,17 @@ rec {
 
   # Derivation for the PostgREST Haskell package, including the executable,
   # libraries and documentation. We disable running the test suite on Nix
-  # builds, as they require a database to be set up. We split the binary
-  # into a separate output, so that the default distribution via flake.nix
-  # has a much smaller closure size.
-  postgrestPackage = pkgs.lib.pipe postgrest [
-    lib.dontCheck
-    lib.enableSeparateBinOutput
-    (haskellPackages.generateOptparseApplicativeCompletions [ "postgrest" ])
-  ];
+  # builds, as they require a database to be set up.
+  postgrestPackage =
+    lib.dontCheck postgrest;
 
   # Profiled dynamic executable.
-  postgrestProfiled = pkgs.lib.pipe postgrestPackage [
-    lib.enableExecutableProfiling
-    lib.enableLibraryProfiling
-    lib.dontHaddock
-  ];
+  postgrestProfiled =
+    lib.enableExecutableProfiling (
+      lib.dontHaddock (
+        lib.dontCheck (profiledHaskellPackages.callCabal2nix name src { })
+      )
+    );
 
   inherit (postgrest) env;
 
@@ -124,21 +121,21 @@ rec {
   docs =
     pkgs.callPackage nix/tools/docs.nix { };
 
-  # Git tools.
-  gitTools =
-    pkgs.callPackage nix/tools/gitTools.nix { };
-
   # Load testing tools.
   loadtest =
     pkgs.callPackage nix/tools/loadtest.nix { inherit withTools; };
 
+  # Script for running memory tests.
+  memory =
+    pkgs.callPackage nix/tools/memory.nix { inherit postgrestProfiled withTools; };
+
   # Utility for updating the pinned version of Nixpkgs.
   nixpkgsTools =
     pkgs.callPackage nix/tools/nixpkgsTools.nix { };
 
   # Scripts for publishing new releases.
   release =
-    pkgs.callPackage nix/tools/release.nix { };
+    pkgs.callPackage nix/tools/release { };
 
   # Linting and styling tools.
   style =

docker-hub-readme.md

@@ -19,26 +19,31 @@ write from scratch.
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
-          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/supabase.svg">
+        <a href="https://gnuhost.eu/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/gnuhost.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.euronodes.com/postgrest" target="_blank">
-          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/euronodes.svg">
+        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/neon.jpg">
         </a>
       </td>
     </tr>
     <tr></tr>
     <tr>
       <td align="center" valign="middle">
-        <a href="https://neon.tech/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/neon.jpg">
+        <a href="https://code.build/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/code-build.png">
         </a>
       </td>
       <td align="center" valign="middle">
-        <a href="https://www.bytebase.com/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
-          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/bytebase.svg">
+        <a href="https://supabase.io?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage" target="_blank">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/supabase.svg">
+        </a>
+      </td>
+      <td align="center" valign="middle">
+        <a href="https://tembo.io/?utm_source=sponsor&utm_campaign=postgrest" target="_blank">
+          <img width="296px" src="https://raw.githubusercontent.com/PostgREST/postgrest/main/static/tembo.png">
         </a>
       </td>
     </tr>
@@ -59,7 +64,7 @@ The image is built from scratch using
 [Nix](https://nixos.org/nixpkgs/manual/#sec-pkgs-dockerTools) instead of a
 `Dockerfile`, which yields a highly secure and optimized image. This is also why
 no commands are listed in the image history. See the [PostgREST
-repository](https://github.com/PostgREST/postgrest/tree/main/nix/tools/docker) for
+respository](https://github.com/PostgREST/postgrest/tree/main/nix/tools/docker) for
 details on the build process and how to inspect the image.
 
 This does not apply to the arm64 variant, which is based on Ubuntu.

docs/_diagrams/uml/arch.uml

@@ -40,14 +40,9 @@ database "PostgreSQL" {
 
 :user:
 hexagon Proxy
-:user: .r-> Proxy : request with JWT
+:user: .r-> Proxy
 HTTPAPI <.l- Proxy
 
-hexagon ExternalAuth
-ExternalAuth -u[hidden]- Proxy
-:user: .r-> ExternalAuth : login
-:user: <.r- ExternalAuth : JWT
-
 :operator: .d-> HTTPADMIN
 :operator: .d-> CLI
 
@@ -56,18 +51,15 @@ PostgreSQL <.developer : "\t"
 Listener -r.> "PostgreSQL"
 "Connection Pool" -r.> "PostgreSQL" : "\t\t"
 
+
 note bottom of Auth
-  Validates the JWT
+  Authenticates the user request
 end note
 
 note bottom of ApiRequest
   Parses the URL syntax
 end note
 
-note bottom of Plan
-  Generates internal AST
-end note
-
 note bottom of Query
   Generates the SQL
 end note
@@ -76,19 +68,15 @@ note top of Listener
   LISTEN session
 end note
 
-url of ExternalAuth is [[../explanations/external_auth.html]]
 url of Admin is [[../references/admin_server.html#admin-server]]
 url of API is [[../explanations/schema_isolation.html]]
 url of Auth is [[../references/auth.html#authn]]
-url of ApiRequest is [[../explanations/architecture.html#api-request]]
-url of Plan is [[../explanations/architecture.html#plan]]
-url of Query is [[../explanations/architecture.html#query]]
 url of Authorization is [[../explanations/db_authz.html]]
 url of CLI is [[../references/cli.html#cli]]
 url of "Connection Pool" is [[../references/connection_pool.html]]
 url of Config is [[../references/configuration.html#configuration]]
-url of HTTPADMIN is [[../explanations/architecture.html#http]]
-url of HTTPAPI is [[../explanations/architecture.html#http]]
+url of HTTPADMIN is [[https://aosabook.org/en/posa/warp.html]]
+url of HTTPAPI is [[https://aosabook.org/en/posa/warp.html]]
 url of Listener is [[../references/listener.html#listener]]
 url of Proxy is [[../explanations/nginx.html]]
 url of "Schema Cache" is [[../references/schema_cache.html#schema-cache]]

docs/_static/sch-iso-dark.svg

@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="391px" preserveAspectRatio="none" style="width:328px;height:391px;" version="1.1" viewBox="0 0 328 391" width="328px" zoomAndPan="magnify"><defs/><g><!--cluster PostgreSQL--><g id="cluster_PostgreSQL"><path d="M6,16 C6,6 158.5,6 158.5,6 C158.5,6 311,6 311,16 L311,293.59 C311,303.59 158.5,303.59 158.5,303.59 C158.5,303.59 6,303.59 6,293.59 L6,16 " fill="none" style="stroke:#E7E7E7;stroke-width:1.0;"/><path d="M6,16 C6,26 158.5,26 158.5,26 C158.5,26 311,26 311,16 " fill="none" style="stroke:#E7E7E7;stroke-width:1.0;"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="92.2305" x="112.3848" y="40.9951">PostgreSQL</text></g><!--cluster public--><g id="cluster_public"><polygon fill="none" points="30,74,40,64,153,64,153,146.29,143,156.29,30,156.29,30,74" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="143" x2="153" y1="74" y2="64"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="30" x2="143" y1="74" y2="74"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="143" x2="143" y1="74" y2="156.29"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="47.9063" x="63.5469" y="89.9951">public</text></g><!--cluster API--><g id="cluster_API"><polygon fill="none" points="70,190.29,80,180.29,246,180.29,246,269.59,236,279.59,70,279.59,70,190.29" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="236" x2="246" y1="190.29" y2="180.29"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="70" x2="236" y1="190.29" y2="190.29"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="236" x2="236" y1="190.29" y2="279.59"/><text fill="#FFFFFF" font-family="sans-serif" font-size="20" font-weight="bold" lengthAdjust="spacing" textLength="34.668" x="136.666" y="211.8545">api</text></g><!--entity tables_public--><g id="elem_tables_public"><rect fill="#313139" height="36.2969" rx="2.5" ry="2.5" style="stroke:#E7E7E7;stroke-width:0.5;" width="62.752" x="71.62" y="104"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="42.752" x="81.62" y="126.9951">tables</text></g><!--entity extensions--><g id="elem_extensions"><polygon fill="none" points="169.14,109,179.14,99,294.8695,99,294.8695,135.2969,284.8695,145.2969,169.14,145.2969,169.14,109" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="284.8695" x2="294.8695" y1="109" y2="99"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="169.14" x2="284.8695" y1="109" y2="109"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="284.8695" x2="284.8695" y1="109" y2="145.2969"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="85.7295" x="184.14" y="131.9951">extensions</text></g><!--entity vf_api--><g id="elem_vf_api"><rect fill="#313139" height="36.2969" rx="2.5" ry="2.5" style="stroke:#E7E7E7;stroke-width:0.5;" width="144.6465" x="85.68" y="227.29"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="124.6465" x="95.68" y="250.2851">views + functions</text></g><!--entity PostgREST--><g id="elem_PostgREST"><ellipse cx="158" cy="352.59" fill="#313139" rx="8" ry="8" style="stroke:#E7E7E7;stroke-width:0.5;"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="74.6895" x="120.6553" y="382.5851">PostgREST</text></g><!--reverse link tables_public to vf_api--><g id="link_tables_public_vf_api"><path d="M110.03,146.6 C110.03,169.85 110.03,203.55 110.03,226.86 " fill="none" id="tables_public-backto-vf_api" style="stroke:#E7E7E7;stroke-width:1.0;"/><polygon fill="#E7E7E7" points="110.03,140.6,106.03,149.6,110.03,145.6,114.03,149.6,110.03,140.6" style="stroke:#E7E7E7;stroke-width:1.0;"/></g><!--reverse link extensions to vf_api--><g id="link_extensions_vf_api"><path d="M199.73,151.63 C199.73,175.24 199.73,205.18 199.73,226.88 " fill="none" id="extensions-backto-vf_api" style="stroke:#E7E7E7;stroke-width:1.0;"/><polygon fill="#E7E7E7" points="199.73,145.63,195.73,154.63,199.73,150.63,203.73,154.63,199.73,145.63" style="stroke:#E7E7E7;stroke-width:1.0;"/></g><!--link vf_api to PostgREST--><g id="link_vf_api_PostgREST"><path d="M158,269.62 C158,292.9 158,320.34 158,337.81 " fill="none" id="vf_api-PostgREST" style="stroke:#E7E7E7;stroke-width:3.0;"/><polygon fill="#E7E7E7" points="158,263.62,154,272.62,158,268.62,162,272.62,158,263.62" style="stroke:#E7E7E7;stroke-width:3.0;"/><polygon fill="#E7E7E7" points="158,343.81,162,334.81,158,338.81,154,334.81,158,343.81" style="stroke:#E7E7E7;stroke-width:3.0;"/></g><!--SRC=[KypCIyufJKbLqDFJBqxEqCqipjShpSq10000]--></g></svg>
+<?xml version="1.0" encoding="us-ascii" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="411px" preserveAspectRatio="none" style="width:315px;height:411px;" version="1.1" viewBox="0 0 315 411" width="315px" zoomAndPan="magnify"><defs/><g><!--cluster PostgreSQL--><g id="cluster_PostgreSQL"><path d="M6,16 C6,6 152,6 152,6 C152,6 298,6 298,16 L298,309.14 C298,319.14 152,319.14 152,319.14 C152,319.14 6,319.14 6,309.14 L6,16 " fill="none" style="stroke:#E7E7E7;stroke-width:1.0;"/><path d="M6,16 C6,26 152,26 152,26 C152,26 298,26 298,16 " fill="none" style="stroke:#E7E7E7;stroke-width:1.0;"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="81.375" x="111.3125" y="42.9659">PostgreSQL</text></g><!--cluster public--><g id="cluster_public"><polygon fill="none" points="30,77,40,67,150,67,150,155.07,140,165.07,30,165.07,30,77" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="140" x2="150" y1="77" y2="67"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="30" x2="140" y1="77" y2="77"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="140" x2="140" y1="77" y2="165.07"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="44.625" x="63.6875" y="94.9659">public</text></g><!--cluster API--><g id="cluster_API"><polygon fill="none" points="68,199.07,78,189.07,236,189.07,236,285.14,226,295.14,68,295.14,68,199.07" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="226" x2="236" y1="199.07" y2="189.07"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="68" x2="226" y1="199.07" y2="199.07"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="226" x2="226" y1="199.07" y2="295.14"/><text fill="#FFFFFF" font-family="sans-serif" font-size="20" font-weight="bold" lengthAdjust="spacing" textLength="29.875" x="133.0625" y="223.45">api</text></g><!--entity tables_public--><g id="elem_tables_public"><rect fill="#313139" height="39.0679" rx="2.5" ry="2.5" style="stroke:#E7E7E7;stroke-width:0.5;" width="61" x="69.5" y="110"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="41" x="79.5" y="134.9659">tables</text></g><!--entity extensions--><g id="elem_extensions"><polygon fill="none" points="165.81,115,175.81,105,282.185,105,282.185,144.0679,272.185,154.0679,165.81,154.0679,165.81,115" style="stroke:#E7E7E7;stroke-width:1.0;"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="272.185" x2="282.185" y1="115" y2="105"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="165.81" x2="272.185" y1="115" y2="115"/><line style="stroke:#E7E7E7;stroke-width:1.0;" x1="272.185" x2="272.185" y1="115" y2="154.0679"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" font-weight="bold" lengthAdjust="spacing" textLength="76.375" x="180.81" y="139.9659">extensions</text></g><!--entity vf_api--><g id="elem_vf_api"><rect fill="#313139" height="39.0679" rx="2.5" ry="2.5" style="stroke:#E7E7E7;stroke-width:0.5;" width="136" x="84" y="240.07"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="116" x="94" y="265.0359">views + functions</text></g><!--entity PostgREST--><g id="elem_PostgREST"><ellipse cx="152" cy="371.14" fill="#313139" rx="8" ry="8" style="stroke:#E7E7E7;stroke-width:0.5;"/><text fill="#FFFFFF" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="70" x="117" y="403.1059">PostgREST</text></g><!--reverse link tables_public to vf_api--><g id="link_tables_public_vf_api"><path d="M107.25,155.29 C107.25,179.74 107.25,215.13 107.25,239.67 " fill="none" id="tables_public-backto-vf_api" style="stroke:#E7E7E7;stroke-width:1.0;"/><polygon fill="#E7E7E7" points="107.25,149.29,103.25,158.29,107.25,154.29,111.25,158.29,107.25,149.29" style="stroke:#E7E7E7;stroke-width:1.0;"/></g><!--reverse link extensions to vf_api--><g id="link_extensions_vf_api"><path d="M192.91,160.31 C192.91,185.07 192.91,216.68 192.91,239.61 " fill="none" id="extensions-backto-vf_api" style="stroke:#E7E7E7;stroke-width:1.0;"/><polygon fill="#E7E7E7" points="192.91,154.31,188.91,163.31,192.91,159.31,196.91,163.31,192.91,154.31" style="stroke:#E7E7E7;stroke-width:1.0;"/></g><!--link vf_api to PostgREST--><g id="link_vf_api_PostgREST"><path d="M152,285.55 C152,309.98 152,338.34 152,356.18 " fill="none" id="vf_api-PostgREST" style="stroke:#E7E7E7;stroke-width:3.0;"/><polygon fill="#E7E7E7" points="152,279.55,148,288.55,152,284.55,156,288.55,152,279.55" style="stroke:#E7E7E7;stroke-width:3.0;"/><polygon fill="#E7E7E7" points="152,362.18,156,353.18,152,357.18,148,353.18,152,362.18" style="stroke:#E7E7E7;stroke-width:3.0;"/></g><!--SRC=[KypCIyufJKbLqDFJBqxEqCqipjShpSq10000]--></g></svg>

docs/conf.py

@@ -12,6 +12,7 @@
 # All configuration values have a default; values that are commented out
 # serve to show the default.
 
+import sys
 import os
 
 # If extensions (or modules to document with autodoc) are in another directory,
@@ -49,7 +50,7 @@ source_suffix = ".rst"
 master_doc = "index"
 
 # This is overriden by readthedocs with the version tag anyway
-version = "14"
+version = "12.2"
 # To avoid repetition in <title> we set this to an empty string.
 release = ""
 
@@ -113,7 +114,7 @@ html_theme = "sphinx_rtd_theme"
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
 # documentation.
-html_theme_options = {}
+html_theme_options = {"display_version": False}
 
 # Add any paths that contain custom themes here, relative to this directory.
 # html_theme_path = []
@@ -296,10 +297,6 @@ user_agent = (
 )
 
 linkcheck_ignore = [
-    # 403 only in CI / GitHub Actions
-    r"https://www.patreon.com/postgrest",
-    r"https://blog.frankel.ch/poor-man-api",
-    r"https://www.cybertec-postgresql.com/.*",
     # Odd SSL error
     r"https://www.dripdepot.com",
     r"https://www.euronodes.com",

docs/ecosystem.rst

@@ -6,7 +6,7 @@ Community Tutorials
 * `Building a Contacts List with PostgREST and Vue.js <https://www.youtube.com/watch?v=iHtsALtD5-U>`_ -
   In this video series, DigitalOcean shows how to build and deploy an Nginx + PostgREST(using a managed PostgreSQL database) + Vue.js webapp in an Ubuntu server droplet.
 
-* `PostgREST + Auth0: Create REST API in mintutes, and add social login using Auth0 <https://samkhawase.com/blog/postgrest/>`_ - A step-by-step tutorial to show how to dockerize and integrate Auth0 to PostgREST service.
+* `PostgREST + Auth0: Create REST API in minutes, and add social login using Auth0 <https://samkhawase.com/blog/postgrest-1-introduction/>`_ - A step-by-step tutorial to show how to dockerize and integrate Auth0 to PostgREST service.
 
 * `"CodeLess" backend using postgres, postgrest and oauth2 authentication with keycloak <https://www.mathieupassenaud.fr/codeless_backend/>`_ -
   A step-by-step tutorial for using PostgREST with KeyCloak(hosted on a managed service).
@@ -34,7 +34,7 @@ Templates
 Example Apps
 ------------
 
-* `archtika <https://github.com/thiloho/archtika>`_ - self-hosted CMS
+* `archtika <https://github.com/thiloho/archtika>`_ - self‑hosted CMS
 * `delibrium-postgrest <https://gitlab.com/delibrium/delibrium-postgrest/>`_ - example school API and front-end in Vue.js
 * `ETH-transactions-storage <https://github.com/Adamant-im/ETH-transactions-storage>`_ - indexer for Ethereum to get transaction list by ETH address
 * `general <https://github.com/PierreRochard/general>`_ - example auth back-end

docs/explanations/architecture.rst

@@ -58,7 +58,7 @@ A request might be rejected at this level if it's invalid. For example when prov
 Plan
 ----
 
-Using the Schema Cache, `Plan.hs <https://github.com/PostgREST/postgrest/blob/main/src/PostgREST/Plan.hs>`_ generates an internal AST, filling out-of-band SQL details (like an ``ON CONFLICT (pk)`` clause) required to complete the user request.
+Using the Schema Cache, `Plan.hs <https://github.com/PostgREST/postgrest/blob/main/src/PostgREST/Plan.hs>`_ fills in out-of-band SQL details (like an ``ON CONFLICT (pk)`` clause) required to complete the user request.
 
 A request might be rejected at this level if it's invalid. For example when doing resource embedding on a nonexistent resource.
 

docs/explanations/db_authz.rst

@@ -13,7 +13,7 @@ A role can be thought of as either a database user, or a group of database users
 Roles for Each Web User
 -----------------------
 
-PostgREST can accommodate either viewpoint. If you treat a role as a single user then :ref:`user_impersonation` does most of what you need. When an authenticated user makes a request PostgREST will switch into the database role for that user, which in addition to restricting queries, is available to SQL through the :code:`current_user` variable.
+PostgREST can accommodate either viewpoint. If you treat a role as a single user then the :ref:`jwt_impersonation` does most of what you need. When an authenticated user makes a request PostgREST will switch into the database role for that user, which in addition to restricting queries, is available to SQL through the :code:`current_user` variable.
 
 You can use row-level security to flexibly restrict visibility and access for the current user. Here is an `example <https://www.enterprisedb.com:443/blog/application-users-vs-row-level-security>`_ from Tomas Vondra, a chat table storing messages sent between users. Users can insert rows into it to send messages to other users, and query it to see messages sent to them by other users.
 

docs/explanations/install.rst

@@ -16,11 +16,16 @@ Supported PostgreSQL versions
 =============================
 
 =============== =================================
-**Supported**   PostgreSQL >= 13
+**Supported**   PostgreSQL >= 9.6
 =============== =================================
 
-PostgREST works with all PostgreSQL versions still `officially supported <https://www.postgresql.org/support/versioning/>`_.
+PostgREST works with all PostgreSQL versions starting from 9.6.
 
+.. note::
+
+   Support for PostgreSQL versions 9.6, 10 and 11 is deprecated. From this on version onwards, PostgREST will only support non-end-of-life PostgreSQL versions.
+
+   See https://www.postgresql.org/support/versioning/.
 
 Running PostgREST
 =================
@@ -75,12 +80,8 @@ You can get the `official PostgREST Docker image <https://hub.docker.com/r/postg
 
 .. code-block:: bash
 
-  # pull the latest version
   docker pull postgrest/postgrest
 
-  # to pull a particular version, use one of the versions on https://hub.docker.com/r/postgrest/postgrest/tags
-  docker pull postgrest/postgrest:<version>
-
 To configure the container image, use :ref:`env_variables_config`.
 
 There are two ways to run the PostgREST container: with an existing external database, or through docker-compose.
@@ -146,7 +147,6 @@ To avoid having to install the database at all, you can run both it and the serv
       ports:
         - "3000:3000"
       environment:
-        PGRST_SERVER_HOST: 0.0.0.0 # necessary for `postgrest --ready` flag to work
         PGRST_DB_URI: postgres://app_user:password@db:5432/app_db
         PGRST_OPENAPI_SERVER_PROXY_URI: http://127.0.0.1:3000
       depends_on:

docs/how-tos/sql-user-management-using-postgres-users-and-passwords.rst

@@ -43,7 +43,7 @@ As in :ref:`sql_user_management`, we create the :code:`pgcrypto` and :code:`pgjw
   CREATE EXTENSION pgcrypto WITH SCHEMA ext_pgcrypto;
 
 
-Concerning the `pgjwt extension <https://github.com/michelp/pgjwt>`_, please cf. to :ref:`jwt-from-sql`.
+Concerning the `pgjwt extension <https://github.com/michelp/pgjwt>`_, please cf. to :ref:`client_auth`.
 
 .. code-block:: postgres
 
@@ -157,7 +157,7 @@ Here we use the username instead of the email address to identify a user.
 Logins
 ~~~~~~
 
-As described in :ref:`jwt-from-sql`, we'll create a JWT token inside our login function. Note that you'll need to adjust the secret key which is hard-coded in this example to a secure (at least thirty-two character) secret of your choosing.
+As described in :ref:`client_auth`, we'll create a JWT token inside our login function. Note that you'll need to adjust the secret key which is hard-coded in this example to a secure (at least thirty-two character) secret of your choosing.
 
 
 .. code-block:: postgres

docs/how-tos/sql-user-management.rst

@@ -3,7 +3,7 @@
 SQL User Management
 ===================
 
-As mentioned on :ref:`jwt_generation`, an external service can provide user management and coordinate with the PostgREST server using JWT. It's also possible to support logins entirely through SQL. It's a fair bit of work, so get ready.
+As mentioned on :ref:`jwt_generation`, an external service can provide user management and coordinate with the PostgREST server using JWT. It’s also possible to support logins entirely through SQL. It’s a fair bit of work, so get ready.
 
 Storing Users and Passwords
 ---------------------------
@@ -110,8 +110,6 @@ Then, add ``db-anon-role`` to the configuration file to allow anonymous requests
 
   db-anon-role = "anon"
 
-.. _jwt-from-sql:
-
 JWT from SQL
 ~~~~~~~~~~~~
 

docs/index.rst

@@ -38,27 +38,8 @@ Sponsors
     .. image:: ../static/cybertec.svg
       :target: https://www.cybertec-postgresql.com/en/?utm_source=postgrest.org&utm_medium=referral&utm_campaign=postgrest
 
-  .. container:: img-dark
-
-    .. image:: ../static/supabase-dark.svg
-      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage
-
-  .. container:: img-light
-
-    .. image:: ../static/supabase.svg
-      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage
-
-  .. container:: img-dark
-
-    .. image:: ../static/euronodes.svg
-      :target: https://www.euronodes.com/postgrest
-
-  .. container:: img-light
-
-    .. image:: ../static/euronodes.svg
-      :target: https://www.euronodes.com/postgrest
-
-  |
+  .. image:: ../static/gnuhost.png
+    :target: https://euronodes.com/?utm_source=sponsor&utm_campaign=postgrest
 
   .. container:: img-dark
 
@@ -70,21 +51,36 @@ Sponsors
     .. image:: ../static/neon.jpg
       :target: https://neon.com/?utm_source=sponsor&utm_campaign=postgrest
 
+  |
+
   .. container:: img-dark
 
-    .. image:: ../static/bytebase-dark.svg
-      :target: https://www.bytebase.com/?utm_source=sponsor&utm_campaign=postgrest
+    .. image:: ../static/code-build-dark.png
+      :target: https://code.build/?utm_source=sponsor&utm_campaign=postgrest
 
   .. container:: img-light
 
-    .. image:: ../static/bytebase.svg
-      :target: https://www.bytebase.com/?utm_source=sponsor&utm_campaign=postgrest
+    .. image:: ../static/code-build.png
+      :target: https://code.build/?utm_source=sponsor&utm_campaign=postgrest
+
+  .. container:: img-dark
+
+    .. image:: ../static/supabase-dark.svg
+      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage
+
+  .. container:: img-light
+
+    .. image:: ../static/supabase.svg
+      :target: https://supabase.com/?utm_source=postgrest%20backers&utm_medium=open%20source%20partner&utm_campaign=postgrest%20backers%20github&utm_term=homepage
+
+  .. image:: ../static/tembo.png
+    :target: https://tembo.io/?utm_source=sponsor&utm_campaign=postgrest
 
   .. The static/empty.png(created with `convert -size 320x95 xc:#fcfcfc empty.png`) is an ugly workaround
      to create space and center the logos. It's not easy to layout with restructuredText.
 
-  .. image:: _static/empty.png
-    :target: #sponsors
+  .. .. image:: _static/empty.png
+       :target: #sponsors
 
 |
 
@@ -113,17 +109,10 @@ Getting Support
 
 The project has a friendly and growing community. For discussions, use the Github `discussions page <https://github.com/PostgREST/postgrest/discussions>`_. You can also report or search for bugs/features on the Github `issues <https://github.com/PostgREST/postgrest/issues>`_ page.
 
-Releases
---------
+Release Notes
+-------------
 
-PostgREST follows ``MAJOR.PATCH`` two-part versioning:
-
-- ``MAJOR``: feature release, may deprecate or remove things.
-- ``PATCH``: fix/security release only; no features, no behavior changes.
-
-Starting from ``v14.0``, only even-numbered MAJOR versions will be released, reserving odd-numbered MAJOR versions for development.
-
-All the releases are published on `PostgREST's GitHub release page <https://github.com/PostgREST/postgrest/releases>`_.
+The release notes are published on `PostgREST's GitHub release page <https://github.com/PostgREST/postgrest/releases>`_.
 
 Tutorials
 ---------
@@ -271,21 +260,4 @@ Testimonials
 Contributing
 ------------
 
-Please see the `Contributing guidelines <https://github.com/PostgREST/postgrest/blob/main/CONTRIBUTING.md>`_ in the main PostgREST repository.
-
-.. raw:: html
-
-  <script type="text/javascript">
-    let hash = window.location.hash;
-
-    const redirects = {
-      // Tables and Views
-      '#release-notes': '#releases',
-    };
-
-    let willRedirectTo = redirects[hash];
-
-    if (willRedirectTo) {
-      window.location.href = willRedirectTo;
-    }
-  </script>
+Please see the `Contributing guidelines <https://github.com/PostgREST/postgrest/blob/main/.github/CONTRIBUTING.md>`_ in the main PostgREST repository.

docs/integrations/jwt_gen.rst

@@ -1,6 +1,6 @@
-.. _external_auth:
+.. _external_jwt:
 
-External Authentication
+External JWT Generation
 -----------------------
 
 JWT from Auth0

docs/postgrest.dict

@@ -3,7 +3,6 @@ api
 API's
 APIs
 APISIX
-AST
 aud
 Auth
 auth
@@ -28,12 +27,10 @@ CSV
 durations
 DDL
 DOM
-DSL
 DevOps
 dockerize
 enum
 Enums
-Entra
 eq
 ETH
 Ethereum
@@ -70,11 +67,9 @@ isdistinct
 JS
 js
 JSON
-JSPath
 JWK
 JWT
 jwt
-Keycloak
 Kubernetes
 localhost
 login
@@ -98,11 +93,10 @@ npm
 nxl
 nxr
 OAuth
-ORM
 Observability
-Okta
 OpenAPI
 openapi
+ORM
 ov
 parametrized
 passphrase
@@ -194,5 +188,3 @@ Websockets
 webuser
 wfts
 www
-debouncing
-deduplicates

docs/references/admin_server.rst

@@ -55,6 +55,27 @@ Metrics
 
 Provides :ref:`metrics`.
 
+.. _runtime_config:
+
+Runtime Configuration
+=====================
+
+Provides a ``config`` endpoint that returns the runtime :ref:`configuration`. This requires setting :ref:`admin-server-config-enabled`.
+
+.. code-block:: bash
+
+  curl "http://localhost:3001/config"
+
+.. code-block::
+
+  db-aggregates-enabled = false
+  db-anon-role = "web_anon"
+  db-channel = "pgrst"
+  db-channel-enabled = false
+  ...
+
+.. _runtime_schema_cache:
+
 Runtime Schema Cache
 ====================
 

docs/references/api/aggregate_functions.rst

@@ -225,10 +225,10 @@ If we also want to get the total ``amount`` grouped by the ``order_date`` of the
 Note that the aggregate is done within the embedded resource ``orders``.
 It is not affected by any of the columns from the top-level relationship ``customers``.
 
-Aggregates in To-One Spreads
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Using Aggregates in Spreads
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-All the aggregates inside a :ref:`one-to-one or many-to-one spread embedded resource <spread_to_one_embed>` will be hoisted to the top-level relationship.
+All the aggregates inside a :ref:`spread embedded resource <spread_embed>` will be hoisted to the top-level relationship.
 In other words, it will behave as if the aggregate was done in the top-level relationship itself. For example:
 
 .. code-block:: bash
@@ -251,7 +251,3 @@ This will take the ``max`` and ``min`` subscription date of every customer and g
       "min": "2016-02-11"
     }
   ]
-
-.. note::
-
-  Aggregates inside to-many spreads are not supported

docs/references/api/domain_representations.rst

@@ -173,4 +173,4 @@ Domain Representations avoid all the above drawbacks. Their only drawback is tha
 
   Why not create a `base type <https://www.postgresql.org/docs/current/sql-createtype.html#id-1.9.3.94.5.8>`_ instead? ``CREATE TYPE app_uuid (INTERNALLENGTH = 22, INPUT = app_uuid_parser, OUTPUT = app_uuid_formatter)``.
 
-  Creating base types need superuser, which is restricted on cloud hosted databases. Additionally this way lets "how the data is presented" dictate "how the data is stored" which would be backwards.
+  Creating base types need superuser, which is restricted on cloud hosted databases. Additionally this way lets “how the data is presented” dictate “how the data is stored” which would be backwards.

docs/references/api/functions.rst

@@ -131,6 +131,10 @@ For this the ``Content-Type: application/json`` header must be included in the r
 
  If an overloaded function has a single ``json`` or ``jsonb`` unnamed parameter, PostgREST will call this function as a fallback provided that no other overloaded function is found with the parameters sent in the POST request.
 
+.. warning::
+
+ Sending the JSON request body as a single argument is also possible with :ref:`Prefer: params=single-object <prefer_params>` but this method is **deprecated**.
+
 .. _function_single_unnamed:
 
 Functions with a single unnamed parameter

docs/references/api/openapi.rst

@@ -19,9 +19,6 @@ For extra customization, the OpenAPI output contains a "description" field for e
   COMMENT ON TABLE monotremes IS
     'Freakish mammals lay the best eggs for breakfast';
 
-  COMMENT ON VIEW monotremes_v IS
-    'Only the platypus is publicly visible';
-
   COMMENT ON COLUMN monotremes.has_venomous_claw IS
     'Sometimes breakfast is not worth it';
 

docs/references/api/preferences.rst

@@ -15,6 +15,7 @@ The following preferences are supported.
 - ``Prefer: missing``. See :ref:`prefer_missing`.
 - ``Prefer: max-affected``, See :ref:`prefer_max_affected`.
 - ``Prefer: tx``. See :ref:`prefer_tx`.
+- ``Prefer: params``. See :ref:`prefer_params`.
 
 .. _prefer_handling:
 
@@ -242,7 +243,7 @@ Will result in:
 Max Affected
 ============
 
-You can set a limit to the amount of resources affected in a request by sending ``max-affected`` preference. This feature works in combination with ``handling=strict`` preference. ``max-affected`` would be ignored with lenient handling. The "affected resources" are the number of rows returned by ``DELETE`` and ``PATCH`` requests.
+You can set a limit to the amount of resources affected in a request by sending ``max-affected`` preference. This feature works in combination with ``handling=strict`` preference. ``max-affected`` would be ignored with lenient handling. The "affected resources" are the number of rows returned by ``DELETE`` and ``PATCH`` requests. This is also supported through ``RPC`` calls.
 
 To illustrate the use of this preference, consider the following scenario where the ``items`` table contains 14 rows.
 
@@ -265,34 +266,30 @@ To illustrate the use of this preference, consider the following scenario where
       "hint": null
   }
 
-With :ref:`RPC <functions>`, the preference is honored completely on the basis of the number of rows returned in the result set of the function. This can be useful for complex mutation queries using `data-modifying statements <https://www.postgresql.org/docs/current/queries-with.html#QUERIES-WITH-MODIFYING>`_. A simple example:
+.. _prefer_params:
+
+Single JSON object as Function Parameter
+----------------------------------------
+
+.. warning::
+
+  Using this preference is **deprecated** in favor of :ref:`function_single_json`.
+
+:code:`Prefer: params=single-object` allows sending the JSON request body as the single argument of a :ref:`function <functions>`.
 
 .. code-block:: postgres
 
-  CREATE FUNCTION test.delete_items()
-  RETURNS SETOF items AS $$
-    DELETE FROM items WHERE id < 15 RETURNING *;
+  CREATE FUNCTION mult_them(param json) RETURNS int AS $$
+    SELECT (param->>'x')::int * (param->>'y')::int
   $$ LANGUAGE SQL;
 
 .. code-block:: bash
 
-  curl -i "http://localhost:3000/rpc/delete_items" \
-    -H "Content-Type: application/json" \
-    -H "Prefer: handling=strict, max-affected=10"
-
-.. code-block:: http
-
-  HTTP/1.1 400 Bad Request
+  curl "http://localhost:3000/rpc/mult_them" \
+    -X POST -H "Content-Type: application/json" \
+    -H "Prefer: params=single-object" \
+    -d '{ "x": 4, "y": 2 }'
 
 .. code-block:: json
 
-  {
-      "code": "PGRST124",
-      "message": "Query result exceeds max-affected preference constraint",
-      "details": "The query affects 14 rows",
-      "hint": null
-  }
-
-.. note::
-
-  It is important for functions to return ``SETOF`` or ``TABLE`` when called with ``max-affected`` preference. A violation of this would cause a :ref:`PGRST128 <pgrst128>` error.
+  8

docs/references/api/resource_embedding.rst

@@ -143,7 +143,7 @@ Since the table name is plural, we can be more accurate by making it singular wi
 One-to-many relationships
 -------------------------
 
-The **foreign key reference** establishes the inverse one-to-many relationship. In this case, ``films`` returns as a JSON array because of the "to-many" end.
+The **foreign key reference** establishes the inverse one-to-many relationship. In this case, ``films`` returns as a JSON array because of the “to-many” end.
 
 .. code-block:: bash
 
@@ -209,25 +209,18 @@ The join table is also detected if the composite key has additional columns.
 One-to-one relationships
 ------------------------
 
-One-to-one relationships are detected in two ways. (We'll use the ``films`` and ``technical_specs`` tables from the :ref:`sample film database <erd_film>` as an example).
+One-to-one relationships are detected in two ways.
 
-- When the foreign key is also a primary key.
+- When the foreign key is a primary key as specified in the :ref:`sample film database <erd_film>`.
+- When the foreign key has a unique constraint.
 
   .. code-block:: postgres
 
     create table technical_specs(
-      film_id int references films(id) primary key
-    -- ...
-    );
-
-- Or when the foreign key has a unique constraint.
-
-  .. code-block:: postgres
-
-    create table technical_specs(
-      id int primary key
-    , film_id int references films(id) unique
-    -- ...
+      film_id int references films(id) unique,
+      runtime time,
+      camera text,
+      sound text
     );
 
 .. code-block:: bash
@@ -251,12 +244,6 @@ Computed Relationships
 
 You can manually define relationships by using functions. This is useful for database objects that can't define foreign keys, like `Foreign Data Wrappers <https://wiki.postgresql.org/wiki/Foreign_data_wrappers>`_.
 
-Computed relationships have good performance as their intended design enable `function inlining <https://wiki.postgresql.org/wiki/Inlining_of_SQL_functions#Inlining_conditions_for_table_functions>`_.
-
-.. important::
-
-  - Always use ``SETOF`` when creating computed relationships. Functions can return a table without using ``SETOF``, but bear in mind that PostgreSQL will not inline them. e.g. ``RETURNS <table_name>`` is not inlinable.
-
 Assuming there's a foreign table ``premieres`` that we want to relate to ``films``.
 
 .. code-block:: postgres
@@ -289,10 +276,6 @@ The name of the function ``film`` is arbitrary and can be used to do the embeddi
     ".."
   ]
 
-.. warning::
-
-  - Make sure to correctly label the ``to-one`` part of the relationship. When using the ``ROWS 1`` estimation, PostgREST will expect a single row to be returned. If that is not the case, it will unnest the embedding and return repeated values for the top level resource.
-
 Now let's define the opposite one-to-many relationship.
 
 .. code-block:: postgres
@@ -341,6 +324,12 @@ Thanks to overloaded functions, you can use the same function name for different
 
 Computed relationships have good performance as their intended design enable `function inlining <https://wiki.postgresql.org/wiki/Inlining_of_SQL_functions#Inlining_conditions_for_table_functions>`_.
 
+.. warning::
+
+  - Always use ``SETOF`` when creating computed relationships. Functions can return a table without using ``SETOF``, but bear in mind that PostgreSQL will not inline them.
+
+  - Make sure to correctly label the ``to-one`` part of the relationship. When using the ``ROWS 1`` estimation, PostgREST will expect a single row to be returned. If that is not the case, it will unnest the embedding and return repeated values for the top level resource.
+
 .. _embed_disamb:
 .. _target_disamb:
 .. _hint_disamb:
@@ -938,12 +927,7 @@ Filters can also be applied on nested embedded resources:
 
 .. code-block:: bash
 
-  # curl "http://localhost:3000/films?select=*,roles(*,actors(*))&roles.actors.order=last_name&roles.actors.first_name=like.*Tom*"
-
-  curl --get "http://localhost:3000/films" \
-    -d "select=*,roles(*,actors(*))" \
-    -d "roles.actors.order=last_name" \
-    -d "roles.actors.first_name=like.*Tom*"
+  curl "http://localhost:3000/films?select=*,roles(*,actors(*))&roles.actors.order=last_name&roles.actors.first_name=like.*Tom*"
 
 The result will show the nested actors named Tom and order them by last name. Aliases can also be used instead of the resource names to filter the nested tables.
 
@@ -1154,19 +1138,14 @@ For example, to arrange the films in descending order using the director's last
 Spread embedded resource
 ========================
 
-You can modify the shape of the embedded resources by using the spread syntax (``...``).
-
-.. _spread_to_one_embed:
-
-Spread To-One relationships
----------------------------
-
-Spread on resources forming :ref:`one-to-one <one-to-one>` and :ref:`many-to-one <many-to-one>` relationships, will lift the embedded columns to the top object.
+On many-to-one and one-to-one relationships, you can "spread" the embedded resource. That is, remove the surrounding JSON object for the embedded resource columns.
 
 .. code-block:: bash
 
+   # curl "http://localhost:3000/films?select=title,...directors(director_last_name:last_name)&title=like.*Workers*"
+
   curl --get "http://localhost:3000/films" \
-    -d "select=title,...directors(director_first_name:first_name, director_last_name:last_name)" \
+    -d "select=title,...directors(director_last_name:last_name)" \
     -d "title=like.*Workers*"
 
 .. code-block:: json
@@ -1174,148 +1153,17 @@ Spread on resources forming :ref:`one-to-one <one-to-one>` and :ref:`many-to-one
    [
      {
        "title": "Workers Leaving The Lumière Factory In Lyon",
-       "director_first_name": "Louis",
        "director_last_name": "Lumière"
      }
    ]
 
-Note that there is no wrapping ``"directors"`` object, unlike regularly embedding :ref:`many-to-one <many-to-one>` relationships. Also note that embedded columns can be aliased normally.
+Note that there is no ``"directors"`` object. Also the embed columns can be aliased normally.
 
-.. _spread_to_many_embed:
-
-Spread To-Many relationships
-----------------------------
-
-Spread on resources forming :ref:`one-to-many <one-to-many>` and :ref:`many-to-many <many-to-many>` relationships, will convert the embedded columns into correlated arrays.
+You can use this to get the columns of a join table in a many-to-many relationship. For instance, to get films and its actors, but including the ``character`` column from the roles table:
 
 .. code-block:: bash
 
-  curl --get "http://localhost:3000/directors" \
-    -d "select=first_name,...films(film_titles:title,film_years:year)" \
-    -d "first_name=like.Quentin*"
-
-.. code-block:: json
-
-   [
-     {
-       "first_name": "Quentin",
-       "film_titles": [
-         "Pulp Fiction",
-         "Reservoir Dogs"
-       ],
-       "film_years": [
-         1994,
-         1992
-       ]
-     }
-   ]
-
-Note that ``films`` is no longer an array of objects, unlike regularly embedding :ref:`one-to-many`. The embedded columns become arrays and they're correlated-in the above result, we can say that "Pulp Fiction" premiered in 1994 and "Reservoir Dogs" in 1992.
-
-Order in spread to-many
-~~~~~~~~~~~~~~~~~~~~~~~
-
-In the above example, the order of the values inside the correlated arrays is unspecified, but all the values are guaranteed to be in the same unspecified order.
-
-You can order the correlated arrays explicitly. For example, to order by the film year:
-
-.. code-block:: bash
-
-  curl --get "http://localhost:3000/directors" \
-    -d "select=first_name,...films(film_titles:title,film_years:year)" \
-    -d "first_name=like.Quentin*" \
-    -d "films.order=year"
-
-.. code-block:: json
-
-   [
-     {
-       "first_name": "Quentin",
-       "film_titles": [
-         "Reservoir Dogs",
-         "Pulp Fiction"
-       ],
-       "film_years": [
-         1992,
-         1994
-       ]
-     }
-   ]
-
-.. warning::
-
-   Aliasing spreaded columns is recommended since JSON allows duplicate keys. Example:
-
-   .. code-block:: bash
-
-     curl --get "localhost:3000/projects" \
-       -d "select=id,name,...clients(id,name)"
-
-   .. code-block:: json
-
-     [{"id":1,"name":"Windows 7","id":1,"name":"Microsoft"},
-      {"id":2,"name":"Windows 10","id":1,"name":"Microsoft"},
-      {"id":3,"name":"IOS","id":2,"name":"Apple"},
-      {"id":4,"name":"OSX","id":2,"name":"Apple"},
-      {"id":5,"name":"Orphan","id":null,"name":null}]
-
-   This can be a problem in Javascript objects, since only the last duplicated key will be considered. To solve it do:
-
-   .. code-block:: bash
-
-     curl --get "localhost:3000/projects" \
-       -d "select=id,name,...clients(client_id:id,client_name:name)"
-
-
-Multiple Spreads
-----------------
-
-You can use multiple spreads at any level. For example, let's spread ``technical_specs`` and ``roles`` into ``films`` and then spread ``films`` into ``directors``:
-
-.. code-block:: bash
-
-  curl --get "http://localhost:3000/directors" \
-    -d "select=first_name,...films(film_titles:title,film_years:year,...technical_specs(film_runtimes:runtime),...roles(film_characters:character))" \
-    -d "first_name=like.Quentin*" \
-    -d "films.order=year" \
-    -d "films.roles.order=character"
-
-.. code-block:: json
-
-   [
-     {
-       "first_name": "Quentin",
-       "film_titles": [
-         "Reservoir Dogs",
-         "Pulp Fiction"
-       ],
-       "film_years": [
-         1992,
-         1994
-       ],
-       "film_runtimes": [
-         "01:39:00",
-         "02:29:00"
-       ]
-       "film_characters": [
-         [ "Mr. Pink", "Mr. White" ],
-         [ "Mia Wallace", "Vincent Vega" ]
-       ]
-     }
-   ]
-
-Note that:
-
-- All the ``film_*`` arrays are correlated-"Reservoir Dogs" premiered in 1992, its runtime is 1:39:00 and it has the following characters: ``[ "Mr. Pink", "Mr. White" ]``.
-- The ``film_*`` arrays are ordered by ``year`` (due to ``films.order=year``).
-- The bottom level array ``film_characters`` is ordered (due to ``films.roles.order=character``).
-
-Spread a join table
--------------------
-
-Spread can be used to move the columns of a join table in a :ref:`many-to-many <many-to-many>` to the top object. For instance, to get the ``character`` column of the ``roles`` join table into ``actors``:
-
-.. code-block:: bash
+   # curl "http://localhost:3000/films?select=title,actors:roles(character,...actors(first_name,last_name))&title=like.*Lighthouse*"
 
   curl --get "http://localhost:3000/films" \
     -d "select=title,actors:roles(character,...actors(first_name,last_name))" \
@@ -1336,4 +1184,6 @@ Spread can be used to move the columns of a join table in a :ref:`many-to-many <
      }
    ]
 
+.. note::
 
+  The spread operator ``...`` is borrowed from the Javascript `spread syntax <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Spread_syntax>`_.

docs/references/api/resource_representation.rst

@@ -100,15 +100,17 @@ This returns
 
   { "id": 1 }
 
+with a :code:`Content-Type: application/vnd.pgrst.object+json`.
+
 When a singular response is requested but no entries are found, the server responds with an error message and 406 Not Acceptable status code rather than the usual empty array and 200 status:
 
 .. code-block:: json
 
   {
-    "code": "PGRST116",
-    "message": "Cannot coerce the result to a single JSON object",
-    "details": "The result contains 0 rows",
-    "hint": null
+    "message": "JSON object requested, multiple (or no) rows returned",
+    "details": "Results contain 0 rows, application/vnd.pgrst.object+json requires 1 row",
+    "hint": null,
+    "code": "PGRST505"
   }
 
 .. note::

docs/references/api/tables_views.rst

@@ -72,7 +72,7 @@ imatch        :code:`~*`                ~* operator, see :ref:`pattern_matching`
 in            :code:`IN`                one of a list of values, e.g. :code:`?a=in.(1,2,3)`
                                         – also supports commas in quoted strings like
                                         :code:`?a=in.("hi,there","yes,you")`
-is            :code:`IS`                checking for exact equality (null,not_null,true,false,unknown)
+is            :code:`IS`                checking for exact equality (null,true,false,unknown)
 isdistinct    :code:`IS DISTINCT FROM`  not equal, treating :code:`NULL` as a comparable value
 fts           :code:`@@`                :ref:`fts` using to_tsquery
 plfts         :code:`@@`                :ref:`fts` using plainto_tsquery
@@ -175,56 +175,25 @@ To ensure best performance on larger data sets, an `appropriate index <https://w
 Full-Text Search
 ~~~~~~~~~~~~~~~~
 
-The :code:`fts` operator has a number of options to support flexible textual queries, namely the choice of plain vs phrase search and the language used for stemming.
-
-The following examples illustrate the possibilities, assuming column :code:`my_tsv` is of type `tsvector <https://www.postgresql.org/docs/current/datatype-textsearch.html>`_.
+The :code:`fts` filter mentioned above has a number of options to support flexible textual queries, namely the choice of plain vs phrase search and the language used for stemming. Suppose that :code:`tsearch` is a table with column :code:`my_tsv`, of type `tsvector <https://www.postgresql.org/docs/current/datatype-textsearch.html>`_. The following examples illustrate the possibilities.
 
 .. code-block:: bash
 
-  curl --get "http://localhost:3000/people" \
-    -d "my_tsv=fts(french).amusant"
+  curl "http://localhost:3000/tsearch?my_tsv=fts(french).amusant"
 
 .. code-block:: bash
 
-  curl --get "http://localhost:3000/people" \
-    -d "my_tsv=plfts.The%20Fat%20Cats"
+  curl "http://localhost:3000/tsearch?my_tsv=plfts.The%20Fat%20Cats"
 
 .. code-block:: bash
 
-  curl --get "http://localhost:3000/people" \
-    -d "my_tsv=not.phfts(english).The%20Fat%20Cats"
+  curl "http://localhost:3000/tsearch?my_tsv=not.phfts(english).The%20Fat%20Cats"
 
 .. code-block:: bash
 
-  curl --get "http://localhost:3000/people" \
-    -d "my_tsv=not.wfts(french).amusant"
+  curl "http://localhost:3000/tsearch?my_tsv=not.wfts(french).amusant"
 
-.. _fts_to_tsvector:
-
-Automatic ``tsvector`` conversion
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-If the filtered column is not of type ``tsvector``, then it will be automatically converted using `to_tsvector() <https://www.postgresql.org/docs/current/functions-textsearch.html#TEXTSEARCH-FUNCTIONS-TABLE>`_.
-This allows using the ``fts`` operator on ``text`` and ``json`` types out of the box.
-
-.. code-block:: bash
-
-  curl --get "http://localhost:3000/people" \
-    -d "my_text_column=fts(french).amusant"
-
-.. code-block:: bash
-
-  curl --get "http://localhost:3000/people" \
-    -d "my_json_column=not.phfts(english).The%20Fat%20Cats"
-
-.. important::
-
-  To ensure this operation is fast, you need to create an index on the expression:
-
-  .. code-block:: postgres
-
-    CREATE INDEX idx_people_col ON people
-    USING GIN (to_tsvector('french', my_text_column));
+Using `websearch_to_tsquery` requires PostgreSQL of version at least 11.0 and will raise an error in earlier versions of the database.
 
 .. _v_filter:
 
@@ -714,6 +683,31 @@ Deletions also support :ref:`prefer_return`, :ref:`resource_embedding` and :ref:
 
   Beware of accidentally deleting all rows in a table. To learn to prevent that see :ref:`block_fulltable`.
 
+.. _limited_update_delete:
+
+Limited Update/Delete
+=====================
+
+You can limit the amount of affected rows by :ref:`update` or :ref:`delete` with the ``limit`` query parameter. For this, you must add an explicit ``order`` on a unique column(s).
+
+.. code-block:: bash
+
+  curl -X PATCH "/users?limit=10&order=id&last_login=lt.2020-01-01" \
+    -H "Content-Type: application/json" \
+    -d '{ "status": "inactive" }'
+
+.. code-block:: bash
+
+  curl -X DELETE "http://localhost:3000/users?limit=10&order=id&status=eq.inactive"
+
+If your table has no unique columns, you can use the `ctid <https://www.postgresql.org/docs/current/ddl-system-columns.html>`_ system column.
+
+Using ``offset`` to target a different subset of rows is also possible.
+
+.. note::
+
+  There is no native ``UPDATE...LIMIT`` or ``DELETE...LIMIT`` support in PostgreSQL; the generated query simulates that behavior and is based on `this Crunchy Data blog post <https://www.crunchydata.com/blog/simulating-update-or-delete-with-limit-in-postgres-ctes-to-the-rescue>`_.
+
 .. raw:: html
 
   <script type="text/javascript">

docs/references/auth.rst

@@ -31,7 +31,7 @@ The authenticator role is used for connecting to the database and should be conf
 .. _user_impersonation:
 
 User Impersonation
-~~~~~~~~~~~~~~~~~~
+------------------
 
 The picture below shows how the server handles authentication. If auth succeeds, it switches into the user role specified by the request, otherwise it switches into the anonymous role (if it's set in :ref:`db-anon-role`).
 
@@ -43,13 +43,12 @@ This role switching mechanism is called **user impersonation**. In PostgreSQL it
 
   The impersonated roles will have their settings applied. See :ref:`impersonated_settings`.
 
-.. _jwt_auth:
+.. _jwt_impersonation:
 
-JWT Authentication
-------------------
+JWT-Based User Impersonation
+----------------------------
 
-We use `JSON Web Tokens <https://datatracker.ietf.org/doc/html/rfc7519/>`_ to authenticate API requests, this allows us to be stateless and not require database lookups for verification.
-As you'll recall a JWT contains a list of cryptographically signed claims. All claims are allowed but PostgREST cares specifically about a claim called role (configurable with :ref:`jwt_role_extract`).
+We use `JSON Web Tokens <https://jwt.io/>`_ to authenticate API requests, this allows us to be stateless and not require database lookups for verification. As you'll recall a JWT contains a list of cryptographically signed claims. All claims are allowed but PostgREST cares specifically about a claim called role.
 
 .. code:: json
 
@@ -73,10 +72,17 @@ Note that the database administrator must allow the authenticator role to switch
 
 If the client included no JWT (or one without a role claim) then PostgREST switches into the anonymous role. The database administrator must set the anonymous role permissions correctly to prevent anonymous users from seeing or changing things they shouldn't.
 
-.. _bearer_auth:
+.. _jwt_generation:
 
-Bearer Authentication
-~~~~~~~~~~~~~~~~~~~~~
+JWT Generation
+~~~~~~~~~~~~~~
+
+You can create a valid JWT either from inside your database (see :ref:`sql_user_management`) or via an external service (see :ref:`external_jwt`).
+
+.. _client_auth:
+
+Client Auth
+~~~~~~~~~~~
 
 To make an authenticated request the client must include an :code:`Authorization` HTTP header with the value :code:`Bearer <jwt>`. For instance:
 
@@ -87,29 +93,24 @@ To make an authenticated request the client must include an :code:`Authorization
 
 The ``Bearer`` header value can be used with or without capitalization(``bearer``).
 
-.. _jwt_generation:
+.. _jwt_caching:
 
-JWT Generation
-~~~~~~~~~~~~~~
+JWT Caching
+-----------
 
-You can create a valid JWT either from inside your database (see :ref:`sql_user_management`) or via an external service (see :ref:`external_auth`).
+PostgREST validates ``JWTs`` on every request. We can cache ``JWTs`` to avoid this performance overhead.
 
-.. _jwt_signature:
+To enable JWT caching, the config :code:`jwt-cache-max-lifetime` is to be set. It is the maximum number of seconds for which the cache stores the JWT validation results. The cache uses the :code:`exp` claim to set the cache entry lifetime. If the JWT does not have an :code:`exp` claim, it uses the config value. See :ref:`jwt-cache-max-lifetime` for more details.
 
-JWT Signature Verification
---------------------------
+.. note::
 
-PostgREST supports both symmetric and asymmetric keys for verifying the signature of the token.
+  You can use the :ref:`server-timing_header` to see the effect of JWT caching.
 
 Symmetric Keys
 ~~~~~~~~~~~~~~
 
-In the case of symmetric cryptography the signer and verifier share the same secret passphrase, which can be configured with :ref:`jwt-secret`.
-If it is set to a simple string then PostgREST interprets it as an HMAC-SHA256 passphrase.
-
-.. code-block:: ini
-
-  jwt-secret = "reallyreallyreallyreallyverysafe"
+Each token is cryptographically signed with a secret key. In the case of symmetric cryptography the signer and verifier share the same secret passphrase, which can be configured with :ref:`jwt-secret`.
+If it is set to a simple string value like “reallyreallyreallyreallyverysafe” then PostgREST interprets it as an HMAC-SHA256 passphrase.
 
 .. _asym_keys:
 
@@ -155,112 +156,21 @@ You can specify the literal value as we saw earlier, or reference a filename to
 
   jwt-secret = "@rsa.jwk.pub"
 
-``kid`` verification
-^^^^^^^^^^^^^^^^^^^^
-
-PostgREST has built-in verification of the `key ID parameter <https://www.rfc-editor.org/rfc/rfc7517#section-4.5>`_, useful when working with a JSON Web Key Set.
-It goes as follows:
-
-- If the JWT contains a ``kid`` parameter, then PostgREST will look for the JSON Web Key in the :ref:`jwt-secret`.
-
-  + If no key has a matching ``kid`` (or if they don't have one defined), the token will be rejected with a :ref:`401 Unauthorized <pgrst301>` error.
-  + If a key matches the ``kid`` value then it will validate the token against that key accordingly.
-
-- If the JWT doesn't have a ``kid``, PostgREST  will try each key in the :ref:`jwt-secret` one by one until it finds one that works.
-
-.. _jwt_claims_validation:
-
 JWT Claims Validation
----------------------
+~~~~~~~~~~~~~~~~~~~~~
 
-Time-Based claims validation
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-The time-based JWT claims specified in `RFC 7519 <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4>`_ are validated:
+PostgREST honors the following `JWT claims <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4>`_:
 
 - ``exp`` Expiration Time
 - ``iat`` Issued At
 - ``nbf`` Not Before
-
-We allow a 30-second clock skew when validating the above claims. In other words, we give an extra 30 seconds before the JWT is rejected if there is a slight discrepancy in the timestamps.
-
-.. _jwt_aud:
-
-``aud`` validation
-~~~~~~~~~~~~~~~~~~
-
-PostgREST has built-in validation of the `JWT audience claim <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3>`_.
-It works this way:
-
-- If :ref:`jwt-aud` is not set (the default), PostgREST identifies with all audiences and allows the JWT for any ``aud`` claim.
-- If :ref:`jwt-aud` is set to a specific audience, PostgREST will check if this audience is present in the ``aud`` claim:
-
-  + If the ``aud`` value is a JSON string, it will match it to the :ref:`jwt-aud`.
-  + If the ``aud`` value is a JSON array of strings, it will search every element for a match.
-  + If the match fails or if the ``aud`` value is not a string or array of strings, then the token will be rejected with a :ref:`401 Unauthorized <pgrst303>` error.
-  + If the ``aud`` key **is not present** or if its value is ``null`` or ``[]``, PostgREST will interpret this token as allowed for all audiences and will complete the request.
-
-.. _jwt_caching:
-
-JWT Cache
----------
-
-JWT signature validation (specially :ref:`asym_keys` such as RSA) is slow, we can cache ``JWT`` validation results to avoid this performance overhead.
-
-The JWT cache is bounded and uses the `SIEVE algorithm <https://cachemon.github.io/SIEVE-website>`_ for efficient eviction. The cache is enabled by default and can be configured with :ref:`jwt-cache-max-entries`.
-
-It's recommended to leave the JWT cache enabled as our load tests indicate ~20% more throughput for simple GET requests when using it. This while reducing CPU utilization in exchange for a bit more memory.
-
-:ref:`jwt_cache_metrics` are available.
+- ``aud`` Audience, see :ref:`jwt-aud`
 
 .. note::
-
-  - If the ``jwt-secret`` is changed and the config is reloaded, the JWT cache will reset.
-  - JWTs that pass :ref:`jwt_signature` are cached, regardless if they pass :ref:`jwt_claims_validation`. We do this to ensure responses stays fast under common failure cases (such as expired JWTs).
-  - You can use the :ref:`server-timing_header` to see the peformance benefit of JWT caching.
-
-.. _jwt_role_extract:
-
-JWT Role Extraction
--------------------
-
-A JSPath DSL that specifies the location of the :code:`role` key in the JWT claims. It's configured by :ref:`jwt-role-claim-key`. This can be used to consume a JWT provided by a third party service like Auth0, Okta, Microsoft Entra or Keycloak.
-
-The DSL follows the `JSONPath <https://goessner.net/articles/JsonPath/>`_ expression grammar with extended string comparison operators. Supported operators are:
-
-- ``==`` selects the first array element that exactly matches the right operand
-- ``!=`` selects the first array element that does not match the right operand
-- ``^==`` selects the first array element that starts with the right operand
-- ``==^`` selects the first array element that ends with the right operand
-- ``*==`` selects the first array element that contains the right operand
-
-Usage examples:
-
-  .. code:: bash
-
-    # {"postgrest":{"roles": ["other", "author"]}}
-    # the DSL accepts characters that are alphanumerical or one of "_$@" as keys
-    jwt-role-claim-key = ".postgrest.roles[1]"
-
-    # {"https://www.example.com/role": { "key": "author" }}
-    # non-alphanumerical characters can go inside quotes(escaped in the config value)
-    jwt-role-claim-key = ".\"https://www.example.com/role\".key"
-
-    # {"postgrest":{"roles": ["other", "author"]}}
-    # `@` represents the current element in the array
-    # all the these match the string "author"
-    jwt-role-claim-key = ".postgrest.roles[?(@ == \"author\")]"
-    jwt-role-claim-key = ".postgrest.roles[?(@ != \"other\")]"
-    jwt-role-claim-key = ".postgrest.roles[?(@ ^== \"aut\")]"
-    jwt-role-claim-key = ".postgrest.roles[?(@ ==^ \"hor\")]"
-    jwt-role-claim-key = ".postgrest.roles[?(@ *== \"utho\")]"
-
-.. note::
-
-  The string comparison operators are implemented as a custom extension to the JSPath and does not strictly follow the `RFC 9535 <https://www.rfc-editor.org/rfc/rfc9535.html>`_.
+  PostgREST allows for a 30-second clock skew when validating the ``exp`` and ``iat`` claims. In other words, it gives an extra 30 seconds before the token is rejected if there is a slight discrepancy in the timestamps.
 
 JWT Security
-------------
+~~~~~~~~~~~~
 
 There are at least three types of common critiques against using JWT: 1) against the standard itself, 2) against using libraries with known security vulnerabilities, and 3) against using JWT for web sessions. We'll briefly explain each critique, how PostgREST deals with it, and give recommendations for appropriate user action.
 
@@ -296,23 +206,3 @@ doing custom logic based on the web user info.
     END IF;
   END
   $$ LANGUAGE plpgsql;
-
-.. raw:: html
-
-  <script type="text/javascript">
-    let hash = window.location.hash;
-
-    const redirects = {
-      '#jwt-based-user-impersonation': '#jwt-authentication',
-      '#client-auth': '#bearer-authentication',
-      '#jwt-caching': '#jwt-cache',
-      '#jwk-kid-validation': '#kid-verification',
-      '#jwt-aud-claim-validation': '#aud-validation',
-    };
-
-    let willRedirectTo = redirects[hash];
-
-    if (willRedirectTo) {
-      window.location.href = willRedirectTo;
-    }
-  </script>

docs/references/cli.rst

@@ -3,47 +3,23 @@
 CLI
 ===
 
-PostgREST provides a CLI with the options listed below:
-
-.. code:: text
-
-  Usage: postgrest [-v|--version] [-e|--example] [--dump-config | --dump-schema | --ready]
-                 [FILENAME]
-
-    PostgREST / create a REST API to an existing Postgres
-    database
-
-  Available options:
-    -h,--help                Show this help text
-    -v,--version             Show the version information
-    -e,--example             Show an example configuration file
-    --dump-config            Dump loaded configuration and exit
-    --dump-schema            Dump loaded schema as JSON and exit (for debugging,
-                             output structure is unstable)
-    --ready                  Checks the health of PostgREST by doing a request on
-                             the admin server /ready endpoint
-    FILENAME                 Path to configuration file
-
-FILENAME
---------
-
-Runs PostgREST with the given :ref:`file_config`.
+PostgREST provides a CLI with the commands listed below:
 
 Help
 ----
 
 .. code:: bash
 
-  $ postgrest --help
+  $ postgrest [-h|--help]
 
-Shows all the options available.
+Shows all the commands available.
 
 Version
 -------
 
 .. code:: bash
 
-  $ postgrest --version
+  $ postgrest [-v|--version]
 
 Prints the PostgREST version.
 
@@ -52,16 +28,16 @@ Example
 
 .. code:: bash
 
-  $ postgrest --example
+  $ postgrest [-e|--example]
 
-Shows example configuration settings.
+Shows example configuration options.
 
 Dump Config
 -----------
 
 .. code:: bash
 
-  $ postgrest --dump-config
+  $ postgrest [--dump-config]
 
 Dumps the loaded :ref:`configuration` values, considering the configuration file, environment variables and :ref:`in_db_config`.
 
@@ -70,20 +46,6 @@ Dump Schema
 
 .. code:: bash
 
-  $ postgrest --dump-schema
+  $ postgrest [--dump-schema]
 
 Dumps the schema cache in JSON format.
-
-Ready Flag
-----------
-
-Makes a request to the ``/ready`` endpoint of the :ref:`admin_server`. It exits with a return code of ``0`` on success and ``1`` on failure.
-
-.. code-block:: bash
-
-  $ postgrest --ready
-  OK: http://localhost:3001/ready
-
-.. note::
-
-  The ``--ready`` flag cannot be used when :ref:`server-host` is configured with special hostnames. We suggest to change it to ``localhost``.

docs/references/configuration.rst

@@ -146,21 +146,6 @@ To reload the configuration from within the database, you can use the ``NOTIFY``
 List of parameters
 ==================
 
-.. _admin-server-host:
-
-admin-server-host
------------------
-
-  =============== =======================
-  **Type**        String
-  **Default**     `server-host` value
-  **Reloadable**  N
-  **Environment** PGRST_ADMIN_SERVER_HOST
-  **In-Database** `n/a`
-  =============== =======================
-
-  Specifies the host for the :ref:`admin_server`. Defaults to :ref:`server-host` value.
-
 .. _admin-server-port:
 
 admin-server-port
@@ -174,7 +159,31 @@ admin-server-port
   **In-Database** `n/a`
   =============== =======================
 
-  Specifies the port for the :ref:`admin_server`. Cannot be equal to :ref:`server-port`.
+  Specifies the port for the :ref:`admin_server`.
+
+.. _admin-server-config-enabled:
+
+admin-server-config-enabled
+---------------------------
+
+  .. danger::
+
+    The ``/config`` endpoint contains sensitive information, don't enable this if you're exposing the Admin Server publicly.
+
+    To safely enable this you can use a proxy like :ref:`nginx` to:
+
+    - Ensure ``/config`` are only available to local networks.
+    - Only expose ``/live`` and ``/ready`` to public networks.
+
+  =============== =================================
+  **Type**        Boolean
+  **Default**     False
+  **Reloadable**  N
+  **Environment** PGRST_ADMIN_SERVER_CONFIG_ENABLED
+  **In-Database** `n/a`
+  =============== =================================
+
+  Enables the admin server :ref:`runtime_config` and :ref:`runtime_schema_cache` endpoints.
 
 .. _app.settings.*:
 
@@ -191,10 +200,6 @@ app.settings.*
 
   Arbitrary settings that can be used to pass in secret keys directly as strings, or via OS environment variables. For instance: :code:`app.settings.jwt_secret = "$(MYAPP_JWT_SECRET)"` will take :code:`MYAPP_JWT_SECRET` from the environment and make it available to PostgreSQL functions as :code:`current_setting('app.settings.jwt_secret')`.
 
-  When using the environment variable `PGRST_APP_SETTINGS_*` form, the remainder of the variable is used as the new name. Case is not important : :code:`PGRST_APP_SETTINGS_MY_ENV_VARIABLE=some_value` can be accessed in postgres as :code:`current_setting('app.settings.my_env_variable')`.
-
-  The :code:`current_setting` function has `an optional boolean second <https://www.postgresql.org/docs/current/functions-admin.html#FUNCTIONS-ADMIN-SET>`_ argument to avoid it from raising an error if the value was not defined. Default values to :code:`app.settings` can then be given by combining this argument with :code:`coalesce` and :code:`nullif` : :code:`coalesce(nullif(current_setting('app.settings.my_custom_variable', true), ''), 'default value')`. The use of :code:`nullif` is necessary because if set in a transaction, the setting is sometimes not "rolled back" to :code:`null`. See also :ref:`this section <guc_req_headers_cookies_claims>` for more information on this behaviour.
-
 .. _db-aggregates-enabled:
 
 db-aggregates-enabled
@@ -315,10 +320,6 @@ db-extra-search-path
 
   Multiple schemas can be added in a comma-separated string, e.g. ``public, extensions``.
 
-.. important::
-
-  We default this config to ``public`` because it is the most common schema used to install PostgreSQL extensions such as :ref:`PostGIS <ww_postgis>`. You can disable this by setting this config to ``""``.
-
 .. _db-hoisted-tx-settings:
 
 db-hoisted-tx-settings
@@ -409,7 +410,7 @@ db-pool-max-idletime
   **In-Database** `n/a`
   =============== =================================
 
-   *For backwards compatibility, this config parameter is also available as "db-pool-timeout".*
+   *For backwards compatibility, this config parameter is also available as “db-pool-timeout”.*
 
    Time in seconds to close idle pool connections.
 
@@ -603,7 +604,11 @@ jwt-aud
   **In-Database** pgrst.jwt_aud
   =============== =================================
 
-    Specifies an audience for the JWT ``aud`` claim. See :ref:`jwt_aud`.
+  Specifies the `JWT audience claim <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3>`_. If this claim is present in the client provided JWT then you must set this to the same value as in the JWT, otherwise verifying the JWT will fail.
+
+  .. warning::
+
+     Using this setting will only reject tokens with a different audience claim. Tokens **without** audience claim will still be accepted.
 
 .. _jwt-role-claim-key:
 
@@ -620,7 +625,17 @@ jwt-role-claim-key
 
   *For backwards compatibility, this config parameter is also available without prefix as "role-claim-key".*
 
-  See :ref:`jwt_role_extract` on how to specify key paths and usage examples.
+  A JSPath DSL that specifies the location of the :code:`role` key in the JWT claims. This can be used to consume a JWT provided by a third party service like Auth0, Okta or Keycloak. Usage examples:
+
+  .. code:: bash
+
+    # {"postgrest":{"roles": ["other", "author"]}}
+    # the DSL accepts characters that are alphanumerical or one of "_$@" as keys
+    jwt-role-claim-key = ".postgrest.roles[1]"
+
+    # {"https://www.example.com/role": { "key": "author }}
+    # non-alphanumerical characters can go inside quotes(escaped in the config value)
+    jwt-role-claim-key = ".\"https://www.example.com/role\".key"
 
 .. _jwt-secret:
 
@@ -658,20 +673,20 @@ jwt-secret-is-base64
 
   When this is set to :code:`true`, the value derived from :code:`jwt-secret` will be treated as a base64 encoded secret.
 
-.. _jwt-cache-max-entries:
+.. _jwt-cache-max-lifetime:
 
-jwt-cache-max-entries
+jwt-cache-max-lifetime
 ----------------------
 
   =============== =================================
   **Type**        Int
-  **Default**     1000
+  **Default**     0
   **Reloadable**  Y
-  **Environment** PGRST_JWT_CACHE_MAX_ENTRIES
-  **In-Database** pgrst.jwt_cache_max_entries
+  **Environment** PGRST_JWT_CACHE_MAX_LIFETIME
+  **In-Database** pgrst.jwt_cache_max_lifetime
   =============== =================================
 
-  Maximum number of entries in JWT cache. The value :code:`0` disables JWT caching. See :ref:`jwt_caching`.
+  Maximum number of seconds of lifetime for cached entries. The default :code:`0` disables caching. See :ref:`jwt_caching`.
 
 .. _log-level:
 
@@ -708,21 +723,6 @@ log-level
 
   Because currently there's no buffering for logging, the levels with minimal logging(``crit/error``) will increase throughput.
 
-.. _log-query:
-
-log-query
----------
-
-  =============== =================================
-  **Type**        Boolean
-  **Default**     False
-  **Reloadable**  Y
-  **Environment** PGRST_LOG_QUERY
-  **In-Database** `n/a`
-  =============== =================================
-
-  Logs the SQL query for the corresponding request at the current :ref:`log-level`. See :ref:`sql_query_logs`.
-
 .. _openapi-mode:
 
 openapi-mode
@@ -836,12 +836,6 @@ server-host
   * :code:`*6` - any IPv4 or IPv6 hostname, IPv6 preferred
   * :code:`!6` - any IPv6 hostname
 
-  Examples:
-
-  .. code:: bash
-
-    server-host = "127.0.0.1"
-
 .. _server-port:
 
 server-port

docs/references/connection_pool.rst

@@ -15,7 +15,7 @@ Dynamic Connection Pool
 
 To conserve system resources, PostgREST uses a dynamic connection pool. This enables the number of connections in the pool to increase and decrease depending on request traffic.
 
-- If all the connections are being used, a new connection is added. The pool can grow until it reaches the :ref:`db-pool` size. Note that it's pointless to set this higher than the ``max_connections`` setting in your database.
+- If all the connections are being used, a new connection is added. The pool can grow until it reaches the :ref:`db-pool` size. Note that it’s pointless to set this higher than the ``max_connections`` setting in your database.
 - If a connection is unused for a period of time (:ref:`db-pool-max-idletime`), it will be released.
 - For connecting to the database, the :ref:`authenticator <roles>` role is used. You can configure this using :ref:`db-uri`.
 
@@ -106,4 +106,4 @@ Also set :ref:`db-channel-enabled` to ``false`` since ``LISTEN`` is not compatib
 
 .. note::
 
-  It's not recommended to use an external connection pooler. `Our benchmarks <https://github.com/PostgREST/postgrest/issues/2294#issuecomment-1139148672>`_ indicate it provides much lower performance than PostgREST built-in pool.
+  It’s not recommended to use an external connection pooler. `Our benchmarks <https://github.com/PostgREST/postgrest/issues/2294#issuecomment-1139148672>`_ indicate it provides much lower performance than PostgREST built-in pool.

docs/references/errors.rst

@@ -5,8 +5,6 @@ Errors
 
 PostgREST error messages follow the PostgreSQL error structure. It includes ``MESSAGE``, ``DETAIL``, ``HINT``, ``ERRCODE`` and will add an HTTP status code to the response.
 
-.. _postgresql_errors:
-
 Errors from PostgreSQL
 ======================
 
@@ -207,6 +205,14 @@ Related to the HTTP request elements.
 |               |             | specified in the ``select`` part of the query string.       |
 | PGRST108      |             | See :ref:`embed_filters`.                                   |
 +---------------+-------------+-------------------------------------------------------------+
+| .. _pgrst109: | 400         | Restricting a Deletion or an Update using limits must       |
+|               |             | include the ordering of a unique column.                    |
+| PGRST109      |             | See :ref:`limited_update_delete`.                           |
++---------------+-------------+-------------------------------------------------------------+
+| .. _pgrst110: | 400         | When restricting a Deletion or an Update using limits       |
+|               |             | modifies more rows than the maximum specified in the limit. |
+| PGRST110      |             | See :ref:`limited_update_delete`.                           |
++---------------+-------------+-------------------------------------------------------------+
 | .. _pgrst111: | 500         | An invalid ``response.headers`` was set.                    |
 |               |             | See :ref:`guc_resp_hdrs`.                                   |
 | PGRST111      |             |                                                             |
@@ -235,6 +241,10 @@ Related to the HTTP request elements.
 |               |             | there is no many-to-one or one-to-one relationship between  |
 | PGRST118      |             | them.                                                       |
 +---------------+-------------+-------------------------------------------------------------+
+| .. _pgrst119: | 400         | Could not use the spread operator on the related table      |
+|               |             | because there is no many-to-one or one-to-one relationship  |
+| PGRST119      |             | between them.                                               |
++---------------+-------------+-------------------------------------------------------------+
 | .. _pgrst120: | 400         | An embedded resource can only be filtered using the         |
 |               |             | ``is.null`` or ``not.is.null`` :ref:`operators <operators>`.|
 | PGRST120      |             |                                                             |
@@ -247,31 +257,6 @@ Related to the HTTP request elements.
 |               |             | ``Prefer: handling=strict``. See :ref:`prefer_handling`.    |
 | PGRST122      |             |                                                             |
 +---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst123: | 400         | Aggregate functions are disabled.                           |
-|               |             | See :ref:`db-aggregates-enabled`.                           |
-| PGRST123      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst124: | 400         | ``max-affected`` preference is violated.                    |
-|               |             | See :ref:`prefer_max_affected`.                             |
-| PGRST124      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst125: | 404         | Invalid path is specified in request URL.                   |
-|               |             |                                                             |
-| PGRST125      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst126: | 404         | Open API config is disabled but API root path is            |
-|               |             | accessed. See :ref:`openapi-mode`.                          |
-| PGRST126      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst127: | 400         | The feature specified in the ``details`` field is not       |
-|               |             | implemented.                                                |
-| PGRST127      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst128: | 400         | ``max-affected`` preference is violated with ``RPC`` call.  |
-|               |             | See :ref:`prefer_max_affected`.                             |
-| PGRST128      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
-
 
 .. _pgrst2**:
 
@@ -305,10 +290,6 @@ Related to a :ref:`schema_cache`. Most of the time, these errors are solved by :
 |               |             | in the ``columns`` query parameter is not found.            |
 | PGRST204      |             |                                                             |
 +---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst205: | 404         | Caused when the :ref:`table specified <tables_views>` in    |
-|               |             | the URI is not found.                                       |
-| PGRST205      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
 
 .. _pgrst3**:
 
@@ -324,18 +305,14 @@ Related to the authentication process using JWT. You can follow the :ref:`tut1`
 |               |             | configuration.                                              |
 | PGRST300      |             |                                                             |
 +---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst301: | 401         | Provided JWT couldn't be decoded or it is invalid.          |
-|               |             |                                                             |
+| .. _pgrst301: | 401         | Any error related to the verification of the JWT,           |
+|               |             | which means that the JWT provided is invalid in some way.   |
 | PGRST301      |             |                                                             |
 +---------------+-------------+-------------------------------------------------------------+
 | .. _pgrst302: | 401         | Attempted to do a request without                           |
-|               |             | :ref:`bearer_auth` when the anonymous role                  |
+|               |             | :ref:`authentication <client_auth>` when the anonymous role |
 | PGRST302      |             | is disabled by not setting it in :ref:`db-anon-role`.       |
 +---------------+-------------+-------------------------------------------------------------+
-| .. _pgrst303: | 401         | :ref:`JWT claims validation <jwt_claims_validation>`        |
-|               |             | or parsing failed.                                          |
-| PGRST303      |             |                                                             |
-+---------------+-------------+-------------------------------------------------------------+
 
 .. The Internal Errors Group X** is always at the end
 
@@ -354,8 +331,6 @@ Internal errors. If you encounter any of these, you may have stumbled on a Postg
 | PGRSTX00      |             |                                                             |
 +---------------+-------------+-------------------------------------------------------------+
 
-.. _custom_errors:
-
 Custom Errors
 =============
 
@@ -452,24 +427,3 @@ For non standard HTTP status, you can optionally add ``status_text`` to describe
   detail = '{"status":419,"status_text":"Page Expired","headers":{"X-Powered-By":"Nerd Rage"}}';
 
 If PostgREST can't parse the JSON objects ``message`` and ``detail``, it will throw a ``PGRST121`` error. See :ref:`Errors from PostgREST<pgrst1**>`.
-
-.. _proxy-status_header:
-
-Proxy-Status Header
-===================
-
-For error cases, the standard `Proxy-Status <https://www.rfc-editor.org/rfc/rfc9209.html#name-the-proxy-status-http-field>`_ header is returned with the error code. The error code comes from either :ref:`PostgREST <pgrst_errors>`, :ref:`PostgreSQL <postgresql_errors>` or :ref:`Custom <custom_errors>` errors. This is useful when doing ``HEAD`` requests where the HTTP status is not descriptive enough.
-
-For example, doing a request on a table with high count (say 30_000_000), we get:
-
-.. code-block:: http
-
-  HEAD /table HTTP/1.1
-  Prefer: count=exact
-
-.. code-block:: http
-
-  HTTP/1.1 500 Internal Server Error
-  Proxy-Status: PostgREST; error=57014
-
-The PostgreSQL error code ``57014`` (`ref <https://www.postgresql.org/docs/current/errcodes-appendix.html>`_) reveals that the error is due to a short ``statement_timeout`` value.

docs/references/listener.rst

@@ -4,7 +4,7 @@ Listener
 ########
 
 PostgREST uses `LISTEN <https://www.postgresql.org/docs/current/sql-listen.html>`_ to reload its :ref:`Schema Cache <schema_reloading_notify>` and :ref:`Configuration <config_reloading_notify>` via `NOTIFY <https://www.postgresql.org/docs/current/sql-notify.html>`_.
-This is useful in environments where you can't send SIGUSR1 or SIGUSR2 Unix Signals.
+This is useful in environments where you can’t send SIGUSR1 or SIGUSR2 Unix Signals.
 Like on cloud managed containers or on Windows systems.
 
 .. code:: postgresql

docs/references/observability.rst

@@ -15,14 +15,12 @@ Observability allows measuring a system's current state based on the data it gen
 Logs
 ====
 
-PostgREST logs basic request information to ``stdout``, including the authenticated user if available, the requesting IP address and user agent, the URL requested, the HTTP response status and the response body size in bytes if available.
-
-With :ref:`log-level` set to ``info``, we get:
+PostgREST logs basic request information to ``stdout``, including the authenticated user if available, the requesting IP address and user agent, the URL requested, and HTTP response status.
 
 .. code::
 
-   127.0.0.1 - user [26/Jul/2021:01:56:38 -0500] "GET /clients HTTP/1.1" 200 56 "" "curl/7.64.0"
-   127.0.0.1 - anonymous [26/Jul/2021:01:56:48 -0500] "GET /unexistent HTTP/1.1" 404 162 "" "curl/7.64.0"
+   127.0.0.1 - user [26/Jul/2021:01:56:38 -0500] "GET /clients HTTP/1.1" 200 - "" "curl/7.64.0"
+   127.0.0.1 - anonymous [26/Jul/2021:01:56:48 -0500] "GET /unexistent HTTP/1.1" 404 - "" "curl/7.64.0"
 
 For diagnostic information about the server itself, PostgREST logs to ``stderr``:
 
@@ -33,50 +31,22 @@ For diagnostic information about the server itself, PostgREST logs to ``stderr``
 .. code::
 
    06/May/2024:08:16:11 -0500: Starting PostgREST 12.1...
+   06/May/2024:08:16:11 -0500: Attempting to connect to the database...
    06/May/2024:08:16:11 -0500: Successfully connected to PostgreSQL 14.10 (Ubuntu 14.10-0ubuntu0.22.04.1) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, 64-bit
-   06/May/2024:08:16:11 -0500: Connection Pool initialized with a maximum size of 10 connections
-   06/May/2024:08:16:11 -0500: API server listening on port 3000
-   06/May/2024:08:16:11 -0500: Listening for database notifications on the "pgrst" channel
+   06/May/2024:08:16:11 -0500: Listening on port 3000
+   06/May/2024:08:16:11 -0500: Listening for notifications on the "pgrst" channel
    06/May/2024:08:16:11 -0500: Config reloaded
    06/May/2024:08:16:11 -0500: Schema cache queried in 3.8 milliseconds
    06/May/2024:08:16:11 -0500: Schema cache loaded 15 Relations, 8 Relationships, 8 Functions, 0 Domain Representations, 4 Media Type Handlers
    06/May/2024:14:11:27 -0500: Received a config reload message on the "pgrst" channel
    06/May/2024:14:11:27 -0500: Config reloaded
 
-.. note::
-
-  Logs are based on the ``log-level`` setting. See :ref:`log-level`.
-
-.. _sql_query_logs:
-
-SQL Query Logs
---------------
-
-To log the SQL queries executed for a request, set the :ref:`log-query` to ``true``. It will be logged based on the current :ref:`log-level` setting.
-
-.. code-block:: bash
-
-  log-level = "warn"
-  log-query = "true"
-
-The SQL queries will only be logged on ``400`` HTTP errors and up.
-So, if the user requests a resource without sufficient privileges:
-
-.. code-block:: bash
-
-  curl "localhost:3000/protected_table"
-
-This will be logged by PostgREST:
-
-.. code::
-
-  17/Feb/2025:17:28:15 -0500: WITH pgrst_source AS ( SELECT "public"."protected_table".* FROM "public"."protected_table"  )  SELECT null::bigint AS total_result_set, pg_catalog.count(_postgrest_t) AS page_total, coalesce(json_agg(_postgrest_t), '[]') AS body, nullif(current_setting('response.headers', true), '') AS response_headers, nullif(current_setting('response.status', true), '') AS response_status, '' AS response_inserted FROM ( SELECT * FROM pgrst_source ) _postgrest_t
-  127.0.0.1 - web_anon [17/Feb/2025:17:28:15 -0500] "GET /protected_table HTTP/1.1" 401 99 "" "curl/8.7.1"
-
 Database Logs
 -------------
 
-Additionally, to find all the SQL operations, you can watch the database logs. By default PostgreSQL does not keep these logs, so you'll need to make the configuration changes below.
+Currently PostgREST doesn't log the SQL commands executed against the underlying database.
+
+To find the SQL operations, you can watch the database logs. By default PostgreSQL does not keep these logs, so you'll need to make the configuration changes below.
 
 Find :code:`postgresql.conf` inside your PostgreSQL data directory (to find that, issue the command :code:`show data_directory;`). Either find the settings scattered throughout the file and change them to the following values, or append this block of code to the end of the configuration file.
 
@@ -126,11 +96,6 @@ The ``metrics`` endpoint on the :ref:`admin_server` endpoint provides metrics in
 
   curl "http://localhost:3001/metrics"
 
-.. code-block:: http
-
-  HTTP/1.1 200 OK
-  Content-Type: text/plain; charset=utf-8
-
   # HELP pgrst_schema_cache_query_time_seconds The query time in seconds of the last schema cache load
   # TYPE pgrst_schema_cache_query_time_seconds gauge
   pgrst_schema_cache_query_time_seconds 1.5937927e-2
@@ -204,40 +169,6 @@ pgrst_db_pool_max
 
 Max pool connections.
 
-.. _jwt_cache_metrics:
-
-JWT Cache Metrics
------------------
-
-Metrics related to the :ref:`jwt_caching`.
-
-pgrst_jwt_cache_requests_total
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-======== =======
-**Type** Counter
-======== =======
-
-The total number of JWT cache lookups.
-
-pgrst_jwt_cache_hits_total
-~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-======== =======
-**Type** Counter
-======== =======
-
-The total number of JWT cache hits.
-
-pgrst_jwt_cache_evictions_total
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-======== =======
-**Type** Counter
-======== =======
-
-The total number of JWT cache evictions.
-
 Traces
 ======
 
@@ -273,11 +204,6 @@ You can enable tracing HTTP requests by setting :ref:`server-trace-header`. Spec
   HTTP/1.1 200 OK
   X-Request-Id: 123
 
-Proxy-Status Header
--------------------
-
-See :ref:`proxy-status_header`.
-
 .. _server-timing_header:
 
 Server-Timing Header
@@ -297,7 +223,7 @@ This header communicates metrics of the different phases in the request-response
   Server-Timing: jwt;dur=14.9, parse;dur=71.1, plan;dur=109.0, transaction;dur=353.2, response;dur=4.4
 
 - All the durations (``dur``) are in milliseconds.
-- The ``jwt`` stage is when :ref:`jwt_auth` is done. This duration can be lowered with :ref:`jwt_caching`.
+- The ``jwt`` stage is when :ref:`jwt_impersonation` is done. This duration can be lowered with :ref:`jwt_caching`.
 - On the ``parse`` stage, the :ref:`url_grammar` is parsed.
 - On the ``plan`` stage, the :ref:`schema_cache` is used to generate the :ref:`main_query` of the transaction.
 - The ``transaction`` stage corresponds to the database transaction. See :ref:`transactions`.
@@ -307,27 +233,6 @@ This header communicates metrics of the different phases in the request-response
 
   We're working on lowering the duration of the ``parse`` and ``plan`` stages on https://github.com/PostgREST/postgrest/issues/2816.
 
-.. _content-length_header:
-
-Content-Length Header
----------------------
-
-You can verify the response body size in bytes in the `Content-Length header <https://httpwg.org/specs/rfc9110.html#field.content-length>`_.
-
-.. code-block:: bash
-
-  curl -i 'localhost:3000/users'
-
-.. code-block:: http
-
-  HTTP/1.1 200 OK
-  Content-Length: 104
-
-Note that this header won't be returned on ``HEAD`` requests for optimization purposes (see :ref:`head_req`).
-This is in line with `RFC 9110 <https://httpwg.org/specs/rfc9110.html#field.content-length>`_.
-
-The body size is also present in the :ref:`PostgREST logs <pgrst_logging>`.
-
 .. _explain_plan:
 
 Execution plan

docs/references/schema_cache.rst

@@ -53,19 +53,6 @@ To reload the schema cache from within the database, you can use the ``NOTIFY``
 
   NOTIFY pgrst, 'reload schema'
 
-Debouncing
-~~~~~~~~~~
-
-PostgREST does not reload the schema cache for each notification when several ``NOTIFY pgrst`` events are generated quickly after one another.
-
-There are two cases to consider: when notifications are sent within a single transaction and when they are sent across multiple transactions.
-
-In the first case, PostgreSQL deduplicates identical ``NOTIFY`` events within the same transaction. This means that even if multiple ``NOTIFY pgrst`` statements are executed before a ``COMMIT``, only a single notification is delivered to PostgREST.
-
-In the second case, when notifications are sent from separate transactions in a short time span, PostgREST applies a debouncing mechanism to avoid excessive schema cache reloads.
-
-Instead of reloading the schema cache for each notification, events are grouped within a small time window of 100 milliseconds. The reload function is executed once immediately when the first notification is received and once more after the burst of events settles, resulting in at most two executions within that time window.
-
 .. _auto_schema_reloading:
 
 Automatic Schema Cache Reloading

docs/references/transactions.rst

@@ -284,10 +284,11 @@ However, starting from PostgreSQL 15, you can grant privileges for these setting
 
   GRANT SET ON PARAMETER <setting> TO <authenticator>;
 
-Hoisted Function Settings
-~~~~~~~~~~~~~~~~~~~~~~~~~
+Function Settings
+~~~~~~~~~~~~~~~~~
 
-PostgREST can "hoist" function settings to transaction-scoped settings. This allows functions settings to override the impersonated and connection role settings.
+In addition to :ref:`impersonated_settings`, PostgREST will also apply function settings as transaction-scoped settings. This allows functions settings to override
+the impersonated and connection role settings.
 
 .. code-block:: postgres
 
@@ -302,7 +303,7 @@ When calling the above function (see :ref:`functions`), the statement timeout wi
 
 .. note::
 
-   Only the settings in :ref:`db-hoisted-tx-settings` will be hoisted.
+   Only the transactions that are hoisted by config :ref:`db-hoisted-tx-settings` will be applied.
 
 .. _main_query:
 

docs/requirements.txt

@@ -1,7 +1,9 @@
-# This file is auto-generated by postgrest-nixpkgs-upgrade
-sphinx==8.2.3
-sphinx-copybutton==0.5.2
-sphinx-rtd-dark-mode==1.3.0
-sphinx-rtd-theme==3.0.2
-sphinx-tabs==3.4.7
-sphinxext-opengraph==0.9.1
+docutils==0.20.1
+sphinx-copybutton
+sphinx-intl
+sphinx-rtd-theme>=0.5.1
+sphinx-rtd-dark-mode>=1.3.0
+sphinx-tabs>=3.2.0
+sphinx>=5.0.2
+sphinxext-opengraph==0.9.1
+urllib3==2.2.3

docs/shared/installation.rst

@@ -28,7 +28,7 @@
 
           pacman -S postgrest
 
-      .. tab:: Nix via nixpkgs
+      .. tab:: Nix
 
         You can install PostgREST from nixpkgs.
 
@@ -36,17 +36,6 @@
 
           nix-env -i postgrest
 
-      .. tab:: Nix via flake
-
-        You can install PostgREST via flake.
-
-        .. code:: nix
-
-          {
-            inputs.postgrest.url = "github:postgrest/postgrest";
-            # ...
-          }
-
   .. group-tab:: Windows
 
     You can install PostgREST using `Chocolatey <https://community.chocolatey.org/packages/postgrest>`_ or `Scoop <https://github.com/ScoopInstaller/Scoop>`_.

docs/tutorials/tut0.rst

@@ -213,8 +213,12 @@ You should see something similar to:
 .. code-block:: text
 
   Starting PostgREST 12.0.2...
-  Successfully connected to PostgreSQL 14.10 (Ubuntu 14.10-0ubuntu0.22.04.1) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, 64-bit
-  API server listening on port 3000
+  Attempting to connect to the database...
+  Connection successful
+  Listening on port 3000
+  Config reloaded
+  Listening for notifications on the pgrst channel
+  Schema cache loaded
 
 It's now ready to serve web requests. There are many nice graphical API exploration tools you can use, but for this tutorial we'll use :code:`curl` because it's likely to be installed on your system already. Open a new terminal (leaving the one open that PostgREST is running inside). Try doing an HTTP request for the todos.
 

docs/tutorials/tut1.rst

@@ -52,31 +52,17 @@ Check that the :code:`tutorial.conf` (created in the previous tutorial) has the
 
 If the PostgREST server is still running from the previous tutorial, restart it to load the updated configuration file.
 
-.. _tut1_step3:
-
 Step 3. Sign a Token
 --------------------
 
-Ordinarily your own code in the database or in another server will create and sign authentication tokens, but for this tutorial we will make one "by hand" using ``bash`` and ``openssl``.
+Ordinarily your own code in the database or in another server will create and sign authentication tokens, but for this tutorial we will make one "by hand." Go to `jwt.io <https://jwt.io/#debugger-io>`_ and fill in the fields like this:
 
-.. code:: bash
+.. figure:: ../_static/tuts/tut1-jwt-io.png
+   :alt: jwt.io interface
 
-  #!/bin/bash
-  set -e
+   How to create a token at https://jwt.io
 
-  JWT_SECRET='test_secret_that_is_at_least_32_characters_long'
-
-  _base64 () { openssl base64 -e -A | tr '+/' '-_' | tr -d '='; }
-
-  header=$(echo -n '{"alg":"HS256","typ":"JWT"}' | _base64)
-
-  payload=$(echo -n "{\"role\":\"todo_user\"}" | _base64)
-
-  signature=$(echo -n "$header.$payload" | openssl dgst -sha256 -hmac "$JWT_SECRET" -binary | _base64)
-
-  echo -n "$header.$payload.$signature"
-
-**Remember to fill in the secret you generated rather than keeping the "test_secret_that_is_at_least_32_characters_long".** After you have filled in the secret and payload, the encoded data on the left will update. Copy the encoded token.
+**Remember to fill in the secret you generated rather than the word "secret".** After you have filled in the secret and payload, the encoded data on the left will update. Copy the encoded token.
 
 .. note::
 
@@ -159,22 +145,14 @@ To observe expiration in action, we'll add an :code:`exp` claim of five minutes
 
   select extract(epoch from now() + '5 minutes'::interval) :: integer;
 
-Or in ``bash``:
+Go back to jwt.io and change the payload to
 
+.. code-block:: json
 
-.. code-block:: bash
-
-  exp=$(( EPOCHSECONDS + 5*60 ))  # five minutes
-
-  echo $exp
-
-Go back to :ref:`tut1_step3` and change the payload to
-
-.. code-block:: bash
-
-  payload=$(echo -n "{\"role\":\"todo_user\",\"exp\":\"123456789\"}" | _base64)
-
-  echo -n "$header.$payload.$signature"
+  {
+    "role": "todo_user",
+    "exp": 123456789
+  }
 
 **NOTE**: Don't forget to change the dummy epoch value :code:`123456789` in the snippet above to the epoch value returned by the :code:`psql` command.
 

flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1752006229,
-        "narHash": "sha256-BeuAPwNM2RBc5bvUTb0j4GRs2yBkDeRCw/8Y3v9Xesc=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "c80edd02003fe3d8af527215a3ac069be9cfd47f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixpkgs-25.05-darwin",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,50 +0,0 @@
-{
-  description = "REST API for any Postgres database";
-
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-25.05-darwin";
-  };
-
-  nixConfig = {
-    extra-substituters = "https://postgrest.cachix.org";
-    extra-trusted-public-keys = "postgrest.cachix.org-1:icgW4R15fz1+LqvhPjt4EnX/r19AaqxiVV+1olwlZtI=";
-  };
-
-  outputs = { nixpkgs, ... }:
-    let
-      systems = [
-        "aarch64-darwin"
-        "aarch64-linux"
-        "x86_64-darwin"
-        "x86_64-linux"
-      ];
-
-      pgrstFor = system: import ./default.nix {
-        inherit system;
-        nixpkgsVersion = {
-          owner = "nixos";
-          repo = "nixpkgs";
-          inherit (nixpkgs) rev;
-          tarballHash = nixpkgs.narHash;
-        };
-      };
-
-      genSystems = f: nixpkgs.lib.genAttrs systems (system: f (pgrstFor system));
-    in
-    {
-      packages = genSystems (attrs: {
-        default = attrs.postgrestPackage.bin;
-        profiled = attrs.postgrestProfiled.bin;
-      } // nixpkgs.lib.optionalAttrs (attrs ? postgrestStatic) {
-        static = attrs.postgrestStatic;
-      });
-
-      apps = genSystems (attrs: {
-        default = {
-          type = "app";
-          program = "${attrs.postgrestStatic or attrs.postgrestPackage.bin}/bin/postgrest";
-          meta.description = "REST API for any Postgres database";
-        };
-      });
-    };
-}

nix/README.md

@@ -72,53 +72,45 @@ The PostgREST utilities available in `nix-shell` all have names that begin with
 ```bash
 # Note: The utilities listed here might not be up to date.
 [nix-shell]$ postgrest-<tab>
-postgrest-build                   postgrest-parallel-curl
-postgrest-check                   postgrest-profiled-run
-postgrest-clean                   postgrest-push-cachix
-postgrest-commitlint              postgrest-release
-postgrest-coverage                postgrest-repl
-postgrest-coverage-draft-overlay  postgrest-run
-postgrest-docs-build              postgrest-style
-postgrest-docs-check              postgrest-style-check
-postgrest-docs-dictcheck          postgrest-test-big-schema
-postgrest-docs-linkcheck          postgrest-test-doctests
-postgrest-docs-render             postgrest-test-io
-postgrest-docs-serve              postgrest-test-memory
-postgrest-docs-spellcheck         postgrest-test-replica
-postgrest-dump-minimal-imports    postgrest-test-spec
-postgrest-dump-schema             postgrest-test-spec-idempotence
-postgrest-gen-ctags               postgrest-watch
-postgrest-gen-jwt                 postgrest-with-all
-postgrest-gen-secret              postgrest-with-git
-postgrest-git-hooks               postgrest-with-pgrst
-postgrest-hsie-graph-modules      postgrest-with-pg-13
-postgrest-hsie-graph-symbols      postgrest-with-pg-14
-postgrest-hsie-minimal-imports    postgrest-with-pg-15
-postgrest-lint                    postgrest-with-pg-16
-postgrest-loadtest                postgrest-with-pg-17
-postgrest-loadtest-against        postgrest-with-slow-pg
-postgrest-loadtest-report         postgrest-with-slow-postgrest
-postgrest-nixpkgs-upgrade
+postgrest-build                   postgrest-test-spec
+postgrest-check                   postgrest-watch
+postgrest-clean                   postgrest-with-all
+postgrest-coverage                postgrest-with-postgresql-10
+postgrest-lint                    postgrest-with-postgresql-11
+postgrest-run                     postgrest-with-postgresql-12
+postgrest-style                   postgrest-with-postgresql-13
+postgrest-style-check             postgrest-with-postgresql-9.6
+postgrest-test-io
 ...
 
 [nix-shell]$
 
 ```
 
-The `docker` module has large dependencies to be build before the shell becomes
+Some additional modules like `memory`, `docker` and `release`
+have large dependencies that would need to be built before the shell becomes
 available, which could take an especially long time if the cachix binary cache
-is not used. You can activate it by passing a flag to `nix-shell` with
-`nix-shell --arg docker true`. This will make the respective utilities available:
+is not used. You can activate those by passing a flag to `nix-shell` with
+`nix-shell --arg <module> true`. This will make the respective utilities available:
 
 ```bash
-$ nix-shell --arg docker true
-[nix-shell]$ postgrest-docker-<tab>
-postgrest-docker-load
+$ nix-shell --arg memory true
+[nix-shell]$ postgrest-<tab>
+postgrest-build                   postgrest-test-spec
+postgrest-check                   postgrest-watch
+postgrest-clean                   postgrest-with-all
+postgrest-coverage                postgrest-with-postgresql-10
+postgrest-lint                    postgrest-with-postgresql-11
+postgrest-run                     postgrest-with-postgresql-12
+postgrest-style                   postgrest-with-postgresql-13
+postgrest-style-check             postgrest-with-postgresql-9.6
+postgrest-test-io
+postgrest-test-memory
 ...
 
 ```
 
-Note that `postgrest-docker-load` is now also available.
+Note that `postgrest-test-memory` is now also available.
 
 To run one-off commands, you can also use `nix-shell --run <command>`, which
 will launch the Nix shell, run that one command and exit. Note that the tab
@@ -174,7 +166,7 @@ $ nix-shell --run "postgrest-with-all postgrest-test-spec"
 
 # Run the tests against a specific version of PostgreSQL (use tab-completion in
 # nix-shell to see all available versions):
-$ nix-shell --run "postgrest-with-pg-13 postgrest-test-spec"
+$ nix-shell --run "postgrest-with-postgresql-13 postgrest-test-spec"
 
 ```
 
@@ -284,7 +276,7 @@ Tools like `postgrest-build`, `postgrest-run`, `postgrest-repl` etc. are simple
 also run in CI, with the exception of the IO and Memory checks that need to be run
 separately.
 
-`postgrest-with-pg-*` take a command as an argument and will run it
+`postgrest-with-postgresql-*` take a command as an argument and will run it
 with a temporary database. `postgrest-with-all` will run the command against
 all supported PostgreSQL versions. Tests run without `postgrest-with-*` are
 run against the latest PostgreSQL version by default.
@@ -379,8 +371,10 @@ that).
 
 We also use `default.nix` to load our pinned version of the `nixpkgs`
 repository. This set of packages will always be the same, independently from
-where or when you use it. The pinned version is taken from `flake.lock` and
-can be updated with `postgrest-nixpkgs-upgrade`.
+where or when you use it. The pinned version can be upgraded with the small
+`nixpkgs-upgrade` utility. Running `nixpkgs-upgrade > nix/nixpkgs-version.nix`
+in `nix-shell` will upgrade the pinned version to the latest `nixpkgs-unstable`
+version.
 
 ### `shell.nix`
 

nix/docs-extensions/sphinx-rtd-dark-mode.nix

@@ -0,0 +1,46 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, nose
+, sphinx
+, sphinx-rtd-theme
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-rtd-dark-mode";
+  version = "1.3.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "MrDogeBro";
+    repo = "sphinx_rtd_dark_mode";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-N5KG2Wqn9wfGNY3VH4FnBce1aZUbnvVmwD10Loe0Qn4=";
+  };
+
+  propagatedBuildInputs = [
+    sphinx-rtd-theme
+  ];
+
+  nativeCheckInputs = [
+    nose
+    sphinx
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    nosetests tests
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "sphinx_rtd_dark_mode"
+  ];
+
+  meta = with lib; {
+    description = "Adds a toggleable dark mode to the Read the Docs theme for Sphinx.";
+    homepage = "https://github.com/MrDogeBro/sphinx_rtd_dark_mode";
+    changelog = "https://github.com/MrDogeBro/sphinx_rtd_dark_mode/releases/tag/v${version}";
+    license = licenses.mit;
+  };
+}

nix/libpq.nix

@@ -0,0 +1,57 @@
+# Creating a separate libpq package is is discussed in
+# https://github.com/NixOS/nixpkgs/issues/61580, but nixpkgs has not moved
+# forward, yet.
+# This package is passed to postgresql-libpq (haskell) which needs to be
+# cross-compiled to the static build and possibly other architectures as
+# as well. To reduce the number of dependencies that need to be built with
+# it, this derivation focuses on building the client libraries only. No
+# server, no tests.
+{ stdenv
+, lib
+, openssl
+, zlib
+, postgresql
+, pkg-config
+, tzdata
+}:
+
+stdenv.mkDerivation {
+  pname = "libpq";
+  inherit (postgresql) src version patches;
+
+  configureFlags = [
+    "--without-gssapi"
+    "--without-icu"
+    "--without-readline"
+    "--with-openssl"
+    "--with-system-tzdata=${tzdata}/share/zoneinfo"
+    "--sysconfdir=/etc/postgresql"
+  ];
+
+  nativeBuildInputs = [ pkg-config tzdata ];
+  buildInputs = [ openssl zlib ];
+
+  buildFlags = [ "submake-libpq" "submake-libpgport" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    make -C src/bin/pg_config install
+    make -C src/common install
+    make -C src/include install
+    make -C src/interfaces/libpq install
+    make -C src/port install
+
+    rm -rfv $out/share
+
+    runHook postInstall
+  '';
+
+  outputs = [ "out" ];
+
+  meta = with lib; {
+    homepage = "https://www.postgresql.org";
+    description = "Client API library for PostgreSQL";
+    license = licenses.postgresql;
+  };
+}

nix/nixpkgs-version.nix

@@ -0,0 +1,8 @@
+# Pinned version of Nixpkgs, generated with postgrest-nixpkgs-upgrade.
+{
+  owner = "NixOS";
+  repo = "nixpkgs";
+  date = "2024-05-29";
+  rev = "a15e8d1b3d9e6496c4a3214e2104f6d28dfa7df7";
+  tarballHash = "sha256:0r4a4165f4n1zlpnyjrdrwrg86n1b6g3axsdh3j5iizpmjrlxmd7";
+}

nix/overlays/checked-shell-script/checked-shell-script.nix

@@ -6,7 +6,6 @@
 , coreutils
 , git
 , lib
-, moreutils
 , runCommand
 , shellcheck
 , stdenv
@@ -57,7 +56,7 @@ let
         # Example: This way `postgrest-watch -h` will return the help output for watch, while
         # `postgrest-watch postgrest-test-spec -h` will return the help output for test-spec.
         # Taken from: https://github.com/matejak/argbash/issues/114#issuecomment-557108274
-        sed '/_positionals_count + 1/a\\t\t\t\tset -- "''${@:1:1}" "--" "''${@:2}"' $out | ${moreutils}/bin/sponge $out
+        sed '/_positionals_count + 1/a\\t\t\t\tset -- "''${@:1:1}" "--" "''${@:2}"' -i $out
       '';
 
   bash-completion =
@@ -67,7 +66,7 @@ let
       ''
 
       + lib.optionalString (positionalCompletion != "") ''
-        sed 's#COMPREPLY.*compgen -o bashdefault .*$#${escape positionalCompletion}#' $out | ${moreutils}/bin/sponge $out
+        sed 's#COMPREPLY.*compgen -o bashdefault .*$#${escape positionalCompletion}#' -i $out
       ''
     );
 
@@ -104,7 +103,8 @@ let
         ''
 
         + lib.optionalString withTmpDir ''
-          tmpdir="$(${coreutils}/bin/mktemp -d --tmpdir ${name}-XXX)"
+          mkdir -p "''${TMPDIR:-/tmp}/postgrest"
+          tmpdir="$(${coreutils}/bin/mktemp -d --tmpdir postgrest/${name}-XXX)"
 
           # we keep the tmpdir when an error occurs for debugging
           trap 'echo Temporary directory kept at: $tmpdir' ERR

nix/overlays/default.nix

@@ -3,5 +3,9 @@
   checked-shell-script = import ./checked-shell-script;
   gitignore = import ./gitignore.nix;
   haskell-packages = import ./haskell-packages.nix;
+  postgis = import ./postgis.nix;
+  postgresql-libpq = import ./postgresql-libpq.nix;
+  postgresql-legacy = import ./postgresql-legacy.nix;
+  postgresql-future = import ./postgresql-future.nix;
   slocat = import ./slocat.nix;
 }

nix/overlays/haskell-packages.nix

@@ -48,36 +48,38 @@ let
 
       # Before upgrading fuzzyset to 0.3, check: https://github.com/PostgREST/postgrest/issues/3329
       # jailbreak, because hspec limit for tests
-      fuzzyset = prev.fuzzyset_0_2_4;
-
-      # TODO: Remove once available in nixpkgs haskellPackages
-      configurator-pg =
-        prev.callHackageDirect
+      fuzzyset = lib.doJailbreak
+        (prev.callHackageDirect
           {
-            pkg = "configurator-pg";
-            ver = "0.2.11";
-            sha256 = "sha256-mtGtNawDJgz2ZIEVca+IYXVu4oNw9xsfJiYWAqAbbgc=";
+            pkg = "fuzzyset";
+            ver = "0.2.4";
+            sha256 = "sha256-lpkrTFcR0B4rT/P6x7ui31Twgq7BBj6KIvjKyqXKdpc=";
           }
-          { };
+          { });
 
-      # TODO: Remove once available in nixpkgs haskellPackages
-      streaming-commons =
-        prev.callHackageDirect
-          {
-            pkg = "streaming-commons";
-            ver = "0.2.3.1";
-            sha256 = "sha256-Gl2eaJcWe1sxmcE/octWlH9uSnERguf+5H66K4fV87s=";
-          }
-          { };
+      hasql-pool = lib.dontCheck (prev.callHackageDirect
+        {
+          pkg = "hasql-pool";
+          ver = "1.0.1";
+          sha256 = "sha256-Hf1f7lX0LWkjrb25SDBovCYPRdmUP1H6pAxzi7kT4Gg=";
+        }
+        { }
+      );
+
+      postgresql-libpq = lib.dontCheck
+        (prev.postgresql-libpq.override {
+          postgresql = super.libpq;
+        });
+
+      hasql-notifications = lib.dontCheck (prev.callHackageDirect
+        {
+          pkg = "hasql-notifications";
+          ver = "0.2.2.2";
+          sha256 = "sha256-myKwlug7OgTa/qP6mHfCD+5Q8IhM17JvpJBfSo+M01k=";
+        }
+        { }
+      );
 
-      # Downgrade hasql and related packages while we are still on GHC 9.4 for the static build.
-      hasql = lib.dontCheck (lib.doJailbreak prev.hasql_1_6_4_4);
-      hasql-dynamic-statements = lib.dontCheck prev.hasql-dynamic-statements_0_3_1_5;
-      hasql-implicits = lib.dontCheck prev.hasql-implicits_0_1_1_3;
-      hasql-notifications = lib.dontCheck prev.hasql-notifications_0_2_2_2;
-      hasql-pool = lib.dontCheck prev.hasql-pool_1_0_1;
-      hasql-transaction = lib.dontCheck prev.hasql-transaction_1_1_0_1;
-      postgresql-binary = lib.dontCheck (lib.doJailbreak prev.postgresql-binary_0_13_1_3);
     };
 in
 {

nix/overlays/postgis.nix

@@ -0,0 +1,28 @@
+final: prev:
+let
+  postgis_3_2_3 = rec {
+    version = "3.2.3";
+    src = final.fetchurl {
+      url = "https://download.osgeo.org/postgis/source/postgis-${version}.tar.gz";
+      sha256 = "sha256-G02LXHVuWrpZ77wYM7Iu/k1lYneO7KVvpJf+susTZow=";
+    };
+    meta.broken = false;
+  };
+in
+{
+  postgresql_11 = prev.postgresql_11.override { this = final.postgresql_11; } // {
+    pkgs = prev.postgresql_11.pkgs // {
+      postgis = prev.postgresql_11.pkgs.postgis.overrideAttrs (_: postgis_3_2_3);
+    };
+  };
+  postgresql_10 = prev.postgresql_10.override { this = final.postgresql_11; } // {
+    pkgs = prev.postgresql_10.pkgs // {
+      postgis = prev.postgresql_10.pkgs.postgis.overrideAttrs (_: postgis_3_2_3);
+    };
+  };
+  postgresql_9_6 = prev.postgresql_9_6.override { this = final.postgresql_11; } // {
+    pkgs = prev.postgresql_9_6.pkgs // {
+      postgis = prev.postgresql_9_6.pkgs.postgis.overrideAttrs (_: postgis_3_2_3);
+    };
+  };
+}

nix/overlays/postgresql-future.nix

@@ -0,0 +1,19 @@
+_: _:
+# Overlay that adds future versions of PostgreSQL that are supported by
+# PostgREST.
+{
+  ## Example for including a postgresql version from a specific nixpks commit:
+  ##
+  #  postgresql_16 =
+  #    let
+  #      rev = "5148520bfab61f99fd25fb9ff7bfbb50dad3c9db";
+  #      tarballHash = "1dfjmz65h8z4lk845724vypzmf3dbgsdndjpj8ydlhx6c7rpcq3p";
+  #
+  #      pinnedPkgs =
+  #        builtins.fetchTarball {
+  #          url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
+  #          sha256 = tarballHash;
+  #        };
+  #    in
+  #    (import pinnedPkgs { }).pkgs.postgresql_16;
+}

nix/overlays/postgresql-legacy.nix

@@ -0,0 +1,49 @@
+_: _:
+# Overlay that adds legacy versions of PostgreSQL that are supported by
+# PostgREST.
+{
+  # PostgreSQL 9.6 was removed from Nixpkgs with
+  # https://github.com/NixOS/nixpkgs/commit/757dd008b2f2926fc0f7688fa8189f930ea47521
+  # We pin its parent commit to get the last version that was available.
+  postgresql_9_6 =
+    let
+      rev = "571cbf3d1db477058303cef8754fb85a14e90eb7";
+      tarballHash = "0q74wn418i1bn5sssacmw8ykpmqvzr0s93sj6pbs3rf6bf134fkz";
+      pinnedPkgs =
+        builtins.fetchTarball {
+          url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
+          sha256 = tarballHash;
+        };
+    in
+    (import pinnedPkgs { }).pkgs.postgresql_9_6;
+
+  # PostgreSQL 10 was removed from Nixpkgs with
+  # https://github.com/NixOS/nixpkgs/commit/aa1483114bb329fee7e1266100b8d8921ed4723f
+  # We pin its parent commit to get the last version that was available.
+  postgresql_10 =
+    let
+      rev = "79661ba7e2fb96ebefbb537458a5bbae9dc5bd1a";
+      tarballHash = "0rn796pfn4sg90ai9fdnwmr10a2s835p1arazzgz46h6s5cxvq97";
+      pinnedPkgs =
+        builtins.fetchTarball {
+          url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
+          sha256 = tarballHash;
+        };
+    in
+    (import pinnedPkgs { }).pkgs.postgresql_10;
+
+  # PostgreSQL 11 was removed from Nixpkgs with
+  # https://github.com/NixOS/nixpkgs/commit/1220a4d4dd1a4590780a5e1c18d1333a121be366
+  # We pin its parent commit to get the last version that was available.
+  postgresql_11 =
+    let
+      rev = "f5458516e42cc5cb4123cc2d93f45c240548aa18";
+      tarballHash = "1h03621sxfhw4z6ya74k6c2lyx3z7pvf2jcg4vs7i01yz2m6w3cv";
+      pinnedPkgs =
+        builtins.fetchTarball {
+          url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
+          sha256 = tarballHash;
+        };
+    in
+    (import pinnedPkgs { }).pkgs.postgresql_11;
+}

nix/overlays/postgresql-libpq.nix

@@ -0,0 +1,6 @@
+_: super:
+{
+  libpq = super.callPackage ../libpq.nix {
+    postgresql = super.postgresql_16;
+  };
+}

nix/static.nix

@@ -4,29 +4,66 @@
 , src
 }:
 let
-  # This builds a static PostgREST executable based on pkgsStatic.
-  inherit (pkgs) pkgsStatic;
+  # This builds a static PostgREST exectuable based on pkgsStatic.
+  # pkgsStatic is based on musl, so is a kind of cross-compilation.
+  # We still make this explicit here via pkgsCross, because we need
+  # to get postgresql/libpq for musl, too.
+  pkgsCross = pkgs.pkgsCross.musl64;
+  inherit (pkgsCross) pkgsStatic;
   inherit (pkgsStatic.haskell) lib;
 
-  packagesStatic = pkgsStatic.haskell.packages.native-bignum."${compiler}";
+  packagesStatic =
+    pkgsStatic.haskell.packages."${compiler}".override (old: {
+      ghc = pkgsStatic.pkgsBuildHost.haskell.compiler."${compiler}".override {
+        # Using the bundled libffi generally works better for cross-compiling
+        libffi = null;
+        # Building sphinx fails on some platforms
+        enableDocs = false;
+        # Cross compiling with native bignum works better than with gmp
+        enableNativeBignum = true;
+      };
+
+      overrides = pkgs.lib.composeExtensions old.overrides (_: prev: {
+        postgresql-libpq = (lib.overrideCabal prev.postgresql-libpq {
+          # postgresql doesn't build in the fully static overlay - but the default
+          # derivation is built with static libraries anyway.
+          libraryPkgconfigDepends = [ pkgsCross.libpq ];
+        }).overrideAttrs (_: prevAttrs: {
+          buildInputs = prevAttrs.buildInputs ++ [ pkgsStatic.openssl ];
+        });
+      });
+    });
 
   makeExecutableStatic = drv: pkgs.lib.pipe drv [
     lib.compose.justStaticExecutables
 
     # To successfully compile a redistributable, fully static executable we need to:
-    # 1. avoid any references to /nix/store to prevent blowing up the closure size.
-    (drv: drv.overrideAttrs {
-      allowedReferences = [
-        pkgsStatic.openssl.etc
-      ];
-    })
+    # 1. make executable really statically linked.
+    # 2. avoid any references to /nix/store to prevent blowing up the closure size.
+    # 3. be able to run the executable.
+    # When checking for references, we ignore the following:
+    # - eeee... are removed references which don't actually exist
+    # - openssl-etc references are purposely designed to be very small
+    (lib.compose.overrideCabal (drv: {
+      postFixup = drv.postFixup + ''
+        exe="$out/bin/postgrest"
 
-    # 2. be able to run the executable.
-    (drv: drv.overrideAttrs {
-      passthru.tests.version = pkgsStatic.testers.testVersion {
-        package = drv;
-      };
-    })
+        if ! (file "$exe" | grep 'statically linked') then
+          echo "not a static executable, ldd output:"
+          ldd "$exe"
+          exit 1
+        fi
+
+        echo "Checking for references to /nix/store..."
+        (${pkgsStatic.binutils}/bin/strings "$exe" \
+          | grep -v /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee \
+          | grep -v -etc/etc/ssl \
+          | grep /nix/store || exit 0 && exit 1)
+        echo "No references to /nix/store found"
+
+        "$exe" --help
+      '';
+    }))
   ];
 
 in

nix/tools/cabalTools.nix

@@ -33,17 +33,6 @@ let
         exec ${cabal-install}/bin/cabal v2-clean
       '';
 
-  update =
-    checkedShellScript
-      {
-        name = "postgrest-cabal-update";
-        docs = "Update cabal's package list from hackage.haskell.org";
-        workingDir = "/";
-      }
-      ''
-        exec ${cabal-install}/bin/cabal v2-update
-      '';
-
   run =
     checkedShellScript
       {
@@ -55,7 +44,6 @@ let
             "ARG_USE_ENV([PGRST_DB_POOL], [1], [PostgREST pool size])"
             "ARG_USE_ENV([PGRST_DB_POOL_ACQUISITION_TIMEOUT], [1], [PostgREST pool timeout])"
             "ARG_USE_ENV([PGRST_JWT_SECRET], [reallyreallyreallyreallyverysafe], [PostgREST JWT secret])"
-            "ARG_USE_ENV([PGRST_ADMIN_SERVER_PORT], [3001], [PostgREST admin server port])"
             "ARG_LEFTOVERS([PostgREST arguments])"
           ];
         workingDir = "/";
@@ -66,39 +54,11 @@ let
         export PGRST_DB_POOL
         export PGRST_DB_POOL_ACQUISITION_TIMEOUT
         export PGRST_JWT_SECRET
-        export PGRST_ADMIN_SERVER_PORT
 
         exec ${cabal-install}/bin/cabal v2-run ${devCabalOptions} --verbose=0 -- \
           postgrest "''${_arg_leftovers[@]}"
       '';
 
-
-  runProfiled =
-    checkedShellScript
-      {
-        name = "postgrest-profiled-run";
-        docs = "Run a profiled build of postgREST. This will generate a postgrest.prof file that can be used to do optimization.";
-        args =
-          [
-            "ARG_USE_ENV([PGRST_DB_ANON_ROLE], [postgrest_test_anonymous], [PostgREST anonymous role])"
-            "ARG_USE_ENV([PGRST_DB_POOL], [1], [PostgREST pool size])"
-            "ARG_USE_ENV([PGRST_DB_POOL_ACQUISITION_TIMEOUT], [1], [PostgREST pool timeout])"
-            "ARG_USE_ENV([PGRST_JWT_SECRET], [reallyreallyreallyreallyverysafe], [PostgREST JWT secret])"
-            "ARG_LEFTOVERS([PostgREST arguments])"
-          ];
-        workingDir = "/";
-        withEnv = postgrest.env;
-      }
-      ''
-        export PGRST_DB_ANON_ROLE
-        export PGRST_DB_POOL
-        export PGRST_DB_POOL_ACQUISITION_TIMEOUT
-        export PGRST_JWT_SECRET
-
-        exec ${cabal-install}/bin/cabal --builddir="dist-prof" v2-run --enable-profiling --disable-shared exe:postgrest -- \
-          +RTS -p -h -RTS "''${_arg_leftovers[@]}"
-      '';
-
   repl =
     checkedShellScript
       {
@@ -119,9 +79,7 @@ buildToolbox
     inherit
       build
       clean
-      update
       run
-      runProfiled
       repl;
   };
 }

nix/tools/devTools.nix

@@ -10,7 +10,6 @@
 , hsie
 , nix
 , silver-searcher
-, stdenv
 , style
 , tests
 , withTools
@@ -54,14 +53,10 @@ let
 
           Requires authentication with `cachix authtoken ...`.
         '';
-        args =
-          [
-            "ARG_OPTIONAL_SINGLE([system], , [System], [${stdenv.system}])"
-          ];
         workingDir = "/";
       }
       ''
-        ${nix}/bin/nix-instantiate --argstr system "$_arg_system" \
+        ${nix}/bin/nix-instantiate \
           | xargs ${nix}/bin/nix-store -qR --include-outputs \
           | ${cachix}/bin/cachix push postgrest
       '';
@@ -82,7 +77,6 @@ let
       }
       ''
         ${tests}/bin/postgrest-test-spec
-        ${tests}/bin/postgrest-test-observability
         ${tests}/bin/postgrest-test-doctests
         ${tests}/bin/postgrest-test-io
         ${tests}/bin/postgrest-test-big-schema
@@ -339,29 +333,20 @@ let
     checkedShellScript
       {
         name = "postgrest-gen-jwt";
-        docs = ''
-          Generate a JWT. Example: postgrest-gen-jwt --exp 10 postgrest_test_author
-
-          # This can be used to quickly prove a JWT expiry
-          $ curl localhost:3000/authors_only -H "Authorization: Bearer \$(postgrest-gen-jwt --exp -31 postgrest_test_author)"
-        '';
+        docs = "Generate a JWT";
         args = [
           "ARG_POSITIONAL_SINGLE([role], [role for the jwt payload])"
           "ARG_OPTIONAL_SINGLE([secret],, [secret used to sign the JWT], [reallyreallyreallyreallyverysafe])"
-          "ARG_OPTIONAL_SINGLE([exp],, [seconds for JWT expiry, it accepts negative values], [3600])"
         ];
       }
       ''
-        # Based on https://stackoverflow.com/questions/59002949/how-to-create-a-json-web-token-jwt-using-openssl-shell-commands
+        # From https://stackoverflow.com/questions/59002949/how-to-create-a-json-web-token-jwt-using-openssl-shell-commands
 
         # Construct the header
         jwt_header=$(echo -n '{"alg":"HS256","typ":"JWT"}' | base64 | sed s/\+/-/g | sed 's/\//_/g' | sed -E s/=+$//)
 
-        # Construct the exp value
-        expiry=$((EPOCHSECONDS + _arg_exp))
-
         # Construct the payload
-        payload=$(echo -n "{\"role\": \"$_arg_role\", \"exp\": $expiry}" | base64 | sed s/\+/-/g |sed 's/\//_/g' |  sed -E s/=+$//)
+        payload=$(echo -n "{\"role\":\"$_arg_role\"}" | base64 | sed s/\+/-/g |sed 's/\//_/g' |  sed -E s/=+$//)
 
         # Convert secret to hex
         hexsecret=$(echo -n "$_arg_secret" | xxd -p | paste -sd "")

nix/tools/docs.nix

@@ -2,28 +2,24 @@
 , aspellDicts
 , buildToolbox
 , checkedShellScript
-, lib
-, plantuml
 , python3
 , python3Packages
-, writeTextFile
 , writers
+, plantuml
 }:
 let
   selectPythonPackages = ps: [
     ps.sphinx
-    ps.sphinx-copybutton
-    ps.sphinx-rtd-dark-mode
-    ps.sphinx-rtd-theme
+    ps.sphinx_rtd_theme
+    ps.livereload
     ps.sphinx-tabs
+    ps.sphinx-copybutton
     ps.sphinxext-opengraph
+    (ps.callPackage ../docs-extensions/sphinx-rtd-dark-mode.nix { })
+    # TODO: Remove override once new sphinx-intl version (> 2.1.0) is released and available in nixpkgs
+    (ps.sphinx-intl.overrideAttrs (drv: { nativeBuildInputs = drv.nativeBuildInputs ++ [ ps.six ]; }))
   ];
 
-  requirements = writeTextFile {
-    name = "requirements.txt";
-    text = lib.concatMapStringsSep "\n" (pkg: "${pkg.pname}==${pkg.version}") (selectPythonPackages python3Packages);
-  };
-
   python = python3.withPackages selectPythonPackages;
 
   build =
@@ -35,9 +31,6 @@ let
         workingDir = "/docs";
       }
       ''
-        # https://github.com/sphinx-doc/sphinx/issues/11739
-        export LC_ALL=C
-
         function build() {
           ${python}/bin/sphinx-build --color -W -a -n . -b "$@"
         }
@@ -80,7 +73,7 @@ let
   server =
     writers.writePython3
       "postgrest-docs-server"
-      { libraries = selectPythonPackages python3Packages ++ [ python3Packages.livereload ]; }
+      { libraries = selectPythonPackages python3Packages; }
       ''
         import sys
         from livereload import Server, shell
@@ -122,8 +115,6 @@ let
         workingDir = "/docs";
       }
       ''
-        export LC_ALL=C
-
         FILES=$(find . -type f -iname '*.rst' | tr '\n' ' ')
 
         # shellcheck disable=SC2086 disable=SC2016
@@ -144,8 +135,6 @@ let
         workingDir = "/docs";
       }
       ''
-        export LC_ALL=C
-
         FILES=$(find . -type f -iname '*.rst' | tr '\n' ' ')
 
         tail -n+2 postgrest.dict \
@@ -164,8 +153,6 @@ let
         workingDir = "/docs";
       }
       ''
-        export LC_ALL=C
-
         ${python}/bin/sphinx-build --color -b linkcheck . ../.docs-build
       '';
 
@@ -196,5 +183,4 @@ buildToolbox
       serve
       spellcheck;
   };
-  extra = { inherit requirements; };
 }

nix/tools/generate_targets.py

@@ -1,146 +0,0 @@
-# generates a file to be used by the vegeta load testing tool
-
-# It includes a worst case scenario for the JWT cache:
-# - all requests will have a unique JWT so no cache hits
-# - all jwts have an expiration that will be long enough to be
-#   valid at time of request but short enough that already
-#   validated jwts will expire later during the loadtest run
-# - the above guarantees JWT cache purging will happen
-# - we want this to track resource consumption in the worst case
-
-# And a more normal scenario where non-expiring JWTs are picked
-# from an array
-import time
-import argparse
-import sys
-import random
-import jwt
-import jwcrypto.jwk as jwk
-from typing import Optional
-from pathlib import Path
-
-URL = "http://postgrest"
-
-secret_key = b"reallyreallyreallyreallyverysafe"
-
-key = jwk.JWK.generate(kty="RSA", size=4096)
-private_key = jwt.algorithms.RSAAlgorithm.from_jwk(key.export_private())
-public_key = key.export_public()
-
-
-def generate_jwt(now: int, exp_inc: Optional[int], is_hs: bool) -> str:
-    """Generate an HS256 or RS256 JWT"""
-    payload = {
-        "sub": f"user_{random.getrandbits(32)}",
-        "iat": now,
-        "role": "postgrest_test_author",
-    }
-
-    if exp_inc is not None:
-        payload["exp"] = now + exp_inc
-
-    k = secret_key if is_hs else private_key
-    alg = "HS256" if is_hs else "RS256"
-    return jwt.encode(payload, k, alg)
-
-
-def append_targets(lines: list[str], token: str):
-    lines.append(f"OPTIONS {URL}/authors_only")
-    lines.append(f"Authorization: Bearer {token}")
-    lines.append("")  # blank line to separate requests
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Generate Vegeta targets with unique JWTs"
-    )
-    parser.add_argument(
-        "output",
-        help="Path to write the generated targets file",
-    )
-    parser.add_argument(
-        "--worst",
-        dest="worst",
-        action=argparse.BooleanOptionalAction,
-        default=False,
-        help="Generate worst case targets for a JWT cache",
-    )
-    parser.add_argument(
-        "--rsa",
-        dest="jwk_path",
-        metavar="JWK_PATH",
-        type=Path,
-        default=None,
-        help="Path for generating a RSA JWK file to sign tokens with",
-    )
-
-    args = parser.parse_args()
-
-    is_hs = args.jwk_path is None
-
-    nsamples = 1000
-    if is_hs:
-        ntargets = 200000
-    else:
-        # The asymmetric targets take too long to compute so we reduce them
-        ntargets = 50000
-
-    if not is_hs:
-        try:
-            with open(args.jwk_path, "w") as jwk:
-                jwk.write(public_key)
-                print(f"Created {args.jwk_path} file containing the RSA JWK")
-        except IOError as e:
-            print(f"Error writing to {args.jwk_path}: {e}", file=sys.stderr)
-            sys.exit(1)
-
-    print(f"Generating {ntargets} targets...")
-
-    start_time = time.time()
-
-    now = int(start_time)
-
-    lines = []
-
-    # We want to ensure 401 Unauthorized responses don't happen during
-    # JWT validation, this can happen when the jwt `exp` is too short.
-    # At the same time, we want to ensure the `exp` is not too big,
-    # so expires will occur and postgREST needs to
-    # clean cached expired JWTs
-    if args.worst:
-        # estimated time takes to build and run postgrest itself
-        build_run_postgrest_time = 2
-        # estimated time it takes to generate the targets file
-        # the division numbers are tuned by hand
-        if is_hs:  # hs generation is much faster
-            gen_time = ntargets // 66666
-        else:  # asymmetric is slower so the time is higher
-            gen_time = ntargets // 220
-
-        # estimated exp time so some JWTs will expire
-        inc = build_run_postgrest_time + gen_time
-
-        for i in range(ntargets):
-            token = generate_jwt(now, inc + i // 1000, is_hs)
-            append_targets(lines, token)
-
-    else:
-        tokens = [generate_jwt(now, None, is_hs) for _ in range(nsamples)]
-        for i in range(ntargets):
-            token = random.choice(tokens)
-            append_targets(lines, token)
-
-    try:
-        with open(args.output, "w") as f:
-            f.write("\n".join(lines))
-    except IOError as e:
-        print(f"Error writing to {args.output}: {e}", file=sys.stderr)
-        sys.exit(1)
-
-    elapsed = time.time() - start_time
-    print(f"Created {ntargets} targets", end=" ")
-    print(f"in {args.output} ({elapsed:.2f}s)")
-
-
-if __name__ == "__main__":
-    main()

nix/tools/gitTools.nix

@@ -1,60 +0,0 @@
-{ buildToolbox
-, checkedShellScript
-, commitlint
-, writeText
-}:
-let
-  # Rules format: [<severity>, <"always"/"never">, <value>]
-  commitlintConfig = writeText "commitlint.config.mjs" ''
-    export default {
-      rules: {
-        "type-enum": [2, "always", [
-            'add',      // Add a new feature
-            'amend',    // To amend an unrealease commit
-            'change',   // Breaking changes
-            'chore',    // Update sponsors, changelog, readme etc
-            'ci',       // CI configuration files and scripts
-            'docs',     // Documentation
-            'fix',      // Bug fix
-            'nix',      // Related to Nix
-            'perf',     // Performance improvements
-            'refactor', // Refactoring code
-            'remove',   // Remove a feature or fix
-            'test',     // Adding tests
-          ]],
-
-          'subject-case':       [2, 'never', ['pascal-case', 'start-case']],
-          'subject-empty':      [2, 'never'],
-          'subject-full-stop':  [2, 'never', '.'],
-          'subject-max-length': [2, 'always', 80],
-          'subject-min-length': [2, 'always', 5],
-
-          'scope-case':         [2, 'always', 'lower-case'],
-
-          'body-leading-blank': [2, 'always'],
-      },
-    };
-  '';
-
-  commitCheck =
-    checkedShellScript
-      {
-        name = "postgrest-commitlint";
-        docs = "Script to validate commit messages";
-        workingDir = "/";
-        args = [
-          "ARG_OPTIONAL_SINGLE([from],, [commit ref start from], [main])"
-          "ARG_OPTIONAL_SINGLE([to],, [commit ref end at], [HEAD])"
-        ];
-      }
-      ''
-        # Run commitlint with the given configuration
-
-        ${commitlint}/bin/commitlint --config ${commitlintConfig} --from "$_arg_from" --to "$_arg_to"
-      '';
-in
-buildToolbox
-{
-  name = "postgrest-commitlint";
-  tools = { inherit commitCheck; };
-}

nix/tools/loadtest.nix

@@ -41,9 +41,6 @@ let
         args = [
           "ARG_OPTIONAL_SINGLE([output], [o], [Filename to dump json output to], [./loadtest/result.bin])"
           "ARG_OPTIONAL_SINGLE([testdir], [t], [Directory to load tests and fixtures from], [./test/load])"
-          "ARG_OPTIONAL_SINGLE([kind], [k], [Kind of loadtest], [mixed])"
-          "ARG_TYPE_GROUP_SET([KIND], [KIND], [kind], [mixed,jwt-hs,jwt-hs-cache,jwt-hs-cache-worst,jwt-rsa,jwt-rsa-cache,jwt-rsa-cache-worst])"
-          "ARG_OPTIONAL_SINGLE([monitor], [m], [Monitoring file], [./loadtest/result.csv])"
           "ARG_LEFTOVERS([additional vegeta arguments])"
         ];
         workingDir = "/";
@@ -58,67 +55,16 @@ let
         export PGRST_DB_POOL="1"
         export PGRST_DB_TX_END="rollback-allow-override"
         export PGRST_LOG_LEVEL="crit"
-        export PGRST_JWT_SECRET="reallyreallyreallyreallyverysafe"
-        # set previous PGRST_JWT_CACHE_MAX_LIFETIME configuration so that
-        # load test works across branches
-        # TODO clean once PGRST_JWT_CACHE_MAX_ENTRIES merged and released
-        export PGRST_JWT_CACHE_MAX_LIFETIME="86400"
 
         mkdir -p "$(dirname "$_arg_output")"
         abs_output="$(realpath "$_arg_output")"
 
-        case "$_arg_kind" in
-          jwt-hs)
-            ${genTargetsHS} "$_arg_testdir"/gen_targets.http
-            export PGRST_JWT_CACHE_MAX_ENTRIES="0"
-            export PGRST_JWT_CACHE_MAX_LIFETIME="0"
-            ;;
-
-          jwt-hs-cache)
-            ${genTargetsHS} "$_arg_testdir"/gen_targets.http
-            ;;
-
-          jwt-hs-cache-worst)
-            ${genTargetsHS} --worst "$_arg_testdir"/gen_targets.http
-            ;;
-
-          jwt-rsa)
-            ${genTargetsHS} --rsa="$_arg_testdir"/gen_jwk.json "$_arg_testdir"/gen_targets.http
-            export PGRST_JWT_CACHE_MAX_ENTRIES="0"
-            export PGRST_JWT_CACHE_MAX_LIFETIME="0"
-            export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
-            ;;
-
-          jwt-rsa-cache)
-            ${genTargetsHS} --rsa="$_arg_testdir"/gen_jwk.json "$_arg_testdir"/gen_targets.http
-            export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
-            ;;
-
-          jwt-rsa-cache-worst)
-            ${genTargetsHS} --worst --rsa="$_arg_testdir"/gen_jwk.json "$_arg_testdir"/gen_targets.http
-            export PGRST_JWT_SECRET="@$_arg_testdir/gen_jwk.json"
-            ;;
-
-          *)
-            ;;
-        esac
-
-        if [ "$_arg_kind" == "mixed" ]; then
-          # shellcheck disable=SC2145
-          ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \
-          ${withTools.withSlowPg} \
-          ${withTools.withPgrst} -m "$_arg_monitor" \
-          ${withTools.withSlowPgrst} \
-          sh -c "cd \"$_arg_testdir\" && \
-          ${runner} -targets targets.http -output \"$abs_output\" \"''${_arg_leftovers[@]}\""
-        else
-          # shellcheck disable=SC2145
-          ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \
-          ${withTools.withPgrst} -m "$_arg_monitor" \
-          sh -c "cd \"$_arg_testdir\" && \
-          ${runner} -lazy -targets gen_targets.http -output \"$abs_output\" \"''${_arg_leftovers[@]}\""
-        fi
-
+        # shellcheck disable=SC2145
+        ${withTools.withPg} -f "$_arg_testdir"/fixtures.sql \
+        ${withTools.withSlowPg} \
+        ${withTools.withPgrst} \
+        ${withTools.withSlowPgrst} \
+        sh -c "cd \"$_arg_testdir\" && ${runner} -targets targets.http -output \"$abs_output\" \"''${_arg_leftovers[@]}\""
         ${vegeta}/bin/vegeta report -type=text "$_arg_output"
       '';
 
@@ -137,7 +83,6 @@ let
           '';
         args = [
           "ARG_POSITIONAL_INF([target], [Commit-ish reference to compare with], 1)"
-          "ARG_OPTIONAL_SINGLE([kind], [k], [Kind of loadtest], [mixed])"
         ];
         positionalCompletion =
           ''
@@ -148,12 +93,11 @@ let
         workingDir = "/";
       }
       ''
-        # run loadtest for every target
         for tgt in "''${_arg_target[@]}"; do
 
         cat << EOF
 
-        Running "$_arg_kind" loadtest on "$tgt"...
+        Running loadtest on "$tgt"...
 
         EOF
 
@@ -162,7 +106,7 @@ let
         # Save the results in the current working tree, too,
         # otherwise they'd be lost in the temporary working tree
         # created by withTools.withGit.
-        ${withTools.withGit} "$tgt" ${loadtest} -k "$_arg_kind" -m "$PWD/loadtest/$tgt.csv" --output "$PWD/loadtest/$tgt.bin" --testdir "$PWD/test/load"
+        ${withTools.withGit} "$tgt" ${loadtest} --output "$PWD/loadtest/$tgt.bin" --testdir "$PWD/test/load"
 
         cat << EOF
 
@@ -172,15 +116,13 @@ let
 
         done
 
-        # run loadtest once on HEAD
-
         cat << EOF
 
-        Running "$_arg_kind" loadtest on HEAD...
+        Running loadtest on HEAD...
 
         EOF
 
-        ${loadtest} -k "$_arg_kind" -m "$PWD/loadtest/head.csv" --output "$PWD/loadtest/head.bin" --testdir "$PWD/test/load"
+        ${loadtest} --output "$PWD/loadtest/head.bin" --testdir "$PWD/test/load"
 
         cat << EOF
 
@@ -217,7 +159,6 @@ let
         pd.read_json(sys.stdin) \
           .set_index('param') \
           .drop(['branch', 'earliest', 'end', 'latest']) \
-          .fillna("") \
           .convert_dtypes() \
           .to_markdown(sys.stdout, floatfmt='.0f')
       '';
@@ -228,41 +169,15 @@ let
       {
         name = "postgrest-loadtest-report";
         docs = "Create a report of all loadtest reports as markdown.";
-        args = [
-          "ARG_OPTIONAL_SINGLE([group], [g], [Marker to group results])"
-        ];
         workingDir = "/";
       }
       ''
-        marker=''${_arg_group:+"($_arg_group)"}
-
-        echo -e "## Loadtest results $marker\n"
-
         find loadtest -type f -iname '*.bin' -exec ${reporter} {} \; \
           | ${jq}/bin/jq '[paths(scalars) as $path | {param: $path | join("."), (.branch): getpath($path)}]' \
           | ${jq}/bin/jq --slurp 'flatten | group_by(.param) | map(add)' \
           | ${toMarkdown}
-
-        echo -e "\n\n## Loadtest elapsed seconds vs CPU/MEM usage $marker\n"
-
-        find loadtest -type f -iname '*.csv' \
-          | sort -m \
-          | ${mergeMonitorResults}
       '';
 
-  genTargetsHS =
-    writers.writePython3 "postgrest-gen-loadtest-targets-hs"
-      {
-        libraries = [ python3Packages.pyjwt python3Packages.jwcrypto ];
-      }
-      (builtins.readFile ./generate_targets.py);
-
-  mergeMonitorResults =
-    writers.writePython3 "postgrest-merge-monitor-results"
-      {
-        libraries = [ python3Packages.pandas python3Packages.tabulate ];
-      }
-      (builtins.readFile ./merge_monitor_result.py);
 in
 buildToolbox {
   name = "postgrest-loadtest";

nix/tools/memory.nix

@@ -0,0 +1,51 @@
+# The memory tests have large dependencies (a profiled build of PostgREST)
+# and are run less often than the spec tests, so we don't include them in
+# the default test environment. We make them available through a separate module.
+# TODO both of these require reentering the nix-shell if you make a change to the code
+{ buildToolbox
+, checkedShellScript
+, curl
+, postgrestProfiled
+, withTools
+}:
+let
+  test =
+    checkedShellScript
+      {
+        name = "postgrest-test-memory";
+        docs = "Run the memory tests.";
+        workingDir = "/";
+        withPath = [ postgrestProfiled curl ];
+      }
+      ''
+        ${withTools.withPg} -f test/spec/fixtures/load.sql test/memory/memory-tests.sh
+      '';
+
+  runProfiled =
+    checkedShellScript
+      {
+        name = "postgrest-profiled-run";
+        docs = "Run a profiled build of postgREST. This will generate a postgrest.prof file that can be used to do optimization. Note: if you make a change to the code, you must reenter the nix-shell for an updated profiled build.";
+        args =
+          [
+            "ARG_USE_ENV([PGRST_DB_ANON_ROLE], [postgrest_test_anonymous], [PostgREST anonymous role])"
+            "ARG_USE_ENV([PGRST_DB_POOL], [1], [PostgREST pool size])"
+            "ARG_USE_ENV([PGRST_DB_POOL_ACQUISITION_TIMEOUT], [1], [PostgREST pool timeout])"
+            "ARG_LEFTOVERS([PostgREST arguments])"
+          ];
+        workingDir = "/";
+        withPath = [ postgrestProfiled ];
+      }
+      ''
+        export PGRST_DB_ANON_ROLE
+        export PGRST_DB_POOL
+        export PGRST_DB_POOL_ACQUISITION_TIMEOUT
+
+        postgrest +RTS -p -h -RTS "''${_arg_leftovers[@]}"
+      '';
+in
+buildToolbox
+{
+  name = "postgrest-memory";
+  tools = { inherit test runProfiled; };
+}

nix/tools/merge_monitor_result.py

@@ -1,44 +0,0 @@
-import os
-import sys
-import pandas as pd
-
-KEY = "Elapsed seconds"
-BASE_METRICS = ["CPU (%)", "Real (MB)"]
-branch_order = []
-merged = None
-
-paths = [p.strip() for p in sys.stdin.read().split() if p.strip()]
-
-for csv_path in paths:
-    # br is branch (variable shortened to pass linter)
-    br = os.path.splitext(os.path.basename(csv_path))[0]
-    branch_order.append(br)
-
-    df = pd.read_csv(csv_path)
-
-    if KEY not in df.columns:
-        sys.exit(f"{csv_path} is missing the {KEY} column")
-
-    for m in BASE_METRICS:
-        if m not in df.columns:
-            sys.exit(f"Error: '{csv_path}' missing required column '{m}'.")
-
-    # add branch marker to every metric column
-    df = df.rename(columns={c: f"{c} [{br}]" for c in df.columns if c != KEY})
-
-    # outer join so missing rows appear
-    merged = df if merged is None else merged.merge(df, on=KEY, how="outer")
-
-# Re-order columns so related metrics are adjacent
-ordered_cols = [KEY]
-for metric in BASE_METRICS:
-    for br in branch_order:
-        col_name = f"{metric} [{br}]"
-        if col_name in merged.columns:
-            ordered_cols.append(col_name)
-
-merged = merged[ordered_cols]
-
-# replace nan with empty string
-merged = merged.fillna("")
-merged.to_markdown(sys.stdout, index=False, tablefmt="github")

nix/tools/monitor_pid.py

@@ -1,57 +0,0 @@
-# Monitor a process pid with psutil and emits a CSV.
-import sys
-import time
-import psutil
-import pandas as pd
-
-KEY = "Elapsed seconds"
-BASE_METRICS = ["CPU (%)", "Real (MB)"]
-SAMPLE_INTERVAL_SECS = 1
-
-if len(sys.argv) != 2 or not sys.argv[1].isdigit():
-    sys.exit(f"Usage: {sys.argv[0]} <PID>")
-
-pid = int(sys.argv[1])
-try:
-    proc = psutil.Process(pid)
-except psutil.NoSuchProcess:
-    sys.exit(f"Error: process {pid} not found.")
-
-print(f"Starting monitoring of {pid} pid", file=sys.stderr)
-
-records = []
-start = time.time()
-# ignore first result as per docs recommendation
-# https://psutil.readthedocs.io/en/latest/#psutil.cpu_percent
-proc.cpu_percent(None)
-
-while True:
-    try:
-        if not proc.is_running():
-            break
-        time.sleep(SAMPLE_INTERVAL_SECS)
-
-        elapsed_secs = int(time.time() - start)
-        cpu = proc.cpu_percent(None)
-        meminfo = proc.memory_info()
-        bytes_in_MB = 1024**2
-        rss_mb = meminfo.rss / bytes_in_MB
-
-        records.append(
-            [
-                str(elapsed_secs),
-                f"{cpu:.3f}",
-                f"{rss_mb:.3f}",
-            ]
-        )
-
-    except psutil.NoSuchProcess:
-        break
-
-end = time.time()
-total_time = end - start
-print(f"Finished {pid} pid monitoring in {total_time:.3f}", file=sys.stderr)
-
-cols = [KEY] + BASE_METRICS
-df = pd.DataFrame(records, columns=cols, dtype=str)
-df.to_csv(sys.stdout, index=False)

nix/tools/nixpkgsTools.nix

@@ -1,23 +1,52 @@
 { buildToolbox
 , checkedShellScript
+, coreutils
+, curl
+, jq
+, nix
 }:
 # Utility script for pinning the latest stable version of Nixpkgs.
 
-# Instead of running `nix flake update` manually, we run this script
-# to also pin readthedocs dependencies at the same time.
+# Instead of pinning Nixpkgs based on the huge Git repository, we reference a
+# specific tarball that only contains the source of the revision that we want
+# to pin.
 let
+  name =
+    "postgrest-nixpkgs-upgrade";
+
+  refUrl =
+    "https://api.github.com/repos/nixos/nixpkgs/git/matching-refs/heads/nixpkgs-";
+
+  githubV3Header =
+    "Accept: application/vnd.github.v3+json";
+
+  tarballUrlBase =
+    "https://github.com/nixos/nixpkgs/archive/";
+
   upgrade =
     checkedShellScript
       {
-        name = "postgrest-nixpkgs-upgrade";
-        docs = "Pin the newest version of Nixpkgs.";
+        inherit name;
+        docs = "Pin the newest stable version of Nixpkgs.";
         workingDir = "/";
       }
       ''
-        nix flake update
+        # The list of refs is sorted. The first result will be nixpkgs-unstable, the second the latest stable branch.
+        commitHash="$(${curl}/bin/curl "${refUrl}" -H "${githubV3Header}" | ${jq}/bin/jq -r 'sort_by(.ref) | reverse | .[1].object.sha')"
+        tarballUrl="${tarballUrlBase}$commitHash.tar.gz"
+        tarballHash="$(${nix}/bin/nix-prefetch-url --unpack "$tarballUrl")"
+        currentDate="$(${coreutils}/bin/date --iso)"
 
-        echo "# This file is auto-generated by postgrest-nixpkgs-upgrade" > docs/requirements.txt
-        cat "$(nix-build -A docs.requirements)" >> docs/requirements.txt
+        cat > nix/nixpkgs-version.nix << EOF
+        # Pinned version of Nixpkgs, generated with ${name}.
+        {
+          owner = "NixOS";
+          repo = "nixpkgs";
+          date = "$currentDate";
+          rev = "$commitHash";
+          tarballHash = "$tarballHash";
+        }
+        EOF
       '';
 
 in

nix/tools/release/default.nix

@@ -20,41 +20,42 @@ let
         git diff --exit-code HEAD postgrest.cabal > /dev/null
         trap "" ERR
 
-        # TODO: Support C+D bumps when implementing hackage releases
         bump () {
           current_version="$(grep -oP '^version:\s*\K.*' postgrest.cabal)"
           # shellcheck disable=SC2034
-          IFS=. read -r A B C D <<< "$current_version"
+          IFS=. read -r major minor patch <<< "$current_version"
           echo "Current version is $current_version"
 
           case "$1" in
-            A)
-              new_version="$((A+1)).0"
-              new_docs_version="$((A+1))"
+            major)
+              new_version="$((major+1)).0.0"
               ;;
-            B)
-              new_version="$A.$((B+1))"
-              new_docs_version="$A"
+            minor)
+              new_version="$major.$((minor+1)).0"
+              ;;
+            patch)
+              new_version="$major.$minor.$((patch+1))"
               ;;
             devel)
-              new_version="$((A+1))"
-              new_docs_version="devel"
+              new_version="$major.$((minor+1))"
               ;;
           esac
 
           echo "Updating postgrest.cabal ..."
           sed -i -E "s/^(version:\s+).*$/\1$new_version/" postgrest.cabal > /dev/null
-          echo "Updating docs/conf.py ..."
-          sed -i -E "s/^(version = ).*$/\1\"$new_docs_version\"/" docs/conf.py > /dev/null
 
-          git add postgrest.cabal docs/conf.py > /dev/null
+          git add postgrest.cabal > /dev/null        
         }
 
         today_date_for_changelog="$(date '+%Y-%m-%d')"
         if [[ "$current_branch" == "main" ]]; then
-          bump A
+          if [[ "$_arg_major" == "on" ]]; then
+            bump major
+          else
+            bump minor
+          fi
         else
-          bump B
+          bump patch
         fi
 
         echo "Updating CHANGELOG.md ..."
@@ -68,10 +69,10 @@ let
           bump devel
 
           # The order of operations is important here:
-          # - bump devel is run and $A is upated to the new version
-          # - the branch is created with the new A, but the commit before the devel bump
+          # - bump devel is run and $major is upated to the new version
+          # - the branch is created with the new major, but the commit before the devel bump
           # - the devel bump is committed
-          git branch "v$A"
+          git branch -f "v$major"
 
           echo "Committing (devel bump)..."
           git commit -m "bump version to $new_version" > /dev/null
@@ -83,7 +84,7 @@ let
 
         if [[ "$current_branch" == "main" ]]; then
           push1="git push $remote $current_branch"
-          push2="git push $remote v$A"
+          push2="git push $remote v$major --force"
         else
           push1="git push $remote $current_branch"
           push2=""

nix/tools/style.nix

@@ -7,12 +7,9 @@
 , hlint
 , hsie
 , nixpkgs-fmt
-, python3Packages
-, ruff
 , silver-searcher
 , statix
 , stylish-haskell
-, writeText
 }:
 let
   style =
@@ -52,20 +49,6 @@ let
         ${git}/bin/git diff-index --exit-code HEAD -- '*.hs' '*.lhs' '*.nix' '*.py'
       '';
 
-  hlintConfig = writeText "hlintConfig.yml" ''
-
-    # Arguments passed to hlint
-    - arguments: [-j, -XQuasiQuotes, -XNoPatternSynonyms]
-
-    # Warnings
-    - warn: { lhs: "a == a", rhs: "True",  note: "This comparison always evaluates to True" }
-    - warn: { lhs: "a /= a", rhs: "False", note: "This comparison always evaluates to False" }
-    - warn: { lhs: "a < a",  rhs: "False", note: "This comparison always evaluates to False" }
-    - warn: { lhs: "a > a",  rhs: "False", note: "This comparison always evaluates to False" }
-    - warn: { lhs: "a <= a", rhs: "True",  note: "This comparison always evaluates to True" }
-    - warn: { lhs: "a >= a", rhs: "True",  note: "This comparison always evaluates to True" }
-  '';
-
   lint =
     checkedShellScript
       {
@@ -80,21 +63,13 @@ let
         echo "Scanning nix files for unused code..."
         ${deadnix}/bin/deadnix -f
 
-        # ruff has gaps in scanning for unused code, so we use vulture
-        echo "Scanning python files for unused code..."
-        ${silver-searcher}/bin/ag -l --vimgrep -g '\.l?py$' . \
-          | xargs ${python3Packages.vulture}/bin/vulture --exclude docs/conf.py
-
-        echo "Linting python files..."
-        ${ruff}/bin/ruff check .
-
         echo "Checking consistency of import aliases in Haskell code..."
         ${hsie} check-aliases main src
 
         echo "Linting Haskell files..."
         # --vimgrep fixes a bug in ag: https://github.com/ggreer/the_silver_searcher/issues/753
         ${silver-searcher}/bin/ag -l --vimgrep -g '\.l?hs$' . \
-          | xargs ${hlint}/bin/hlint --hint=${hlintConfig}
+          | xargs ${hlint}/bin/hlint -X QuasiQuotes -X NoPatternSynonyms
       '';
 
 in

nix/tools/tests.nix

@@ -1,7 +1,6 @@
 { buildToolbox
 , cabal-install
 , checkedShellScript
-, curl
 , devCabalOptions
 , ghc
 , glibcLocales ? null
@@ -32,20 +31,6 @@ let
           ${cabal-install}/bin/cabal v2-run ${devCabalOptions} test:spec -- "''${_arg_leftovers[@]}"
       '';
 
-  testObservability =
-    checkedShellScript
-      {
-        name = "postgrest-test-observability";
-        docs = "Run the Haskell observability test suite.";
-        args = [ "ARG_LEFTOVERS([hspec arguments])" ];
-        workingDir = "/";
-        withEnv = postgrest.env;
-      }
-      ''
-        ${withTools.withPg} -f test/observability/fixtures/load.sql \
-          ${cabal-install}/bin/cabal v2-run ${devCabalOptions} test:observability -- "''${_arg_leftovers[@]}"
-      '';
-
   testDoctests =
     checkedShellScript
       {
@@ -96,8 +81,8 @@ let
         withEnv = postgrest.env;
       }
       ''
-        ${cabal-install}/bin/cabal v2-build ${devCabalOptions} exe:postgrest
-        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} -f test/io/fixtures/load.sql \
+        ${cabal-install}/bin/cabal v2-build ${devCabalOptions}
+        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} -f test/io/fixtures.sql \
           ${ioTestPython}/bin/pytest --ignore=test/io/test_big_schema.py --ignore=test/io/test_replica.py -v test/io "''${_arg_leftovers[@]}"
       '';
 
@@ -111,8 +96,8 @@ let
         withEnv = postgrest.env;
       }
       ''
-        ${cabal-install}/bin/cabal v2-build ${devCabalOptions} exe:postgrest
-        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} -f test/io/fixtures/big_schema.sql \
+        ${cabal-install}/bin/cabal v2-build ${devCabalOptions}
+        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} -f test/io/big_schema.sql \
           ${ioTestPython}/bin/pytest -v test/io/test_big_schema.py "''${_arg_leftovers[@]}"
       '';
 
@@ -126,8 +111,8 @@ let
         withEnv = postgrest.env;
       }
       ''
-        ${cabal-install}/bin/cabal v2-build ${devCabalOptions} exe:postgrest
-        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} --replica -f test/io/fixtures/replica.sql \
+        ${cabal-install}/bin/cabal v2-build ${devCabalOptions}
+        ${cabal-install}/bin/cabal v2-exec -- ${withTools.withPg} --replica -f test/io/replica.sql \
           ${ioTestPython}/bin/pytest -v test/io/test_replica.py "''${_arg_leftovers[@]}"
       '';
 
@@ -169,7 +154,7 @@ let
           rm -rf coverage/*
 
           # build once before running all the tests
-          ${cabal-install}/bin/cabal v2-build ${devCabalOptions} exe:postgrest lib:postgrest test:spec test:observability
+          ${cabal-install}/bin/cabal v2-build ${devCabalOptions} exe:postgrest lib:postgrest test:spec
 
           (
             trap 'echo Found dead code: Check file list above.' ERR ;
@@ -178,31 +163,26 @@ let
 
           # collect all tests
           HPCTIXFILE="$tmpdir"/io.tix \
-            ${withTools.withPg} -f test/io/fixtures/load.sql \
+            ${withTools.withPg} -f test/io/fixtures.sql \
             ${cabal-install}/bin/cabal v2-exec ${devCabalOptions} -- ${ioTestPython}/bin/pytest --ignore=test/io/test_big_schema.py --ignore=test/io/test_replica.py -v test/io
 
           HPCTIXFILE="$tmpdir"/big_schema.tix \
-            ${withTools.withPg} -f test/io/fixtures/big_schema.sql \
+            ${withTools.withPg} -f test/io/big_schema.sql \
             ${cabal-install}/bin/cabal v2-exec ${devCabalOptions} -- ${ioTestPython}/bin/pytest -v test/io/test_big_schema.py
 
           HPCTIXFILE="$tmpdir"/replica.tix \
-            ${withTools.withPg} --replica -f test/io/fixtures/replica.sql \
+            ${withTools.withPg} --replica -f test/io/replica.sql \
             ${cabal-install}/bin/cabal v2-exec ${devCabalOptions} -- ${ioTestPython}/bin/pytest -v test/io/test_replica.py
 
           HPCTIXFILE="$tmpdir"/spec.tix \
             ${withTools.withPg} -f test/spec/fixtures/load.sql \
             ${cabal-install}/bin/cabal v2-run ${devCabalOptions} test:spec
 
-          HPCTIXFILE="$tmpdir"/observability.tix \
-            ${withTools.withPg} -f test/observability/fixtures/load.sql \
-            ${cabal-install}/bin/cabal v2-run ${devCabalOptions} test:observability
-
           # Note: No coverage for doctests, as doctests leverage GHCi and GHCi does not support hpc
 
           # collect all the tix files
           ${ghc}/bin/hpc sum  --union --exclude=Paths_postgrest --output="$tmpdir"/tests.tix \
-            "$tmpdir"/io*.tix "$tmpdir"/big_schema*.tix "$tmpdir"/replica*.tix "$tmpdir"/spec.tix \
-            "$tmpdir"/observability.tix
+            "$tmpdir"/io*.tix "$tmpdir"/big_schema*.tix "$tmpdir"/replica*.tix "$tmpdir"/spec.tix
 
           # prepare the overlay
           ${ghc}/bin/hpc overlay --output="$tmpdir"/overlay.tix test/coverage.overlay
@@ -247,21 +227,6 @@ let
         sed -i 's|^module \(.*\):|module \1/|g' test/coverage.overlay
       '';
 
-  testMemory =
-    checkedShellScript
-      {
-        name = "postgrest-test-memory";
-        docs = "Run the memory tests.";
-        workingDir = "/";
-        withEnv = postgrest.env;
-        withPath = [ curl ];
-      }
-      ''
-        ${cabal-install}/bin/cabal --builddir="dist-prof" v2-build --enable-profiling --disable-shared exe:postgrest
-        ${cabal-install}/bin/cabal --builddir="dist-prof" v2-exec -- ${withTools.withPg} -f test/spec/fixtures/load.sql \
-          test/memory/memory-tests.sh
-      '';
-
 in
 buildToolbox
 {
@@ -269,7 +234,6 @@ buildToolbox
   tools = {
     inherit
       testSpec
-      testObservability
       testDoctests
       testSpecIdempotence
       testIO
@@ -277,7 +241,6 @@ buildToolbox
       testReplica
       dumpSchema
       coverage
-      coverageDraftOverlay
-      testMemory;
+      coverageDraftOverlay;
   };
 }

nix/tools/withTools.nix

@@ -5,10 +5,8 @@
 , lib
 , postgresqlVersions
 , postgrest
-, python3Packages
 , slocat
 , writeText
-, writers
 }:
 let
   withTmpDb =
@@ -46,7 +44,7 @@ let
         }
 
         # Avoid starting multiple layers of withTmpDb, but make sure to have the last invocation
-        # load fixtures. Otherwise postgrest-with-pg-xx postgrest-test-io would not be possible.
+        # load fixtures. Otherwise postgrest-with-postgresql-xx postgrest-test-io would not be possible.
         if ! test -v PGHOST; then
 
           mkdir -p "$tmpdir"/{db,socket}
@@ -74,13 +72,7 @@ let
             >> "$setuplog"
 
           log "Starting the database cluster..."
-
           # Instead of listening on a local port, we will listen on a unix domain socket.
-          # NOTE: unix domain socket filename name must remain under max limit.
-          # On Linux, it's 108 chars (including '\0' terminator)
-          # On MacOS, it's 104 chars
-          # See: https://serverfault.com/questions/641347/check-if-a-path-exceeds-maximum-for-unix-domain-socket
-
           pg_ctl -l "$tmpdir/db.log" -w start -o "-F -c listen_addresses=\"\" -c hba_file=$HBA_FILE -k $PGHOST -c log_statement=\"all\" " \
             >> "$setuplog"
 
@@ -335,22 +327,6 @@ let
         done
       '';
 
-  # Broadcast SIGINT to any running postgrest instances on the host. Uses python for cross-platform compatibility.
-  signalPostgrest =
-    writers.writePython3 "postgrest-signal-int"
-      { libraries = [ python3Packages.psutil ]; }
-      ''
-        import psutil
-        import signal
-
-        for proc in psutil.process_iter(["name"]):
-            try:
-                if proc.info["name"] == "postgrest":
-                    proc.send_signal(signal.SIGINT)
-            except (psutil.NoSuchProcess, psutil.AccessDenied):
-                continue
-      '';
-
   withPgrst =
     checkedShellScript
       {
@@ -360,7 +336,6 @@ let
           [
             "ARG_POSITIONAL_SINGLE([command], [Command to run])"
             "ARG_LEFTOVERS([command arguments])"
-            "ARG_OPTIONAL_SINGLE([monitor], [m], [Enable CPU and memory monitoring of the PostgREST process and output to the designated file as markdown])"
           ];
         positionalCompletion = "_command";
         workingDir = "/";
@@ -373,13 +348,12 @@ let
         rm -f result
         if [ -z "''${PGRST_BUILD_CABAL:-}" ]; then
           echo -n "Building postgrest (nix)... "
-          # Using lib.getBin to also make this work with older checkouts, where .bin was not a thing, yet.
-          nix-build -E 'with import ./. {}; pkgs.lib.getBin postgrestPackage' > "$tmpdir"/build.log 2>&1 || {
+          nix-build -A postgrestPackage > "$tmpdir"/build.log 2>&1 || {
             echo "failed, output:"
             cat "$tmpdir"/build.log
             exit 1
           }
-          PGRST_CMD=$(echo ./result*/bin/postgrest)
+          PGRST_CMD=./result/bin/postgrest
         else
           echo -n "Building postgrest (cabal)... "
           postgrest-build
@@ -387,22 +361,11 @@ let
         fi
         echo "done."
 
-        ver=$($PGRST_CMD ${legacyConfig} --version)
-
-        echo -n "Starting $ver... "
-
+        echo -n "Starting postgrest... "
         $PGRST_CMD ${legacyConfig} > "$tmpdir"/run.log 2>&1 &
         pid=$!
         # shellcheck disable=SC2317
         cleanup() {
-          # Send INT to all postgrest processes.
-          # Workaround to trigger dumping postgrest.prof for postgrest-profiled-run
-          # Caveat: we cannot realistically limit this to the current process' tree,
-          # since pkill's --parent supports only direct children; therefore this
-          # would reap neighbor postgrest instances as well, because INT is asking
-          # the process to terminate too.
-          # TODO: consider cgroups to make this cleaner
-          ${signalPostgrest}
           kill "$pid" || true
         }
         trap cleanup EXIT
@@ -414,19 +377,9 @@ let
         }
         echo "done."
 
-        if [[ -n "$_arg_monitor" ]]; then
-          ${monitorPid} "$pid" > "$_arg_monitor" &
-        fi
-
         ("$_arg_command" "''${_arg_leftovers[@]}")
       '';
 
-  monitorPid =
-    writers.writePython3 "postgrest-monitor-pid"
-      {
-        libraries = [ python3Packages.pandas python3Packages.tabulate python3Packages.psutil ];
-      }
-      (builtins.readFile ./monitor_pid.py);
 in
 buildToolbox
 {
@@ -439,7 +392,7 @@ buildToolbox
       withSlowPg
       withSlowPgrst;
   } // builtins.listToAttrs (
-    # Create a `postgrest-with-pg-` for each PostgreSQL version
+    # Create a `postgrest-with-postgresql-` for each PostgreSQL version
     builtins.map (pg: { inherit (pg) name; value = withTmpDb pg; }) postgresqlVersions
   );
   # make latest withPg available for other nix files

postgrest.cabal

@@ -1,5 +1,5 @@
 name:               postgrest
-version:            14.8
+version:            12.2.12
 synopsis:           REST API for any Postgres database
 description:        Reads the schema of a PostgreSQL database and creates RESTful routes
                     for tables, views, and functions, supporting all HTTP methods that security
@@ -16,17 +16,18 @@ extra-source-files: CHANGELOG.md
 cabal-version:      >= 1.10
 
 tested-with:
-    -- nix
-    GHC == 9.4.8
-    -- cabal on Ubuntu
     -- stack on FreeBSD, MacOS, Ubuntu, Windows
-  , GHC == 9.6.7
+    GHC == 9.4.5
+    -- nix, cabal on Ubuntu (arm)
+  , GHC == 9.4.8
     -- cabal on Ubuntu
-  , GHC == 9.8.4
+  , GHC == 9.6.4
+    -- cabal on Ubuntu
+  , GHC == 9.8.2
 
 source-repository head
   type:     git
-  location: https://github.com/PostgREST/postgrest.git
+  location: git://github.com/PostgREST/postgrest.git
 
 flag dev
   default:     False
@@ -47,12 +48,7 @@ library
                       PostgREST.App
                       PostgREST.AppState
                       PostgREST.Auth
-                      PostgREST.Auth.Jwt
-                      PostgREST.Auth.JwtCache
-                      PostgREST.Auth.Types
-                      PostgREST.Cache.Sieve
                       PostgREST.CLI
-                      PostgREST.Client
                       PostgREST.Config
                       PostgREST.Config.Database
                       PostgREST.Config.JSPath
@@ -68,13 +64,10 @@ library
                       PostgREST.Error
                       PostgREST.Listener
                       PostgREST.Logger
-                      PostgREST.MainTx
                       PostgREST.MediaType
                       PostgREST.Metrics
-                      PostgREST.Network
                       PostgREST.Observation
                       PostgREST.Query
-                      PostgREST.Query.PreQuery
                       PostgREST.Query.QueryBuilder
                       PostgREST.Query.SqlFragment
                       PostgREST.Query.Statements
@@ -88,58 +81,61 @@ library
                       PostgREST.ApiRequest
                       PostgREST.ApiRequest.Preferences
                       PostgREST.ApiRequest.QueryParams
-                      PostgREST.ApiRequest.Payload
                       PostgREST.ApiRequest.Types
                       PostgREST.Response
                       PostgREST.Response.OpenAPI
                       PostgREST.Response.GucHeader
                       PostgREST.Response.Performance
-                      PostgREST.TimeIt
                       PostgREST.Version
+  other-modules:      Paths_postgrest
   build-depends:      base                      >= 4.9 && < 4.20
                     , HTTP                      >= 4000.3.7 && < 4000.5
                     , Ranged-sets               >= 0.3 && < 0.5
                     , aeson                     >= 2.0.3 && < 2.3
-                    , auto-update               >= 0.1.4 && < 0.3
+                    , auto-update               >= 0.1.4 && < 0.2
                     , base64-bytestring         >= 1 && < 1.3
                     , bytestring                >= 0.10.8 && < 0.13
+                    , cache                     >= 0.1.3 && < 0.2.0
                     , case-insensitive          >= 1.2 && < 1.3
                     , cassava                   >= 0.4.5 && < 0.6
-                    , configurator-pg           >= 0.2.11 && < 0.3
+                    , clock                     >= 0.8.3 && < 0.9.0
+                    , configurator-pg           >= 0.2 && < 0.3
                     , containers                >= 0.5.7 && < 0.7
-                    , cookie                    >= 0.4.2 && < 0.6
+                    , contravariant-extras      >= 0.3.3 && < 0.4
+                    , cookie                    >= 0.4.2 && < 0.5
                     , directory                 >= 1.2.6 && < 1.4
                     , either                    >= 4.4.1 && < 5.1
                     , extra                     >= 1.7.0 && < 2.0
                     , fuzzyset                  >= 0.2.4 && < 0.3
+                    , gitrev                    >= 1.2 && < 1.4
                     , hasql                     >= 1.6.1.1 && < 1.7
                     , hasql-dynamic-statements  >= 0.3.1 && < 0.4
                     , hasql-notifications       >= 0.2.2.2 && < 0.2.3
                     , hasql-pool                >= 1.0.1 && < 1.1
-                    , hasql-transaction         >= 1.0.1 && < 1.2
-                    , http-client               >= 0.7.19 && < 0.8
+                    , hasql-transaction         >= 1.0.1 && < 1.1
+                    , heredoc                   >= 0.2 && < 0.3
                     , http-types                >= 0.12.2 && < 0.13
                     , insert-ordered-containers >= 0.2.2 && < 0.3
-                    , jose-jwt                  >= 0.9.6 && < 0.11
-                    , lens                      >= 4.14 && < 5.4
+                    , interpolatedstring-perl6  >= 1 && < 1.1
+                    , jose                      >= 0.8.5.1 && < 0.12
+                    , lens                      >= 4.14 && < 5.3
                     , lens-aeson                >= 1.0.1 && < 1.3
                     , mtl                       >= 2.2.2 && < 2.4
-                    , neat-interpolation        >= 0.5 && < 0.6
-                    , network                   >= 2.6 && < 3.3
+                    , network                   >= 2.6 && < 3.2
                     , network-uri               >= 2.6.1 && < 2.8
                     , optparse-applicative      >= 0.13 && < 0.19
                     , parsec                    >= 3.1.11 && < 3.2
-                    -- Technically unused, can be removed after updating to hasql >= 1.7
                     , postgresql-libpq          >= 0.10
                     , prometheus-client         >= 1.1.1 && < 1.2.0
                     , protolude                 >= 0.3.1 && < 0.4
                     , regex-tdfa                >= 1.2.2 && < 1.4
                     , retry                     >= 0.7.4 && < 0.10
                     , scientific                >= 0.3.4 && < 0.4
-                    , streaming-commons         >= 0.2.3.1 && < 0.3
+                    , streaming-commons         >= 0.1.1 && < 0.3
                     , swagger2                  >= 2.4 && < 2.9
                     , text                      >= 1.2.2 && < 2.2
                     , time                      >= 1.6 && < 1.13
+                    , timeit                    >= 2.0 && < 2.1
                     , unordered-containers      >= 0.2.8 && < 0.3
                     , unix-compat               >= 0.5.4 && < 0.8
                     , vault                     >= 0.3.1.5 && < 0.4
@@ -152,11 +148,7 @@ library
                     -- for unix sockets; this is tested in test/io/test_io.py. See
                     -- https://github.com/kazu-yamamoto/logger/commit/3a71ca70afdbb93d4ecf0083eeba1fbbbcab3fc3
                     , wai-logger                >= 2.4.0
-                    , warp                      >= 3.3.19 && < 3.5
-                    , stm                       >= 2.5 && < 3
-                    , stm-hamt                  >= 1.2 && < 2
-                    , focus                     >= 1.0 && < 2
-                    , some                      >= 1.0.4.1 && < 2
+                    , warp                      >= 3.3.19 && < 3.4
                       -- -fno-spec-constr may help keep compile time memory use in check,
                       --   see https://gitlab.haskell.org/ghc/ghc/issues/16017#note_219304
                       -- -optP-Wno-nonportable-include-path
@@ -212,7 +204,7 @@ test-suite spec
                       Feature.Auth.AuthSpec
                       Feature.Auth.BinaryJwtSecretSpec
                       Feature.Auth.NoAnonSpec
-                      Feature.Auth.NoJwtSecretSpec
+                      Feature.Auth.NoJwtSpec
                       Feature.ConcurrentSpec
                       Feature.CorsSpec
                       Feature.ExtraSearchPathSpec
@@ -235,6 +227,7 @@ test-suite spec
                       Feature.Query.ErrorSpec
                       Feature.Query.InsertSpec
                       Feature.Query.JsonOperatorSpec
+                      Feature.Query.LimitedMutationSpec
                       Feature.Query.MultipleSchemaSpec
                       Feature.Query.NullsStripSpec
                       Feature.Query.PgSafeUpdateSpec
@@ -260,25 +253,23 @@ test-suite spec
                     , aeson             >= 2.0.3 && < 2.3
                     , aeson-qq          >= 0.8.1 && < 0.9
                     , async             >= 2.1.1 && < 2.3
+                    , auto-update       >= 0.1.4 && < 0.2
                     , base64-bytestring >= 1 && < 1.3
                     , bytestring        >= 0.10.8 && < 0.13
                     , case-insensitive  >= 1.2 && < 1.3
                     , containers        >= 0.5.7 && < 0.7
                     , hasql-pool        >= 1.0.1 && < 1.1
-                    , hasql-transaction >= 1.0.1 && < 1.2
+                    , hasql-transaction >= 1.0.1 && < 1.1
                     , heredoc           >= 0.2 && < 0.3
                     , hspec             >= 2.3 && < 2.12
-                    , hspec-expectations >= 0.8.4 && < 0.9
                     , hspec-wai         >= 0.10 && < 0.12
                     , hspec-wai-json    >= 0.10 && < 0.12
                     , http-types        >= 0.12.3 && < 0.13
-                    , jose-jwt          >= 0.9.6 && < 0.11
-                    , lens              >= 4.14 && < 5.4
+                    , lens              >= 4.14 && < 5.3
                     , lens-aeson        >= 1.0.1 && < 1.3
                     , monad-control     >= 1.0.1 && < 1.1
                     , postgrest
                     , process           >= 1.4.2 && < 1.7
-                    , prometheus-client >= 1.1.1 && < 1.2.0
                     , protolude         >= 0.3.1 && < 0.4
                     , regex-tdfa        >= 1.2.2 && < 1.4
                     , scientific        >= 0.3.4 && < 0.4
@@ -293,39 +284,6 @@ test-suite spec
                       -- https://github.com/PostgREST/postgrest/issues/387
                       -with-rtsopts=-K33K
 
-test-suite observability
-  type:               exitcode-stdio-1.0
-  default-language:   Haskell2010
-  default-extensions: OverloadedStrings
-                      QuasiQuotes
-                      NoImplicitPrelude
-  hs-source-dirs:     test/observability
-  main-is:            Main.hs
-  other-modules:      ObsHelper
-                      Observation.JwtCache
-                      Observation.MetricsSpec
-  build-depends:      base              >= 4.9 && < 4.20
-                    , base64-bytestring >= 1 && < 1.3
-                    , bytestring        >= 0.10.8 && < 0.13
-                    , hasql-pool        >= 1.0.1 && < 1.1
-                    , hasql-transaction >= 1.0.1 && < 1.2
-                    , hspec             >= 2.3 && < 2.12
-                    , hspec-expectations >= 0.8.4 && < 0.9
-                    , hspec-wai         >= 0.10 && < 0.12
-                    , hspec-wai-json    >= 0.10 && < 0.12
-                    , http-types        >= 0.12.3 && < 0.13
-                    , jose-jwt          >= 0.9.6 && < 0.11
-                    , postgrest
-                    , prometheus-client >= 1.1.1 && < 1.2.0
-                    , protolude         >= 0.3.1 && < 0.4
-                    , text              >= 1.2.2 && < 2.2
-                    , wai               >= 3.2.1 && < 3.3
-  ghc-options:        -threaded -O0 -Werror -Wall -fwarn-identities
-                      -fno-spec-constr -optP-Wno-nonportable-include-path
-                      -fwrite-ide-info
-                      -- https://github.com/PostgREST/postgrest/issues/387
-                      -with-rtsopts=-K33K
-
 test-suite doctests
   type:               exitcode-stdio-1.0
   default-language:   Haskell2010

shell.nix

@@ -7,6 +7,7 @@
 # We highly recommend that use the PostgREST binary cache by installing cachix
 # (https://app.cachix.org/) and running `cachix use postgrest`.
 { docker ? false
+, memory ? false
 }:
 let
   postgrest =
@@ -21,15 +22,15 @@ let
       postgrest.cabalTools
       postgrest.devTools
       postgrest.docs
-      postgrest.gitTools
       postgrest.loadtest
       postgrest.nixpkgsTools
-      postgrest.release
       postgrest.style
       postgrest.tests
       postgrest.withTools
+      postgrest.release
     ]
-    ++ lib.optional docker postgrest.docker;
+    ++ lib.optional docker postgrest.docker
+    ++ lib.optional memory postgrest.memory;
 
 in
 lib.overrideDerivation postgrest.env (

src/PostgREST/Admin.hs

@@ -1,3 +1,5 @@
+{-# LANGUAGE NamedFieldPuns #-}
+
 module PostgREST.Admin
   ( runAdmin
   ) where
@@ -7,35 +9,38 @@ import qualified Network.HTTP.Types.Status as HTTP
 import qualified Network.Wai               as Wai
 import qualified Network.Wai.Handler.Warp  as Warp
 
-import Control.Monad.Extra       (whenJust)
-import Network.Socket            hiding (addrFamily)
+import Control.Monad.Extra (whenJust)
+
+import qualified Data.ByteString.Lazy as LBS
+
+import Network.Socket
 import Network.Socket.ByteString
 
 import PostgREST.AppState    (AppState)
-import PostgREST.MediaType   (MediaType (..), toContentType)
+import PostgREST.Config      (AppConfig (..))
 import PostgREST.Metrics     (metricsToText)
-import PostgREST.Network     (resolveSocketToAddress)
 import PostgREST.Observation (Observation (..))
 
 import qualified PostgREST.AppState as AppState
+import qualified PostgREST.Config   as Config
 
-import qualified Network.Socket as NS
-import           Protolude
 
-runAdmin :: AppState -> Maybe NS.Socket -> NS.Socket -> Warp.Settings -> IO ()
-runAdmin appState maybeAdminSocket socketREST settings = do
-  whenJust maybeAdminSocket $ \adminSocket -> do
-    address <- resolveSocketToAddress adminSocket
-    observer $ AdminStartObs address
+import Protolude
+
+runAdmin :: AppState -> Warp.Settings -> IO ()
+runAdmin appState settings = do
+  AppConfig{configAdminServerPort} <- AppState.getConfig appState
+  whenJust (AppState.getSocketAdmin appState) $ \adminSocket -> do
+    observer $ AdminStartObs configAdminServerPort
     void . forkIO $ Warp.runSettingsSocket settings adminSocket adminApp
   where
-    adminApp = admin appState socketREST
+    adminApp = admin appState
     observer = AppState.getObserver appState
 
 -- | PostgREST admin application
-admin :: AppState.AppState -> NS.Socket -> Wai.Application
-admin appState socketREST req respond  = do
-  isMainAppReachable  <- isRight <$> reachMainApp socketREST
+admin :: AppState.AppState -> Wai.Application
+admin appState req respond  = do
+  isMainAppReachable  <- isRight <$> reachMainApp (AppState.getSocketREST appState)
   isLoaded <- AppState.isLoaded appState
   isPending <- AppState.isPending appState
 
@@ -50,12 +55,18 @@ admin appState socketREST req respond  = do
                | otherwise              = HTTP.status500
       in
       respond $ Wai.responseLBS status [] mempty
+    ["config"] -> do
+      config@Config.AppConfig{configAdminServerConfigEnabled} <- AppState.getConfig appState
+      if configAdminServerConfigEnabled then
+        respond $ Wai.responseLBS HTTP.status200 [] (LBS.fromStrict $ encodeUtf8 $ Config.toText config)
+      else
+        respond $ Wai.responseLBS HTTP.status404 [] mempty
     ["schema_cache"] -> do
       sCache <- AppState.getSchemaCache appState
       respond $ Wai.responseLBS HTTP.status200 [] (maybe mempty JSON.encode sCache)
     ["metrics"] -> do
       mets <- metricsToText
-      respond $ Wai.responseLBS HTTP.status200 [toContentType MTTextPlain] mets -- Content-Type is required for prometheus compliance
+      respond $ Wai.responseLBS HTTP.status200 [] mets
     _ ->
       respond $ Wai.responseLBS HTTP.status404 [] mempty