Skip to content

chore(deps): bump pg from 8.11.3 to 8.21.0#244

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pg-8.20.0
Open

chore(deps): bump pg from 8.11.3 to 8.21.0#244
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pg-8.20.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 7, 2026

Bumps pg from 8.11.3 to 8.21.0.

Changelog

Sourced from pg's changelog.

[email protected]

[email protected]

  • Add onConnect callback to pg.Pool constructor options allowing for async initialization of newly created & connected pooled clients.

[email protected]

[email protected]

[email protected]

  • Throw correct error if database URL parsing fails.

[email protected]

[email protected]

  • Add support for esm importing. CommonJS importing is still also supported.

[email protected]

[email protected]

[email protected]

[email protected]

  • Emit release event when client is returned to the pool.

[email protected]

... (truncated)

Commits
  • 544b1ce Publish
  • cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
  • f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
  • f252870 cleanup: pg utils (#3675)
  • c8da6ab Assorted test cleanup (#3673)
  • fa47e73 fix: Client#end callback being called multiple times when first is no-op (#...
  • 88a7e60 cleanup: Move declaration to more natural place
  • 2095247 cleanup: Combine duplicated code in Client#query and avoid unneeded early n...
  • 0ac3edd fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 (#3669)
  • be880d4 Assorted test fixes and cleanup (#3672)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 7, 2026
@dependabot dependabot Bot requested a review from aamoghS as a code owner May 7, 2026 12:49
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 7, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

@dependabot merge

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 7, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/pg 8.21.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/pg 8.21.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/pg-cloudflare 1.4.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/pg-connection-string 2.13.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/pg-pool 3.14.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/pg-protocol 1.14.0 🟢 5.3
Details
CheckScoreReason
Code-Review🟢 5Found 17/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • packages/db/package.json
  • pnpm-lock.yaml

@dependabot dependabot Bot changed the title Bump pg from 8.11.3 to 8.20.0 chore(deps): bump pg from 8.11.3 to 8.20.0 May 12, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/pg-8.20.0 branch from d2e3d68 to d0a8919 Compare May 12, 2026 03:10
@github-actions
Copy link
Copy Markdown
Contributor

@dependabot merge

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/pg-8.20.0 branch from d0a8919 to 65e8c61 Compare May 13, 2026 04:15
@github-actions
Copy link
Copy Markdown
Contributor

@dependabot merge

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/pg-8.20.0 branch from 65e8c61 to 307b5ed Compare May 16, 2026 04:52
@github-actions
Copy link
Copy Markdown
Contributor

@dependabot merge

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/pg-8.20.0 branch from 307b5ed to d1b8d75 Compare May 16, 2026 23:53
@github-actions
Copy link
Copy Markdown
Contributor

@dependabot merge

Bumps [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) from 8.11.3 to 8.21.0.
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/[email protected]/packages/pg)

---
updated-dependencies:
- dependency-name: pg
  dependency-version: 8.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot changed the title chore(deps): bump pg from 8.11.3 to 8.20.0 chore(deps): bump pg from 8.11.3 to 8.21.0 May 22, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/pg-8.20.0 branch from d1b8d75 to 79da40e Compare May 22, 2026 03:02
@github-actions
Copy link
Copy Markdown
Contributor

@dependabot merge

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants