gitzette / @NikolayS / Mar 23 – Mar 29 W13
← W12 W13 W14 →
@NikolayS — open-source digest March 23 – March 29, 2026
Vol. 1, No. 3 github.com/NikolayS
the dispatch
@NikolayS
rpg lands Active Session History, sqlever hardens against oracle-discovered bugs, and a leaked API key gets rotated in hours.
79 commits 67 PRs 8 releases 7 repos

Five releases across rpg and sqlever. Twelve merged PRs. One security incident, quickly contained.

RELEASE

Active Session History arrives in rpg v0.9.0 — /ash charts wait events live and from history

*rpg users can now see what their database is actually waiting on, in real time, with historical depth when pg_ash is installed.*

RELEASE

sqlever v0.3.0 fixes 10 bugs found by real-world oracle testing against production Sqitch projects

*A real Sqitch deployment with 255 migrations ran byte-for-byte against sqlever. All 10 differences have been fixed.*

FEATURE

multi-host failover now works — rpg follows psql's comma-separated host semantics

*HA setups using Patroni or pgBouncer can now point rpg at multiple hosts and let it find the primary automatically.*

psql supports failover via -h host1,host2,host3, trying each in order until one accepts the connection. rpg did not. @NikolayS's #751 implements the same libpq semantics — connection strings like postgres://host1:5432,host2:5432/db or rpg -h primary,replica -p 5432 now work correctly. Per-host ports are supported (-p 5432,5433), and when all hosts fail, rpg reports which hosts were tried and why each one failed, matching psql's error reporting.

FEATURE

shell commands in prompts — PROMPT1 and PROMPT2 now execute backtick-quoted scripts

*Dynamic prompts like `[`git branch`] %/ #` now work in rpg, matching psql behavior that power users depend on.*

psql allows prompt customization via backtick-delimited shell commands: PROMPT1='hostname:\u@\h:\d> ' executes hostname on each prompt render and substitutes the output. rpg was rendering backticks literally. @NikolayS's #748 adds the same behavior — backticks in PROMPT1 and PROMPT2 are now executed via shell, with stdout trimmed and substituted. Failed commands or empty output substitute an empty string without crashing.

the dispatch — Vol. 1, No. 3 March 23 – March 29, 2026
FEATURE

snapshot includes prevent silent security vulnerabilities when replaying historical migrations

*Deploying old migrations on a fresh database now uses file versions from when the migration was written, not current HEAD.*

Every migration tool that supports \i includes has a dangerous assumption: included files are always read from HEAD, not from the version that existed when the migration was written. This means deploying historical migrations silently picks up modifications to shared files, potentially introducing security vulnerabilities or data corruption with no error. @NikolayS's #201 adds a live demo proving the problem — two migrations share a row_level_security.sql file, and modifying it in subsequent commits changes the behavior of earlier migrations on a fresh database. sqlever's default behavior is to snapshot includes at migration write time, and the PR includes 8 test scenarios demonstrating the difference between snapshot (safe) and --no-snapshot (dangerous) behavior.

SECURITY

pgMustard API key accidentally committed in a PR comment — quickly rotated via regex scanner

*An AI testing output in a PR comment exposed a pgMustard API key. Detection and rotation took hours.*

During testing of the new \explain share pgmustard feature in rpg v0.8.0, an AI agent posted test output as a PR comment that included a pgMustard API key in plaintext. @NikolayS spotted this via regex scanning and rotated the key the same day. No production use was compromised. This is a cautionary example of the risk when testing against real third-party APIs in open repositories — even with private keys, they can leak through test output, logs, and error messages.

FEATURE

dispatch articles can now reference linked GitHub issues for richer context

*The generator now performs a two-pass scan — finding issues linked to merged PRs and weaving their details into articles.*

@NikolayS's #3 adds a two-pass generation mode that enriches article descriptions. When a merged PR links to an issue, the generator fetches the issue title and body on a second pass, allowing the article to explain the problem the PR solved rather than just the code change itself. This lets readers understand the 'before' context without leaving the dispatch.

stats corner
79
commits
67
pull requests
8
releases
commits by repo
REPO COMMITS sqlever 35 rpg 29 gitzette 9 postgresai 3 gitzette-dispatch 1 NikolayS 1 rachio-supervisor 1
github stars
postgresai
115
rpg
71
gitzette
3
sqlever
2
release timeline
MONTUEWEDTHUFRISATSUN sqlever v0.2.1 sqlever v0.2.2 sqlever v0.3.0 rpg v0.8.1 rpg v0.8.2 rpg v0.8.3 rpg v0.8.4 rpg v0.9.0
repo index
  • gitzette
    Turn your GitHub activity into a weekly newspaper — AI-generated headlines, styled HTML output
    9 commits · 0 releases · ★ 3
  • gitzette-dispatch
    Weekly engineering newspaper generator — dispatches for gitzette.online
    1 commits · 0 releases · ★ 0
  • rpg
    rpg — modern Postgres terminal written in Rust. psql-compatible, with built-in DBA diagnostics and AI assistant
    29 commits · 5 releases · ★ 71
  • sqlever
    Sqitch-compatible PostgreSQL migration tool with static analysis and zero-downtime migrations
    35 commits · 3 releases · ★ 2
  • NikolayS
    GitHub profile
    1 commits · 0 releases · ★ 0
  • rachio-supervisor
    Rachio irrigation supervisor — schedule control, water usage, visual inspection
    1 commits · 0 releases · ★ 0
  • postgresai
    postgresai – Postgres observability built for humans and AI agents
    3 commits · 0 releases · ★ 115
← Mar 16 – Mar 22 Mar 30 – Apr 5 →
gitzette @NikolayS on gitzette @NikolayS on GitHub
share: post on X share on LinkedIn

Your GitHub week, turned into something worth reading.

Generate your dispatch →
gitzette.online  ·  2026 © AISlopMedia, Inc.