@di-framework/pglite-component 6.0.15 → 6.0.16

package/README.md

@@ -1,6 +1,6 @@
 # di-framework:pglite — embedded PostgreSQL over WIT
 
-The provider bundles the PGlite PostgreSQL 17.5 engine into a WebAssembly
+The provider bundles a PostgreSQL 17.11 engine, built for WASI, into a WebAssembly
 component. SQL calls cross WIT and WebAssembly memory. There is no TCP listener,
 network client, native sidecar, or separate database service.
 
@@ -59,6 +59,24 @@ is cached under `target/engine`. Containers are build tools only; deployment
 runs the resulting `.wasm` directly. For a remote Podman daemon, set the task's
 `DOCKER_CONTEXT=podman`.
 
+### Engine source
+
+The engine is upstream PostgreSQL `REL_17_11` with ElectricSQL's PGlite WASI
+changes replayed onto it. Electric maintains no WASI branch past 17.5 (its newer
+branches are Emscripten-only), so the 17.5 WASI changes are carried as
+[`engine/patches/postgresql-17.11-wasi.patch`](engine/patches/README.md)
+(PostgreSQL License). `scripts/build-engine.ts` fetches the tag pinned in
+`scripts/tool-versions.env` (`POSTGRES_SOURCE_TAG`), refuses it unless it
+resolves to `POSTGRES_SOURCE_COMMIT`, and applies that patch and then the
+[wasipg](https://github.com/moznion/wasipg) recipe's sjlj patches, checking each
+before applying it. `scripts/patch-engine-source.ts` adds the di-framework
+changes described in `engine/NOTICE`.
+
+`make check-engine-patch` runs all of those steps without the container build,
+in about 30 seconds. Run it first after bumping the PostgreSQL release: a patch
+that no longer applies fails with its name, the base, and git's output. Then
+follow [engine/patches/README.md](engine/patches/README.md).
+
 The build embeds the support filesystem, adapts the engine's WASI Preview 1
 imports to Preview 2, and composes the engine with the Rust database provider.
 It fails if the final artifact imports sockets or leaves the engine unresolved.
@@ -98,6 +116,14 @@ and persistence across separate runtime processes. It also exits a runtime
 with an open transaction and verifies that committed rows survive and the
 uncommitted row is absent after restart. No scripted database server is used.
 
+`make smoke` also checks upgrades from the previous release. It downloads the
+published `@di-framework/pglite-component` tarball pinned as
+`PGLITE_UPGRADE_FROM_*` in `scripts/tool-versions.env` (6.0.15, PostgreSQL
+17.5) and checks its sha256. Its provider writes a data directory with a table,
+pgcrypto and PGP ciphertext. The new build must then open that directory,
+report 17.11, read the rows, decrypt the old ciphertext, run pgcrypto on new
+values, and write to it.
+
 ## Publishing to GHCR
 
 The pglite component is published to GitHub Container Registry (GHCR) as an OCI wasm component. [The workflow](https://github.com/di-framework/platform/actions/workflows/pglite-component-publish.yml) runs by itself on each push to `main` that changes one of its input paths (`on.push.paths`). `workflow_dispatch` stays available for reruns and always builds.
@@ -113,7 +139,7 @@ Tags are movable. `0.2.0` always points to the latest `main` publish for WIT pac
 ### Artifact location
 
 The digest is in **Details** > **Record component digest** > **Step summary**, and in the `pglite-publish-report` artifact (`publish-report.json`).
-Published digest: `ghcr.io/di-framework/pglite-component@sha256:42a5a38f61abb621643c8175fd4c9a8652778eb90edc458eb355625733fa4c33`
+Published digest: `ghcr.io/di-framework/pglite-component@sha256:9be0cc2f59efea9ade293173ca28bd289a5505eb31b08fb954e718c03316355e`
 
 **Note:** The GHCR package must be made public by an org admin after the first publish. Until then, only members with access to di-framework/platform can pull it.
 
@@ -151,7 +177,7 @@ wasmtime run --dir ./data::/data path/to/app.composed.wasm
 To use the published OCI component from GHCR instead (pin by digest for reproducibility):
 
 ```sh
-export PGLITE_REF='ghcr.io/di-framework/pglite-component@sha256:42a5a38f61abb621643c8175fd4c9a8652778eb90edc458eb355625733fa4c33'
+export PGLITE_REF='ghcr.io/di-framework/pglite-component@sha256:9be0cc2f59efea9ade293173ca28bd289a5505eb31b08fb954e718c03316355e'
 wash oci pull "${PGLITE_REF}" pglite.wasm
 wac plug --plug pglite.wasm path/to/app.wasm -o path/to/app.composed.wasm
 mkdir -p ./data
@@ -319,7 +345,12 @@ Blowfish (`bf`), CAST5 (`cast5`) and single DES (`des`) are unavailable in
 this build, because the OpenSSL legacy provider is not built or loaded.
 pgcrypto refuses them with `Cipher cannot be initialized`: in `encrypt()` and
 `decrypt()`, in the PGP functions, and when decrypting PGP messages that use
-them. `3des` (DES-EDE3) is in OpenSSL's default provider and still works, for
+them. For PGP this is upstream PostgreSQL's own check (17.11, CVE-2026-14663);
+pgcrypto is otherwise unmodified. Provider releases before the #355 fix wrote
+Blowfish and CAST5 PGP messages that are not actually encrypted. To recover such
+a message, decrypt it once with upstream's `ignore-cipher-failure=1` option
+(`pgp_sym_decrypt`, `pgp_pub_decrypt`; decryption only), then re-encrypt it with
+AES. Plaintext recovered that way is not authenticated by the key. `3des` (DES-EDE3) is in OpenSSL's default provider and still works, for
 legacy data only. Use `aes` (`aes128`, `aes192`, `aes256` for PGP). Password hashing with
 `crypt()` and `gen_salt('bf')`, `'md5'`, `'xdes'` or `'des'` is unaffected,
 because pgcrypto implements those itself.
@@ -339,7 +370,8 @@ For an `open("/data/orders", ...)` call:
 
 Mount the entire root on persistent storage and reuse it after restarts.
 Initialization creates the cluster once; later starts reuse it. Incomplete
-clusters or an incompatible PostgreSQL major version are rejected.
+clusters are rejected, and so is a data directory from another PostgreSQL major
+version (see [below](#upgrading-across-postgresql-major-versions)).
 `fsync`, `synchronous_commit`, and `full_page_writes` are enabled before the
 backend starts. The host filesystem must honor WASI sync operations; a local
 restart test is not a power-loss durability certification.
@@ -370,6 +402,38 @@ its components the matching WASI preopen. Use a stable workload identity on
 redeploy and configure exclusive execution for this database. These
 annotations provide storage; they do not enforce database ownership.
 
+## Upgrading across PostgreSQL major versions
+
+A data directory belongs to one PostgreSQL major version, recorded in
+`<root>/data/PG_VERSION`. Minor releases share the on-disk format: a directory
+written by the 17.5 engine (provider 6.0.15 and earlier) opens in place under
+17.11, and `make smoke` checks this.
+
+The engine opens only major version 17. For any other `PG_VERSION`, `open`
+fails with `open-failed` and a message such as:
+
+```text
+incompatible PostgreSQL data directory: PG_VERSION is 16, but this provider bundles
+PostgreSQL 17.11 and opens only major version 17 data directories; see
+platform/pglite-component/README.md#upgrading-across-postgresql-major-versions
+```
+
+The provider does not convert directories between major versions; it bundles
+neither a second engine nor `pg_upgrade`. To move a database across a major
+version:
+
+1. Stop every writer. Keep the provider version that wrote the directory,
+   pinned by its digest or npm version, and back up the whole root.
+2. With that provider, export the data through the application, for example
+   with a migration step that reads each table through the `database`
+   interface into a portable format.
+3. Deploy the new provider on a new, empty root, and recreate the schema with
+   the application's migrations.
+4. Import the exported data, check it, then retire the old root.
+
+If the root is encrypted with `pglite-encfs`, compose encfs with the same key
+for both the export and the import. PostgreSQL 18 is tracked in #401.
+
 ## Implementation
 
 - `js/adapter.ts`: the `SqlDatabase` adapter published on npm (`bun run build:adapter`).
@@ -380,6 +444,8 @@ annotations provide storage; they do not enforce database ownership.
 - `engine/bridge.wat`: private canonical ABI bridge to the core engine.
 - `engine/build-pgcrypto.sh`: builds OpenSSL libcrypto and pgcrypto in the engine container and generates pgcrypto's static `dlsym` table; `scripts/patch-engine-source.ts` links both into the engine. The libcrypto build is cached under a key of the OpenSSL source tarball's sha256, the Configure options and `SOURCE_DATE_EPOCH`, so an OpenSSL version bump always rebuilds it.
 - `scripts/patch-engine-source.ts`: also replaces the upstream `dlopen` emulation's unbounded table (`dltab`) with the bounded one described under [Extensions](#extensions), and keeps pgcrypto's hook ahead of it.
+- `engine/patches/postgresql-17.11-wasi.patch`: Electric's 17.5 WASI changes replayed onto upstream `REL_17_11`; see [engine/patches/README.md](engine/patches/README.md).
+- `scripts/build-engine.ts`: builds the engine source tree (pinned tag, checked commit, checked patches) and runs the wasipg container build; `scripts/check-engine-patch.ts` (`make check-engine-patch`) runs the same source steps without the build.
 - `scripts/prepare-engine.ts`: pinned engine preparation and componentization (all build scripts are Bun TypeScript; see `scripts/`).
 - `wit/deps/pglite-engine/engine.wit`: internal interface, composed away at build.
 

package/dist/BUILD-INFO.txt

@@ -1,14 +1,16 @@
 component:       di-framework:pglite@0.2.0
 profile:         release
-built:           2026-10-16T03:00:39Z
+built:           2026-10-16T17:04:13Z
 rustc:           rustc 1.97.1 (8bab26f4f 2026-07-14)
 target:          wasm32-wasip2
 wasm-tools:      wasm-tools 1.258.0 (5c6d31c78 2026-08-24)
 wit-bindgen:     0.61.1
 md5:             0.7.0
-engine:          PostgreSQL 17.5, persistent WASI filesystem
+engine:          PostgreSQL 17.11, persistent WASI filesystem
 extensions:      plpgsql, pgcrypto (OpenSSL 3.5.9 libcrypto)
-engine-source:   https://github.com/moznion/wasipg/tree/fa290be67946c0d3c4540bd1400b11e193d874e1
+engine-source:   https://github.com/postgres/postgres/tree/083ac033419f690758508e08c1736089384bbee8 (REL_17_11)
+engine-patch:    engine/patches/postgresql-17.11-wasi.patch (sha256 6beb64a561caa80e3669733f9e24e344edb0445d2623c17eee79d48ec28fac65)
+engine-recipe:   https://github.com/moznion/wasipg/tree/fa290be67946c0d3c4540bd1400b11e193d874e1
 adapter-sha256:  e51dd61669a20daca34befe7fdadf1ac84e4795a2c84a8400818ee1de5373ccc
-engine-sha256:   ad2d96c9ce85a35620719fbc6a038c407234d11c5a106e70c2863b104dcfa52c
-size:            20116132 bytes
+engine-sha256:   eb374344cff24c4cedacdad05a636a3b75b5eb1c4e55aa1a3ff9930be2ebc328
+size:            20168533 bytes

package/dist/SHA256SUMS

@@ -1,4 +1,4 @@
-bff475faba7eecde56427e40704c282523e0f84482389e029f9dd58d9cf0f6aa  di-framework-pglite.wasm
+a98a0476f61d539c72458be572d5705c8a237a49d51329784b65d564fab1b657  di-framework-pglite.wasm
 6053154ec1bc94de63ce4f4f4cce5922ef57dce794c2dde326f5845b8982d35f  di-framework-pglite.wit
-f7a7643d858d330dc4e114d63b554e15dcacfcf19c5afae6454b456e33216b12  BUILD-INFO.txt
-e19368fcd3dc22d06c46a5256950924b3775154cd77f7be2d3105036be576619  THIRD-PARTY-NOTICES.txt
+f76f82266b1f741e10c5c89e6c30f620571adba6bb228a33324681d2dc1822b3  BUILD-INFO.txt
+443fd294671eb64972556656d3ee871e48448ad1169c012d18aa868568f628c1  THIRD-PARTY-NOTICES.txt

package/dist/THIRD-PARTY-NOTICES.txt

@@ -1,14 +1,22 @@
 di-framework embedded PGlite component
 
-The provider bundles PostgreSQL 17.5 (PGlite WASI), originally maintained by
-ElectricSQL. PostgreSQL's license is reproduced in POSTGRESQL-COPYRIGHT.
-The upstream bindings license and WASI adapter license are reproduced in
-PGLITE-BINDINGS-LICENSE and WASMTIME-LICENSE. The engine statically links
-the pgcrypto extension and OpenSSL libcrypto; their notices are in
-PGCRYPTO-NOTICES and the OpenSSL license (Apache-2.0) in OPENSSL-LICENSE.
+The provider bundles PostgreSQL 17.11 built for WASI. The engine source is
+upstream PostgreSQL REL_17_11 (commit 083ac033419f690758508e08c1736089384bbee8)
+with ElectricSQL's PGlite WASI changes from postgres-pglite branch
+REL_17_5_WASM-pglite (commit 2194acf356e9b7bf7cff29c4ed4bd6b82b93895d) replayed
+onto it; that replay is engine/patches/postgresql-17.11-wasi.patch in the
+di-framework source. PostgreSQL, postgres-pglite and the replay patch are
+distributed under the PostgreSQL License, reproduced in POSTGRESQL-COPYRIGHT.
+The engine is built with the wasipg recipe and its sjlj patches (Apache-2.0;
+notice below). The upstream bindings license and WASI adapter license are
+reproduced in PGLITE-BINDINGS-LICENSE and WASMTIME-LICENSE. The engine
+statically links the pgcrypto extension and OpenSSL libcrypto; their notices
+are in PGCRYPTO-NOTICES and the OpenSSL license (Apache-2.0) in
+OPENSSL-LICENSE.
 
 Sources:
-https://github.com/electric-sql/postgres-pglite
+https://github.com/postgres/postgres/tree/REL_17_11
+https://github.com/electric-sql/postgres-pglite/tree/REL_17_5_WASM-pglite
 https://github.com/electric-sql/pglite-bindings
 https://github.com/moznion/wasipg
 https://github.com/bytecodealliance/wasmtime/tree/v29.0.1
@@ -21,9 +29,17 @@ bootstrap files within the database's persistent filesystem mount. A growable,
 bounded memory buffer replaces socket-file spillover for query replies. Backend
 startup restores application session defaults after bootstrap and enables
 durable writes. The emulated dlopen keeps loaded libraries in a bounded table
-instead of writing past the end of an unsized array. pgcrypto's PGP CFB mode
-(contrib/pgcrypto/pgp-cfb.c) is patched to refuse ciphers that are unavailable
-in this build.
+instead of writing past the end of an unsized array. Two small changes to the
+WASI glue let it compile against 17.11: initdb's frontend SplitGUCList
+declaration is renamed where initdb is compiled into the backend, and the
+frontend allocator stubs gain the overflow-checked pg_malloc_mul and
+pg_realloc_mul. pgcrypto is unmodified: PostgreSQL 17.11 itself refuses
+ciphers OpenSSL cannot run (CVE-2026-14663), which in this build includes
+Blowfish and CAST5.
+
+The wasipg notice below describes wasipg's own release artifacts, which were
+built from REL_17_5_WASM-pglite; this provider uses wasipg's build recipe and
+patches with the 17.11 source tree above.
 
 The engine's core module, support files, adapter, and the provider are
 composed into one deployable artifact. Engine code executes in the Wasm
@@ -86,9 +102,9 @@ wasi-libc from wasi-sdk 33, distributed under
 "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT". The shadow headers
 under build/hotfix/ are derived from wasi-libc headers.
 PostgreSQL Database Management System
-(formerly known as Postgres, then as Postgres95)
+(also known as Postgres, formerly known as Postgres95)
 
-Portions Copyright (c) 1996-2025, PostgreSQL Global Development Group
+Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
 
 Portions Copyright (c) 1994, The Regents of the University of California
 
@@ -110,7 +126,7 @@ ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
 PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
 
 --------------------------------------------------------------------------
-pgcrypto (PostgreSQL 17.5 contrib/pgcrypto)
+pgcrypto (PostgreSQL 17.11 contrib/pgcrypto)
 --------------------------------------------------------------------------
 
 pgcrypto is part of PostgreSQL and is distributed under the PostgreSQL

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@di-framework/pglite-component",
-  "version": "6.0.15",
+  "version": "6.0.16",
   "type": "module",
   "description": "Embedded PostgreSQL component with persistent WASI storage and no TCP, plus its SqlDatabase adapter for @di-framework/repo.",
   "license": "(MIT OR Apache-2.0)",

package/wit/world.wit

@@ -114,7 +114,7 @@ interface database {
   /// are supported. Close/drop releases the connection for reuse at that root.
   open: func(path: string, options: option<open-options>) -> result<connection, error>;
 
-  /// The bundled engine version string, `17.5`; does not open a database.
+  /// The bundled engine version string, `17.11`; does not open a database.
   server-version: func() -> result<string, error>;
 
   /// An exclusive handle to the embedded session. Closing or dropping it