QueryAPIGate is pre-1.0 and already keeps a written compatibility promise. Here is what it covers, which versions are supported, and how a change reaches you before it reaches your deployment.
REST endpoints and response shapes, CLI commands and flags, environment variables, the on-disk storage format, API-key and role grant fields, the saved-query format, the MCP tool contract, and error codes.
The Console's internal markup, exact wording of messages and log lines, and Python modules not re-exported from queryapigate.
Outside the promise until they graduate. Today: H2, JDBC and MongoDB connections, OpenTelemetry tracing, and secrets and credentials from AWS. Live events and secrets from files and Vault graduated in 0.34. Marked in the docs, in /openapi.json, in the Console and in the startup log.
{{ patchEx }}Never breaks a covered surface. Fixes and security fixes.
Safe to take{{ minorEx }}Before 1.0, may break a covered surface, rarely, and always under its own Breaking note in the changelog. Never silently.
Read Breaking firstsemverSemantic versioning: breaking changes only in a major release.
Coming with 1.0Only once its successor ships: a Deprecated note in the changelog and a callout in the docs.
A Deprecation header (RFC 9745) and a Link: rel="successor-version" header on every response, deprecated: true in OpenAPI, and a log warning on first use.
Before 1.0, no sooner than the next minor release; from 1.0, not before the next major. Always listed under Breaking.
Security fixes are made against the latest released version, announced under Security in the changelog. Upgrading is designed to be routine: see below.
Trust center →Each Python version is supported until its upstream end of life; CI runs 3.11, 3.12, 3.13 and 3.14. Dropping one is a minor release, called out under Breaking.
Tier 1, under the promise: PostgreSQL, MySQL, SQLite, DuckDB and ClickHouse, each tested against the real database. Experimental: H2, generic JDBC and MongoDB, with the gaps the support matrix lists.
CI runs the suite on the lowest version allowed of every core dependency and of the mcp, jwt and redis extras, so a minimum in the package metadata is one that actually works.
Open an issue on GitHub. Include the version (queryapigate --version or /health) and the request id from the response's X-Request-Id.
Privately, through GitHub's Report a vulnerability form. Never in a public issue.
Report a vulnerability →Fixes, guides and new connection types are welcome. The contributing guide covers the tests, the release process and how features graduate.
Contributing guide →