Five releases across rpg and sqlever. Twelve merged PRs. One security incident, quickly contained.
*rpg users can now see what their database is actually waiting on, in real time, with historical depth when pg_ash is installed.*
*A real Sqitch deployment with 255 migrations ran byte-for-byte against sqlever. All 10 differences have been fixed.*
*HA setups using Patroni or pgBouncer can now point rpg at multiple hosts and let it find the primary automatically.*
psql supports failover via -h host1,host2,host3, trying each in order until one accepts the connection. rpg did not. @NikolayS's #751 implements the same libpq semantics — connection strings like postgres://host1:5432,host2:5432/db or rpg -h primary,replica -p 5432 now work correctly. Per-host ports are supported (-p 5432,5433), and when all hosts fail, rpg reports which hosts were tried and why each one failed, matching psql's error reporting.
*Dynamic prompts like `[`git branch`] %/ #` now work in rpg, matching psql behavior that power users depend on.*
psql allows prompt customization via backtick-delimited shell commands: PROMPT1='hostname:\u@\h:\d> ' executes hostname on each prompt render and substitutes the output. rpg was rendering backticks literally. @NikolayS's #748 adds the same behavior — backticks in PROMPT1 and PROMPT2 are now executed via shell, with stdout trimmed and substituted. Failed commands or empty output substitute an empty string without crashing.
*Deploying old migrations on a fresh database now uses file versions from when the migration was written, not current HEAD.*
Every migration tool that supports \i includes has a dangerous assumption: included files are always read from HEAD, not from the version that existed when the migration was written. This means deploying historical migrations silently picks up modifications to shared files, potentially introducing security vulnerabilities or data corruption with no error. @NikolayS's #201 adds a live demo proving the problem — two migrations share a row_level_security.sql file, and modifying it in subsequent commits changes the behavior of earlier migrations on a fresh database. sqlever's default behavior is to snapshot includes at migration write time, and the PR includes 8 test scenarios demonstrating the difference between snapshot (safe) and --no-snapshot (dangerous) behavior.
*An AI testing output in a PR comment exposed a pgMustard API key. Detection and rotation took hours.*
During testing of the new \explain share pgmustard feature in rpg v0.8.0, an AI agent posted test output as a PR comment that included a pgMustard API key in plaintext. @NikolayS spotted this via regex scanning and rotated the key the same day. No production use was compromised. This is a cautionary example of the risk when testing against real third-party APIs in open repositories — even with private keys, they can leak through test output, logs, and error messages.
*The generator now performs a two-pass scan — finding issues linked to merged PRs and weaving their details into articles.*
@NikolayS's #3 adds a two-pass generation mode that enriches article descriptions. When a merged PR links to an issue, the generator fetches the issue title and body on a second pass, allowing the article to explain the problem the PR solved rather than just the code change itself. This lets readers understand the 'before' context without leaving the dispatch.
| postgresai |
|
115 |
| rpg |
|
71 |
| gitzette |
|
3 |
| sqlever |
|
2 |
Your GitHub week, turned into something worth reading.
Generate your dispatch →