Without a least-privilege read-only role, read mode runs as the app role and relies on the classifier (H2 / generic) or a READ ONLY transaction that still allows side-effecting functions (Postgres). Also records the security fixes in the CHANGELOG. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>