# Neon serverless driver: what changed from 0 to 1

- Product: Neon serverless driver (https://whatsnew.fyi/product/neon-serverless-driver)
- Vendor: Neon
- Range: changelog entries numbered after 0.10.4 up to and including 1.1.0, stable releases only
- Entries below: 4 releases (newest first)
- Resolved: 0 is 0.10.4 and 1 is 1.1.0, the newest stable release of each major we track
- Carrying security changes: 0 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/neon-serverless-driver/compare/0...1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (10 changes, grouped by kind)

### Added

#### 1.0.1 (2025-06-06)

- Add disableWarningInBrowsers configuration option to suppress security warning in web browsers

#### 1.0.0 (2025-03-25)

- HTTP template function now has a query() property for manually parameterized queries
- HTTP template function now has an unsafe() property to interpolate trusted arbitrary string values

### Changed

#### 1.1.0 (2026-04-17)

- Type declarations are now fully inlined instead of re-exported from @types/pg and @types/node
- Package size with dependencies is reduced
- Buffer-specific types in some places are now declared as Uint8Array

#### 1.0.1 (2025-06-06)

- Print a security warning to the console when a connection is made in a web browser

#### 1.0.0 (2025-03-25)

- HTTP template queries are now fully composable, including those with parameters, with lazy compilation to raw SQL at query time
- Minimum supported Node version is now v19

### Removed

#### 1.0.0 (2025-03-25)

- HTTP query template function can no longer be called as a conventional function, only as a template function

_One release carries no categorized changes yet: 1.0.2._

## Release notes

### 1.1.0

- Date: 2026-04-17
- Version: 1.1.0
- Original notes: https://www.npmjs.com/package/@neondatabase/serverless/v/1.1.0
- Permalink: https://whatsnew.fyi/product/neon-serverless-driver/releases/1.1.0

- **changed** — Type declarations are now fully inlined instead of re-exported from @types/pg and @types/node
- **changed** — Package size with dependencies is reduced
- **changed** — Buffer-specific types in some places are now declared as Uint8Array

Type declarations are now fully inlined (some were previously re-exported from `@types/pg` and `@types/node`). The new types greatly reduce the size of the package with dependencies, and should be compatible in normal usage. The code that is actually run remains unchanged.

A few advanced type-level patterns could be affected. Code that depends on exact type identity with the `@types/pg` exports, that relies on `declare module 'pg'` augmentation flowing through these exports, or that assumes `Buffer`-specific types in places now declared as `Uint8Array` may need updated types.

### 1.0.2

- Date: 2025-09-30
- Version: 1.0.2
- Original notes: https://www.npmjs.com/package/@neondatabase/serverless/v/1.0.2
- Permalink: https://whatsnew.fyi/product/neon-serverless-driver/releases/1.0.2

Update neon.tech references to neon.com domain.

### 1.0.1

- Date: 2025-06-06
- Version: 1.0.1
- Original notes: https://www.npmjs.com/package/@neondatabase/serverless/v/1.0.1
- Permalink: https://whatsnew.fyi/product/neon-serverless-driver/releases/1.0.1

- **added** — Add disableWarningInBrowsers configuration option to suppress security warning in web browsers
- **changed** — Print a security warning to the console when a connection is made in a web browser

The package now prints a security warning to the console when a connection is made in a web browser. This behaviour can be suppressed with a new configuration option: `disableWarningInBrowsers`. There are a few other very minor fixes.

### 1.0.0

- Date: 2025-03-25
- Version: 1.0.0
- Original notes: https://www.npmjs.com/package/@neondatabase/serverless/v/1.0.0
- Permalink: https://whatsnew.fyi/product/neon-serverless-driver/releases/1.0.0

- **removed** — HTTP query template function can no longer be called as a conventional function, only as a template function
- **added** — HTTP template function now has a query() property for manually parameterized queries
- **added** — HTTP template function now has an unsafe() property to interpolate trusted arbitrary string values
- **changed** — HTTP template queries are now fully composable, including those with parameters, with lazy compilation to raw SQL at query time
- **changed** — Minimum supported Node version is now v19

Breaking change: the HTTP query template function can now **only** be called as a template function, not as a conventional function. This improves safety from accidental SQL-injection vulnerabilities. For example:

```js
import { neon } from '@neondatabase/serverless';
const sql = neon(process.env.DATABASE_URL);
const id = 1;

// this is safe and convenient, as before
const result = await sql`SELECT * FROM table WHERE id = ${id}`;

// this looks very similar and was previously allowed, but was open to SQL
// injection attacks because it uses ordinary string interpolation -- it's now
// both a TypeScript type error and a runtime error
const throws = await sql(`SELECT * FROM table WHERE id = ${id}`);
```

To fill the gap left by this change, the template function has two new properties: a `query()` function that allows manually parameterized queries, and an `unsafe()` function that lets you interpolate trusted arbitrary string values. For example:

```js
// this was previously allowed, and was safe, but is now also an error so as to
// prevent the vulnerability seen above
const throws = await sql('SELECT * FROM table WHERE id = $1', [id]);

// the `query()` function is the new way to manually specify placeholders and
// values (the same way it's done by `client.query()` and `pool.query()`)
const result = await sql.query('SELECT * FROM table WHERE id = $1', [id]);

// to interpolate strings like column or table names, **only** if you know
// they're safe, use the `unsafe()` function
const table = condition ? 'table1' : 'table2'; // known-safe string values
const result = await sql`SELECT * FROM ${sql.unsafe(table)} WHERE id = ${id}`;

// but in the above case, you might prefer to do this instead
const table = condition ? sql`table1` : sql`table2`;
const result = await sql`SELECT * FROM ${table} WHERE id = ${id}`;
```

In addition, HTTP template queries are now fully composable, including those with parameters. For example:

```js
const name = 'Olivia';
const limit = 1;
const whereClause = sql`WHERE name = ${name}`;
const limitClause = sql`LIMIT ${limit}`;

// compilation to raw SQL now happens lazily, at query time, so that parameter
// placeholders can be numbered appropriately
const result = await sql`SELECT * FROM table ${whereClause} ${limitClause}`;
```

The minimum supported version of Node is now v19 (this avoids having to do dynamic `crypto` imports, which can cause trouble with bundlers).

Lastly: the repository has been rearranged and refactored, `.d.ts` files are now generated automatically, packages are published via `npm version`, and comprehensive tests have been put in place. This should ease the way for future enhancements and contributions.