V0.6.1

.github/ISSUE_TEMPLATE/database-feedback.yml

@@ -13,7 +13,7 @@ body:
     attributes:
       label: safe-migrate version
       description: Paste the output of `safe-migrate --version`.
-      placeholder: safe-migrate 0.6.0
+      placeholder: safe-migrate 0.6.1
     validations:
       required: true
 

CHANGELOG.md

@@ -5,6 +5,18 @@ commits and pull requests. Published binaries, checksums, and generated release
 notes are available on the
 [GitHub Releases page](https://github.com/dsecurity49/safe-migrate/releases).
 
+## v0.6.1 — 2026-08-26
+
+- Upgraded the exactly pinned Squawk parser stack from 2.62.0 to 2.63.0 and
+  migrated statement extraction to its typed AST children for transaction,
+  schema, table, view, sequence, routine, replication, privilege, and session
+  statements.
+- Adopted Squawk's stricter validation for malformed `IN`/`NOT IN`, empty
+  tuples, and `OVERLAPS` expressions, plus its corrected compound-select
+  precedence and trailing-clause parsing.
+- Added focused regressions for every affected extraction family and the new
+  parser-validation behavior.
+
 ## v0.6.0 — 2026-08-22
 
 - Expanded `sync` and Cache V6 to record effective migration timeouts, every

CONTRIBUTING.md

@@ -129,7 +129,7 @@ Use the pinned Squawk source and grammar when changing AST extraction:
 5. test resolver, state, and rule effects when behavior crosses layers;
 6. represent unsupported parser behavior explicitly.
 
-A Squawk version upgrade is an AST migration. Update all three pinned Squawk
+A Squawk version upgrade is an AST migration. Update all four pinned Squawk
 crates together and validate the full extraction surface through compilation and
 tests.
 

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "safe-migrate"
-version = "0.6.0"
+version = "0.6.1"
 edition = "2024"
 rust-version = "1.94"
 description = "Sync PostgreSQL metadata, then lint migrations offline"
@@ -14,10 +14,10 @@ keywords = ["postgres", "migration", "linter", "ast", "database"]
 categories = ["command-line-utilities", "database"]
 
 [dependencies]
-squawk-syntax = "=2.62.0"
-squawk-lexer  = "=2.62.0"
-squawk-parser = "=2.62.0"
-squawk-linter = "=2.62.0"
+squawk-syntax = "=2.63.0"
+squawk-lexer  = "=2.63.0"
+squawk-parser = "=2.63.0"
+squawk-linter = "=2.63.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 toml = "0.8"

README.md

@@ -310,7 +310,7 @@ and GitHub cache contents are not signed. Store a 64-character hexadecimal key
 as `SAFE_MIGRATE_CACHE_KEY` and pass it to both workflows.
 
 ```yaml
-- uses: dsecurity49/safe-migrate@v0.6.0
+- uses: dsecurity49/safe-migrate@v0.6.1
   env:
     DATABASE_URL: ${{ secrets.SAFE_MIGRATE_DATABASE_URL }}
     SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
@@ -329,7 +329,7 @@ Replace `public` with the schemas that contain your migrations, or omit
 Add this after checkout in the pull-request workflow:
 
 ```yaml
-- uses: dsecurity49/safe-migrate@v0.6.0
+- uses: dsecurity49/safe-migrate@v0.6.1
   env:
     SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
   with:

docs/CONTRACT.md

@@ -1,6 +1,6 @@
 # CLI and Report Contract
 
-This document defines safe-migrate v0.6.0's CLI, report, cache, and GitHub
+This document defines safe-migrate v0.6.1's CLI, report, cache, and GitHub
 Action behavior.
 
 If you are learning safe-migrate, start with the [README](../README.md). This

docs/GITHUB_ACTIONS.md

@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.0
+      - uses: dsecurity49/safe-migrate@v0.6.1
         env:
           SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}
         with:
@@ -83,7 +83,7 @@ explicitly.
 In a trusted branch job, pass the checked-out file directly:
 
 ```yaml
-      - uses: dsecurity49/safe-migrate@v0.6.0
+      - uses: dsecurity49/safe-migrate@v0.6.1
         with:
           path: migrations
           config: safe-migrate.toml
@@ -107,7 +107,7 @@ separately:
           sparse-checkout-cone-mode: false
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.0
+      - uses: dsecurity49/safe-migrate@v0.6.1
         with:
           path: migrations
           config: .safe-migrate-base/safe-migrate.toml
@@ -153,7 +153,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dsecurity49/safe-migrate@v0.6.0
+      - uses: dsecurity49/safe-migrate@v0.6.1
         env:
           DATABASE_URL: ${{ secrets.SAFE_MIGRATE_DATABASE_URL }}
           SAFE_MIGRATE_CACHE_KEY: ${{ secrets.SAFE_MIGRATE_CACHE_KEY }}

scripts/test-action-contract

@@ -9,7 +9,7 @@ baseline="$repo_root/scripts/action-baseline"
 manifest="$repo_root/action.yml"
 workflow="$repo_root/.github/workflows/ci.yml"
 
-test "$(/bin/sh "$resolver" v0.6.0 "$repo_root/Cargo.toml")" = v0.6.0
+test "$(/bin/sh "$resolver" v0.6.1 "$repo_root/Cargo.toml")" = v0.6.1
 test "$(/bin/sh "$resolver" 0123456789abcdef0123456789abcdef01234567 "$repo_root/Cargo.toml")" = source
 
 if /bin/sh "$resolver" main "$repo_root/Cargo.toml" >/dev/null 2>&1; then