3ngram 1.8.7

3ngram v1.8.7

Patch: the database and HTTP runtime pins move to their newest releases past
the 7-day cooldown, and every request body that body-parser rejects now gets
its client error instead of a 500.

Changes

• Rejected request bodies are client errors (#312, resolves #301).
  express.json() runs before any route, and only a malformed JSON body was
  mapped to 400 invalid_request; an oversized body or an unsupported
  content encoding fell through to 500 internal_error and an unhandled-error
  log line. A body over the 100 KB default limit now returns 413
  payload_too_large, an unsupported Content-Encoding or charset returns
  415 unsupported_media_type, and a corrupt or truncated compressed body
  returns 400 invalid_request. Each is logged at warn with the status and
  body-parser type only, never the body. /mcp, /api/v1 and the
  form-encoded OAuth endpoints share the handler.

• drizzle-orm 0.45.4, pg 8.23.1, hono 4.13.13 (#303). drizzle-orm
  0.45.3 adds a Netlify DB driver entry point and 0.45.4 fixes explicit
  .prepare(name) on the postgres-js driver; the node-postgres driver
  this engine uses is unchanged. pg 8.22/8.23 add opt-in direct SSL
  negotiation and query pipelining (both off unless configured), rewrite the
  Bind serializer, warn on an invalid Date parameter, and surface a socket
  reset on a pooled client as ECONNRESET instead of a later "Connection
  terminated unexpectedly". withTenant()'s set_config(..., true) path,
  pg-pool 3.14.0 and the ssl default are unchanged. hono 4.13.12/13
  are fixes in modules the engine does not import; the pin governs the copy
  @modelcontextprotocol/node pulls in.

• express 5.3.0 (#311). res.send() no longer adds Content-Length
  when Transfer-Encoding is already set, req.fresh revalidates QUERY
  requests, HTML redirect bodies gain a doctype and title, and
  content-type moves to 2.0 (faster parser; res.send() keeps existing
  Content-Type parameters when it appends the charset and no longer throws
  on an unparsable Content-Type) with type-is 2.1 and
  content-disposition 2.0.1. No route or error-handling behaviour changes.

• CI: the unused Turbo remote cache wiring is gone and the cache is
  disabled explicitly (#308). No published output changes.

Compatibility

• Runtime pin lockstep. Consumers that pin drizzle-orm, pg, hono or
  express exactly next to @3ngram/db or @3ngram/server must move to
  0.45.4, 8.23.1, 4.13.13 and 5.3.0 together. @3ngram/db pins drizzle-orm
  and pg exactly, and a second drizzle-orm copy fails to typecheck against
  the engine's table types; @3ngram/server pins express exactly, and a
  consumer that mounts its own routers into the engine app must share that
  one copy.
• New error codes. Clients that switch on the JSON error field may see
  payload_too_large (413) and unsupported_media_type (415) where they
  previously received internal_error (500).

Operations

No migration and no configuration change.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:051b47f94fb8c5dd670b3c209e75e6ef71b4a96c62d99427a675f0a537986792