pig v1.8.1

Pig v1.8.1 is a safety, correctness, and maintenance release on top of v1.8.0. It hardens command initialization, privileged log access, repository and build workflows, release integrity, and structured-output redaction. It also refreshes the embedded extension catalog and moves the build toolchain to Go 1.27.1 and cargo-pgrx 0.19.2. The embedded Pigsty version remains 4.5.0.

CLI safety and correctness

• Read-only and configuration-independent commands no longer require a writable HOME or create ~/.pig as a side effect. Leaf commands preserve their declared initialization policy.
• pig pg log, pig pt log, and pig pb log preserve arguments through sudo execution as the database OS user and reject unsafe log-file links.
• pig do validates Pigsty names and rejects reserved Ansible cluster targets before execution.
• Native PostgreSQL role detection is bound to the selected instance rather than an unrelated local default.
• Structured results redact credentials, license material, and build-proxy identifiers while retaining truthful command failure.

Repository and build hardening

• Repository add and remove operations now fail when any requested operation fails, deduplicate module selections, and preserve replacement boundaries.
• Offline cache bundles reject unsafe paths, links, special files, and incomplete inputs; archive extraction remains rooted and fail-closed. The obsolete exported cache wrapper was removed after production moved to the structured result path.
• Build source and artifact validation rejects incomplete or unsafe inputs. pig build proxy uses the package-provided service contract, treats its operands as optional, and keeps secret identifiers out of structured output.
• Self-update verifies release checksums, and release tooling refuses dirty or mismatched-tag publication and immutable artifact replacement.

Toolchain and catalog

• Go is updated to 1.27.1; Logrus to 1.10.2; GoReleaser to 2.18.0; and golangci-lint to 2.13.2.
• pig build pgrx now installs cargo-pgrx 0.19.2 by default. Use -v when an extension requires an older pgrx line recorded in its catalog metadata.
• The embedded catalog is refreshed from the maintained pgext view. It adds acdat 0.1.0, marks the superseded pgcontext_pgvector entry removed, and updates package versions, repository ownership, PostgreSQL coverage, and availability matrices.

Verification

The release is built from source commit e3d1eb4. The exact commit passed the full CI workflow, including randomized tests, command race regressions, vet, static analysis, dead-code detection, vulnerability scanning, and a GoReleaser snapshot. The tag then passed the Release workflow, which produced the published RPM, DEB, macOS, and Linux artifacts.

Compatibility notes

• No CLI command or flag is removed in this release.
• Scripts that previously depended on read-only commands creating local configuration should create that state explicitly instead.
• The pgrx default changes to 0.19.2; extension-specific metadata remains authoritative when a build requires another pgrx version.

Checksums