What's new in v0.31.3
v0.31.3 is about SQL text that reached a template it should never have reached. The normalizer replaces every literal with ? so that WHERE id = 1 and WHERE id = 2 group as one statement, and three literal forms slipped past it. A quote escaped with a backslash closed its string early, so in WHERE name = 'it\'s secret data' the words after the apostrophe stayed in the template, and from there in the reports, the query API, the archive and PerfSentinelHub. A hexadecimal number and a number with an exponent were cut at their x or e, so each value got a template of its own and an N+1 over them never formed.
A backslash read the way the engine reads it
Whether \' escapes a quote depends on the engine. MySQL and MariaDB escape with a backslash in every string, in both quote styles, and so do ClickHouse, Snowflake or BigQuery. PostgreSQL does not by default: with standard_conforming_strings on, 'C:\' is a complete string, and only an E'...' string honours the escape. SQL Server, Oracle, DB2 and SQLite never do. The normalizer now picks the reading from the span's db.system: the engines whose strings follow the standard keep the backslash as an ordinary character, PostgreSQL, CockroachDB and Vertica outside E'...', and every other engine escapes. A span that names no engine, such as native JSON whose operation holds the SQL verb, gets the escaping reading. When the dialect is unknown, a missed escape leaks the rest of a string, while a wrong one only masks more than needed. pg-stat now normalizes as PostgreSQL.
One placeholder for 0x1F2A and 2.5e-3
A number now carries on through a 0x followed by hex digits, and through an e or E followed by an optional sign and digits. 0x1F2A, 1e10 and 2.5e-3 each become one ?, so the statements that only differ by such a value group again. An e with no digit after it is still text, and col1e is still an identifier.
Tested without a corpus
Each form has unit tests next to the tokenizer. The metamorphic suite now generates hex and exponent literals and backslash-escaped strings, with a property for each reading of the backslash, and the fuzz target checks that a PostgreSQL template is a fixed point too. In the simulation lab, the sql-backtick-redaction scenario gained four OTLP traces, one per form, that each give one N+1 with no string content in the JSON and SARIF output. They fail six checks on v0.31.2 and pass on this release. A daemon image built from this release also passed validate-findings 12/12, pg-stat on its file and Prometheus paths, mysql-stat, the hybrid daemon-to-HTML scenario, CI shift-left and output-formats-coverage.
Upgrade impact
- Findings on such queries change template and signature. A finding whose template held a backslash-escaped string, a hex number or a number with an exponent gets a new signature, so its acknowledgment no longer matches and has to be made again. Detection groups by template, so queries that split into one template per value now group, and an N+1 that only varied by such a value now shows up.
- On an engine the event does not name, a string that ends on a backslash masks the rest of the statement.
'C:\'in native JSON now runs to the end of the statement instead of closing on its second quote. A span that carries itsdb.systemis read by its engine's rules. - The toolchain moves to Rust 1.99.1, and MSRV with it.
- No configuration key is added or removed, no route, metric or wire format changes, the public API of
perf-sentinel-coredoes not change shape, and the embedded reference data keeps its vintages.
Full detail in CHANGELOG.md.
Verifying this release
# Binary integrity via SLSA build provenance attestation (Build Level 2)
gh attestation verify perf-sentinel-linux-amd64 \
--repo Institut-du-Numerique-Responsable/perf-sentinel
# A periodic disclosure produced by this binary, with its attestation and bundle
perf-sentinel verify-hash --report perf-sentinel-report.json \
--attestation perf-sentinel-report.intoto.jsonl --bundle perf-sentinel-report.sig \
--expected-identity "https://github.com/Institut-du-Numerique-Responsable/perf-sentinel/.github/workflows/release.yml@refs/tags/v0.31.3" \
--expected-issuer "https://token.actions.githubusercontent.com" \
--verify-binary ./perf-sentinel-linux-amd64gh CLI 2.49 or newer required for gh attestation verify. Releases up to v0.26.2 were attested under robintra/perf-sentinel and keep their own --repo and identity.