chore: upgrade fork to upstream pg@8.20.0 by avallete · Pull Request #29 · supabase/node-postgres

avallete · 2026-05-11T14:35:26Z

Summary

Bring the fork up to upstream pg@8.20.0 / pg-protocol@1.13.0 (and the matching upstream tree for the rest of the monorepo) while preserving the two Supabase-specific changes that downstream consumers depend on. Built on top of upstream's tag rather than via a merge to avoid a conflict storm with the parser refactor and the var → let/const migration.

What's in this PR

Branch starts at upstream tag pg@8.20.0 (commit c9070cc8) and adds five commits:

chore: rebrand packages to @supabase scope — root, pg, pg-protocol package names + repo URLs; pg → pg-protocol dep moves to npm:@supabase/pg-protocol@^1.13.0
ci: replace upstream test workflow with @supabase publish workflows — drops ci.yml; restores deploy-pg.yml and deploy-pg-protocol.yml (trusted publishing, no NPM_TOKEN); bumps node to 20
feat: add maxResultSize limit — re-applies the RESULT_SIZE_EXCEEDED feature on top of upstream's refactored connection.js / client.js / defaults.js / native/* + the 131-line integration test. JS path uses a per-message dispatcher (no overhead when the limit is unset); native path uses post-result accounting + re-emits the error on client.native.connection
fix(pg-protocol): bubble up parser error avoid uncatchable exception — wraps the handlePacket switch in a try/catch so malformed protocol bytes surface as a DatabaseError through the normal callback path instead of crashing the host process; releases the buffer reader on every exit path
chore: incorporate prior fork history (ours) — merge -s ours origin/master so this PR can land without force-push. The branch tree is unchanged; master's 33 obsolete chore commits stay reachable in git ancestry but no longer affect any file

Re-applied feature commits are byte-for-byte equivalent to the originals (0e786d23, 88c9a2da) modulo the necessary adjustments for upstream's refactored signatures (parser is no longer a single class with all parse* methods inline; var → const/let etc.).

What gets dropped

Everything that lives only in master today and is now obsolete:

All dependabot bumps (superseded by upstream's newer deps)
Manual scoped-name rebrand commits (folded into commit 1 above)
Built dist/ artifacts that used to be committed (upstream's .gitignore already excludes them and trusted publishing builds during the workflow)

What gets republished

@supabase/pg@8.20.0 (was 0.0.3) — version aligns 1:1 with upstream so consumers can reason about exactly which upstream release they're on
@supabase/pg-protocol@1.13.0 (was 0.0.2) — same reasoning

Trigger is path-based and automatic: the merge commit modifies both packages/pg/** and packages/pg-protocol/**, so both deploy-pg.yml and deploy-pg-protocol.yml will run on push to master.

Test plan

pg-protocol builds cleanly (verified in isolation since the npm:@supabase/pg-protocol@^1.13.0 alias only resolves post-publish — same chicken-and-egg as the existing fork)
All 74 pg-protocol unit tests pass (mocha 'dist/**/*.test.js')
All 5 modified pg/lib/*.js files pass node --check
Branch is a strict descendant of origin/master (git merge-base origin/master HEAD == origin/master)
merge -s ours produced no tree change (git diff <pre-merge> HEAD is empty)
Post-publish: postgres-meta test suite (incl. result-size-limit.ts) runs against the new @supabase/pg@8.20.0 — separate PR in the postgres-meta repo

Downstream follow-up (separate PR, postgres-meta repo)

postgres-meta/package.json lines 55 / 58 → bump to npm:@supabase/pg@8.20.0 / npm:@supabase/pg-protocol@1.13.0 and re-run result-size-limit.ts.

Fixes PGMETA-95

Throwing error will not allow "finally" execution, so client.release() must be invoked before it.

…anc#3412) Bumps [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) from 5.1.2 to 5.2.5. - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/main/CHANGELOG.md) - [Commits](prettier/eslint-plugin-prettier@v5.1.2...v5.2.5) --- updated-dependencies: - dependency-name: eslint-plugin-prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

This reverts commit dcb4257. The change doesn’t fix the bug it claims to (`finally` always runs) and introduces a resource leak if the `ROLLBACK` query fails. The related bug that a broken client can be returned to the pool remains unaffected either way.

Two new functions are introduced to make it easy for TypeScript users to use a PostgresSQL connection string with pg Client. Fixes brianc#2280

…rianc#3419) This hid the error fixed in brianc#3263, for example.

Allows user to change the semantics of `sslmode` to be as close as possible to libpq semantics. The opt in can be enabled using `useLibpqCompat` parsing option or the non-standard `uselibpqcompat` query string parameter. --------- Co-authored-by: Charmander <~@charmander.me> Co-authored-by: Herman J. Radtke III <herman@hermanradtke.com>

* build: add esm exports * fix: add defaults as per arethetypeswrong report * fix: add missing types * lint * Fix broken tests * Add (failing) test for esm compat * Begin moving files to proper extension and adding tests * Add tests for connection-string and fix cloudflare module type and esm compat * Add query-stream and cursor as esm exports * Update PR copilot review * Publish - pg-cloudflare@1.1.2-alpha.0 - pg-connection-string@2.7.1-alpha.0 - pg-cursor@2.13.2-alpha.0 - pg-esm-test@1.0.1-alpha.0 - pg-native@3.3.1-alpha.0 - pg-pool@3.8.1-alpha.0 - pg-protocol@1.8.1-alpha.0 - pg-query-stream@4.8.2-alpha.0 - pg@8.14.2-alpha.0 * More cf compat work * Publish - pg-cloudflare@1.1.2-alpha.1 - pg-cursor@2.13.2-alpha.1 - pg-esm-test@1.0.1-alpha.1 - pg-pool@3.8.1-alpha.1 - pg-query-stream@4.8.2-alpha.1 - pg@8.14.2-alpha.1 * Add more cf compat and update tests * Make tests pass - update exports for esm * Use env vars for test connection in cf tests * Fix lint * Fit vitest into existing legacy framework * Skip worker tests on node below 18 * Revert doc changes for now * Remove legacy worker test in favor of vitest --------- Co-authored-by: Luca Ban <mesqueeb@users.noreply.github.com>

- pg-cloudflare@1.2.0 - pg-connection-string@2.8.0 - pg-cursor@2.14.0 - pg-esm-test@1.1.0 - pg-native@3.4.0 - pg-pool@3.9.0 - pg-protocol@1.9.0 - pg-query-stream@4.9.0 - pg@8.15.0

- client_encoding - fallback_application_name - options

Prior to v2.8.0, the parse function was the default when using import. When esm compatibility was introduced in v2.8.0, there was not default specified. This broke existing code that relied on that default. Fixes brianc#3424

- pg-connection-string@2.8.1 - pg-cursor@2.14.1 - pg-esm-test@1.1.1 - pg-pool@3.9.1 - pg-query-stream@4.9.1 - pg@8.15.1

…#3428) * fix(exports): resolve issues with module imports and requires * fix(pg-native): add support for lib module resolution in package.json

- pg-cloudflare@1.2.5 - pg-connection-string@2.8.5 - pg-cursor@2.14.5 - pg-esm-test@1.1.5 - pg-native@3.4.5 - pg-pool@3.9.5 - pg-protocol@1.9.5 - pg-query-stream@4.9.5 - pg@8.15.5

* Update docs - start * Add logo & discord * Start updating docs for esm style imports * Update docs with logo & info on pooling * Update more import statements --------- Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

- pg-cursor@2.14.6 - pg-esm-test@1.1.6 - pg-pool@3.9.6 - pg-query-stream@4.9.6 - pg@8.15.6

…earna and not needed (brianc#3441) Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

* Support Min connection pool parameter brianc#3009 * Remove extraneous change * streamline code

* Update docs for pool * Letting my robot overlords proofread for me --------- Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

…anc#3444)

Fixes brianc#3600

* Pass connection parameters to password callback * Works on my machine - adding logging for gh actions * More debugging logging in tests * Blank out password in unit test * Try again... * Remove debugging

…anc#2810) * fix(pg-query-stream): invoke `this.callback` on cursor end/error Closes brianc#2013 * fix(Client): respect `callback` argument for `Submittable` case * Add tests * Remove log * Fix lint --------- Co-authored-by: Brian Carlson <brian.m.carlson@gmail.com>

Simple typo fix.

* Deprecate Client's internal query queue * lint * Minor cleanup

- pg-bundler-test@0.2.0 - pg-cursor@2.18.0 - pg-esm-test@1.5.0 - pg-native@3.6.0 - pg-pool@3.12.0 - pg-protocol@1.12.0 - pg-query-stream@4.13.0 - pg@8.19.0

Co-authored-by: Corey Van Woert <corey.vanwoert@helloalfred.com>

* Fix mocha in node 25 * Bump more mochas

* docs: upgrade to nextra v3 * fix: top-level docs:start script Additionally, remove non-working `start` command from docs `package.json`, as it was replaced by `dev` for consistency with the `README.md` in that directory.

Bumps [semver](https://github.com/npm/node-semver) from 7.7.2 to 7.7.4. - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.7.2...v7.7.4) --- updated-dependencies: - dependency-name: semver dependency-version: 7.7.4 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: typo in deprecation notice for client.query() * fix: typo in deprecation notice for client.query()

…anc#3620) * wip * Initial connect lifecycle working * Connect hook working * Rename 'hooks.bla' to 'onBla' * Add more tests * More cleanup testing * Use promise.try

- pg-connection-string@2.12.0 - pg-cursor@2.19.0 - pg-esm-test@1.6.0 - pg-native@3.7.0 - pg-pool@3.13.0 - pg-protocol@1.13.0 - pg-query-stream@4.14.0 - pg@8.20.0

Rename root package, pg, and pg-protocol to the @supabase/* scope and point repository / homepage URLs at supabase/node-postgres. Update the pg → pg-protocol dependency to the npm-alias form so consumers keep using the upstream "pg-protocol" import name while resolving to our fork's @supabase/pg-protocol on npm.

The supabase fork doesn't run upstream's full integration test matrix in GitHub Actions. Drop ci.yml and add the deploy workflows used to publish @supabase/pg and @supabase/pg-protocol to npm via trusted publishing (id-token: write, no NPM_TOKEN secret). Both workflows fire on push to master under their respective package paths and are also dispatchable manually. Node bumped to 20 since upstream now requires >= 16.0.0 and node 18 is end-of-life.

Add a maxResultSize option to bound the bytes returned by a query, so runaway result sets cannot exhaust process memory. When the limit is exceeded the connection is terminated and the query rejects with a Error tagged code='RESULT_SIZE_EXCEEDED' carrying resultSize and maxResultSize fields. Implemented for both the JS Connection (per- message accounting in the parse callback, terminating the connection on overflow) and the libpq-backed NativeQuery (post-result accounting via a size estimator, with the error re-emitted on the client). Defaults to undefined (feature off) so behavior is unchanged unless opted in. Re-applied on top of upstream pg@8.20.0; the JS Connection's attachListeners is split into a no-overhead standard path and a size-tracking path so the cost is paid only when the limit is set.

Wrap the handlePacket switch in a try/catch so any exception thrown from the parse*Message helpers (e.g. on malformed protocol bytes from a misbehaving / proxied server) is converted into a DatabaseError and returned through the normal callback path instead of escaping the parse stream as an uncatchable exception that crashes the host process. Also release the buffer reader on every exit path (success, default, and the new catch arm) so a faulty packet never retains the input buffer in this.reader.

Record origin/master as a parent of this branch using the 'ours' merge strategy so the PR can land with a fast-forward (or single merge commit) and master's history is only ever appended to — no force push. The branch tree is already the desired final state (upstream pg@8.20.0 plus the four supabase patches), so we discard origin/master's tree contributions on purpose. The 33 obsolete fork chore commits (renames, dependabot bumps, dist scaffolding, ad-hoc release chores) remain reachable in git ancestry but no longer affect any file in master.

Carry forward the fork customizations that were previously on master but were dropped when this branch was rebuilt from the upstream pg@8.20.0 tag (commit 'becad889 rebrand packages to @supabase scope' only updated the three packages we actually republish to npm). - packages/pg-cloudflare, pg-connection-string, pg-cursor, pg-native, pg-pool, pg-query-stream: point repository.url / bugs.url / homepage at supabase/node-postgres so contributors browsing our fork land in the right repo (matches commit d1ab821 'update packages.json for supabase scope' from the original fork). pg-pool's bugs/homepage are pointed at the consolidated path under packages/pg-pool, since upstream long ago folded the standalone node-pg-pool repo into this monorepo. - packages/pg/README.md: install snippet says '@supabase/pg' (matches the rebrand commit's package.json change). - root package.json: re-add the 'packageManager' field pinning yarn 1.22.22 with sha (used by corepack on master).

avallete

LGTM

lucaesposto and others added 30 commits April 1, 2025 15:38

docs: fix bug in transaction example (brianc#3414)

dcb4257

Throwing error will not allow "finally" execution, so client.release() must be invoked before it.

feat(pg-connection-string): ClientConfig helper functions

5a8b1a7

Two new functions are introduced to make it easy for TypeScript users to use a PostgresSQL connection string with pg Client. Fixes brianc#2280

eslint: enable recommended ruleset (brianc#3263)

9b51037

test: Avoid silencing errors from idle timeout test’s child process (b…

d8fb2f9

…rianc#3419) This hid the error fixed in brianc#3263, for example.

Update changelog

60817cd

Publish

9ec9e5f

- pg-cloudflare@1.2.0 - pg-connection-string@2.8.0 - pg-cursor@2.14.0 - pg-esm-test@1.1.0 - pg-native@3.4.0 - pg-pool@3.9.0 - pg-protocol@1.9.0 - pg-query-stream@4.9.0 - pg@8.15.0

docs: add missing parameters on pg.Client Config (brianc#3422)

9cc7d8e

- client_encoding - fallback_application_name - options

Publish

fb25f7b

- pg-connection-string@2.8.1 - pg-cursor@2.14.1 - pg-esm-test@1.1.1 - pg-pool@3.9.1 - pg-query-stream@4.9.1 - pg@8.15.1

pg-connection-string: fix 'parse' type signature

bbc84b2

fix(exports): resolve issues with module imports and requires (brianc…

2da196c

…#3428) * fix(exports): resolve issues with module imports and requires * fix(pg-native): add support for lib module resolution in package.json

Add tests for issues fixed in brianc#3428 (brianc#3432)

e8280d5

Expose TypeOverrides in esm & cjs from root of package (brianc#3433)

ad3e603

More tests & exports from pg-protocol (brianc#3436)

6ab0c46

Only allow publish from master

36fd0a6

Manually advance patch versions to re-align with lerna

2919f28

Publish

56e2862

- pg-cloudflare@1.2.5 - pg-connection-string@2.8.5 - pg-cursor@2.14.5 - pg-esm-test@1.1.5 - pg-native@3.4.5 - pg-pool@3.9.5 - pg-protocol@1.9.5 - pg-query-stream@4.9.5 - pg@8.15.5

Update docs - add ESM info

0c1629b

* Update docs - start * Add logo & discord * Start updating docs for esm style imports * Update docs with logo & info on pooling * Update more import statements --------- Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

Make pg-cursor compatible with older versions of pg (brianc#3440)

39e134d

Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

Publish

81d875f

- pg-cursor@2.14.6 - pg-esm-test@1.1.6 - pg-pool@3.9.6 - pg-query-stream@4.9.6 - pg@8.15.6

Remove circluar dep for test dependency - I think this is managed w l…

229de30

…earna and not needed (brianc#3441) Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

Support Min connection pool parameter brianc#3009 (brianc#3438)

ff40638

* Support Min connection pool parameter brianc#3009 * Remove extraneous change * streamline code

Update pool docs (brianc#3442)

7a00938

* Update docs for pool * Letting my robot overlords proofread for me --------- Co-authored-by: Brian Carlson <brian.carlson@getcruise.com>

Replace all usages of var with let / const - eslint auto applied (bri…

9e7a5d9

…anc#3444)

chore: replace var with const in md files (brianc#3446)

93aa1ba

chore: minor eslint fixes, reenable no-unused vars (brianc#3445)

f528433

charmander and others added 24 commits February 11, 2026 17:55

docs: Remove rejectUnauthorized: false when specifying a CA

0b64e4d

Fixes brianc#3600

docs: Remove redundant Buffer → string conversions in TLS configuration

a3eeecb

test: Fix TLS connection test ending too early

d80d883

Pass connection parameters to password callback (brianc#3602)

e6e3692

* Pass connection parameters to password callback * Works on my machine - adding logging for gh actions * More debugging logging in tests * Blank out password in unit test * Try again... * Remove debugging

Typo fix in PgPass deprecation (funciton) (brianc#3605)

a215bfb

Simple typo fix.

Deprecate Client's internal query queue (brianc#3603)

5a4bafc

* Deprecate Client's internal query queue * lint * Minor cleanup

Update changelog

ebc14ca

Publish

f2d7d11

- pg-bundler-test@0.2.0 - pg-cursor@2.18.0 - pg-esm-test@1.5.0 - pg-native@3.6.0 - pg-pool@3.12.0 - pg-protocol@1.12.0 - pg-query-stream@4.13.0 - pg@8.19.0

docs: keepAlive and keepAliveInitialDelayMillis (brianc#3609)

ec90a3c

Co-authored-by: Corey Van Woert <corey.vanwoert@helloalfred.com>

Fix mocha in node 25 (brianc#3610)

d90db86

* Fix mocha in node 25 * Bump more mochas

docs: upgrade to nextra v3 (brianc#3549)

f0f01ec

* docs: upgrade to nextra v3 * fix: top-level docs:start script Additionally, remove non-working `start` command from docs `package.json`, as it was replaced by `dev` for consistency with the `README.md` in that directory.

Add explicit dependency to typescript for docs (brianc#3611)

9e8274f

fix: typo in deprecation notice for client.query() (brianc#3618)

ad36e3c

* fix: typo in deprecation notice for client.query() * fix: typo in deprecation notice for client.query()

Add onConnect callback which allows "setup" of a pooled client (bri…

0c7040e

…anc#3620) * wip * Initial connect lifecycle working * Connect hook working * Rename 'hooks.bla' to 'onBla' * Add more tests * More cleanup testing * Use promise.try

Update changelog

1c8c710

Publish

c9070cc

- pg-connection-string@2.12.0 - pg-cursor@2.19.0 - pg-esm-test@1.6.0 - pg-native@3.7.0 - pg-pool@3.13.0 - pg-protocol@1.13.0 - pg-query-stream@4.14.0 - pg@8.20.0

avallete commented May 11, 2026

View reviewed changes

avallete requested a review from soedirgo May 11, 2026 15:25

soedirgo approved these changes May 11, 2026

View reviewed changes

avallete merged commit e149287 into master May 12, 2026

This was referenced May 12, 2026

fix(ci): make deploy workflows self-bootstrapping #30

Merged

chore: sync upstream/master + bump @supabase/pg to 8.21.0, pg-protocol to 1.13.1 #31

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: upgrade fork to upstream pg@8.20.0#29

chore: upgrade fork to upstream pg@8.20.0#29
avallete merged 127 commits into
masterfrom
chore/upgrade-pg-8.20

avallete commented May 11, 2026 •

edited

Loading

Uh oh!

avallete left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

avallete commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's in this PR

What gets dropped

What gets republished

Test plan

Downstream follow-up (separate PR, postgres-meta repo)

Uh oh!

avallete left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

avallete commented May 11, 2026 •

edited

Loading