Prepare v1.4.2: retract the upstream tags and write the changelog entry

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,7 +7,7 @@ body:
   attributes:
     label: Versions
     description: sqlx, Go, the driver and the database, each with its version
-    placeholder: sqlx v1.4.1, go1.27.2, lib/pq v1.10.9, PostgreSQL 16
+    placeholder: sqlx v1.4.2, go1.27.2, lib/pq v1.10.9, PostgreSQL 16
   validations:
     required: true
 - type: textarea

CHANGELOG.md

@@ -4,7 +4,11 @@ Notable changes to this fork, newest first. An entry that imports an upstream
 pull request names its number and author. Releases up to v1.4.0 are releases of
 upstream [jmoiron/sqlx](https://github.com/jmoiron/sqlx).
 
-## Unreleased
+## v1.4.2 (2026-10-19)
+
+No API change. sqlx's `go.mod` now requires no other module, so importing sqlx
+no longer changes which database driver versions a program builds with, and the
+upstream tags that came with the fork's history are retracted.
 
 ### Module and toolchain
 
@@ -15,7 +19,25 @@ upstream [jmoiron/sqlx](https://github.com/jmoiron/sqlx).
   minimum version selection raised a consumer's own MySQL driver to v1.10.1
   even though sqlx only used it in tests (upstream #642, #569, #849). The
   checks in three tests that read the unexported `unsafe` field now test its
-  effect instead: scanning into a struct that lacks some selected columns.
+  effect instead: scanning into a struct that lacks some selected columns
+  (#34).
+- v1.2.0 to v1.4.0 are retracted under this module path. They are upstream's
+  tags, pushed with the history; their `go.mod` declares
+  `github.com/jmoiron/sqlx`, so `go get github.com/secondwindoss/sqlx@v1.4.0`
+  failed with a module path error. `go list -m -versions` now lists only the
+  fork's own releases (#35).
+
+### Project
+
+- Release tags are signed; GitHub shows them as verified.
+- An OpenSSF Scorecard workflow publishes the repository's score, shown as a
+  README badge; CI actions are pinned by commit SHA; Go fuzz tests cover the
+  SQL scanner, `Rebind`, `compileNamedQuery` and `In`, and their seed corpus
+  runs with the unit tests (#32, #33). CodeQL scans every pull request, and
+  merging into `master` requires the CI checks to pass.
+- The README is rewritten around the fork, with a migration section that
+  explains why a `replace` directive cannot stand in for the import rewrite
+  (#28, #29, #30).
 
 ## v1.4.1 (2026-10-10)
 

README.md

@@ -41,15 +41,15 @@ and go from query to struct in one call with `Get` and `Select`.
 
 |                    | jmoiron/sqlx                 | secondwindoss/sqlx                |
 |--------------------|------------------------------|-----------------------------------|
-| Last release       | v1.4.0, April 2024           | v1.4.1, October 2026              |
+| Last release       | v1.4.0, April 2024           | v1.4.2, October 2026              |
 | Last commit        | May 2024                     | active                            |
 | Open pull requests | 79 (October 2026)            | 0, the fixes are merged           |
 | Go support         | `go 1.10`, untested          | Go 1.24 and newer, tested         |
 | API                |                              | identical, checked by `apidiff`   |
 
 ## Quick start
 
-    go get github.com/secondwindoss/sqlx@v1.4.1
+    go get github.com/secondwindoss/sqlx@v1.4.2
 
 sqlx requires Go 1.24 or newer.
 
@@ -109,19 +109,20 @@ Rewrite the import path, then update the dependency.
 macOS:
 
     grep -rl 'github.com/jmoiron/sqlx' --include='*.go' . | xargs sed -i '' 's#github.com/jmoiron/sqlx#github.com/secondwindoss/sqlx#g'
-    go get github.com/secondwindoss/sqlx@v1.4.1
+    go get github.com/secondwindoss/sqlx@v1.4.2
     go mod tidy
 
 Linux:
 
     grep -rl 'github.com/jmoiron/sqlx' --include='*.go' . | xargs sed -i 's#github.com/jmoiron/sqlx#github.com/secondwindoss/sqlx#g'
-    go get github.com/secondwindoss/sqlx@v1.4.1
+    go get github.com/secondwindoss/sqlx@v1.4.2
     go mod tidy
 
 Tags up to v1.4.0 are upstream's and declare the upstream module path, so
-v1.4.1 is the first version that resolves under the new path.
+v1.4.1 is the first version that resolves under the new path; v1.4.2 retracts
+the older tags so the go command no longer offers them.
 
-A `replace github.com/jmoiron/sqlx => github.com/secondwindoss/sqlx v1.4.1`
+A `replace github.com/jmoiron/sqlx => github.com/secondwindoss/sqlx v1.4.2`
 directive does not work: the fork imports its own `reflectx` package under
 the new path, and Go refuses to use one module under two paths. Rewrite the
 imports instead.

go.mod

@@ -1,3 +1,7 @@
 module github.com/secondwindoss/sqlx
 
 go 1.24.0
+
+// Upstream jmoiron/sqlx tags that came with the fork's history. Their go.mod
+// declares github.com/jmoiron/sqlx, so they cannot be used under this path.
+retract [v1.2.0, v1.4.0]