@imqueue/pg-sequelize 4.2.0 → 4.2.2

package/CHANGELOG.md

@@ -4,6 +4,39 @@ Notable changes to `@imqueue/pg-sequelize`.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.2.1] - 2026-08-18
+
+### Fixed
+
+- **`query.createEntity` leaked a pooled connection on every failed insert.**
+  When no transaction was passed it opened one, and finished it only on the happy
+  path — there was no `rollback` anywhere in the helper. A rejected `save()` (a
+  unique or foreign-key violation, a NOT NULL, an invalid enum) unwound past the
+  commit and left the transaction open.
+
+  In sequelize 6 a pooled connection is bound to the `Transaction` and only
+  `commit()` or `rollback()` hands it back, so nothing released it: `pool.max`
+  failed inserts — 5 by default — exhausted the pool, after which every query in
+  the process failed with `SequelizeConnectionAcquireTimeoutError` until it was
+  restarted. On the database side the backend sat in
+  `idle in transaction (aborted)` indefinitely.
+
+  Ownership is now all-or-nothing, decided by a single flag used for both the
+  commit and the rollback so the two cannot select different sets of calls. Only
+  the call that opened the transaction finishes it; a caller-supplied transaction
+  and the nested relation creates that inherit it are untouched, exactly as
+  before. A rollback that fails is swallowed so it cannot replace the error that
+  caused it.
+
+  Anyone who cannot upgrade can own the lifecycle from outside, which closes the
+  leak with no dependency change:
+
+  ```typescript
+  const entity = await Model.sequelize!.transaction(transaction =>
+      createEntity<T, I>(Model, data, fields, transaction),
+  );
+  ```
+
 ## [4.2.0] - 2026-08-01
 
 The package is renamed from `@imqueue/sequelize` to `@imqueue/pg-sequelize`. No

package/README.md

@@ -1,6 +1,7 @@
 # @imqueue/pg-sequelize
 
-[![Build Status](https://img.shields.io/github/actions/workflow/status/imqueue/pg-sequelize/build.yml)](https://github.com/imqueue/pg-sequelize)
+[![Build Status](https://img.shields.io/github/actions/workflow/status/imqueue/pg-sequelize/build.yml)](https://github.com/imqueue/pg-sequelize/actions/workflows/build.yml)
+[![npm version](https://img.shields.io/npm/v/@imqueue/pg-sequelize)](https://www.npmjs.com/package/@imqueue/pg-sequelize)
 [![Known Vulnerabilities](https://snyk.io/test/github/imqueue/pg-sequelize/badge.svg?targetFile=package.json)](https://snyk.io/test/github/imqueue/pg-sequelize?targetFile=package.json)
 [![License](https://img.shields.io/badge/license-GPL-blue.svg)](https://github.com/imqueue/pg-sequelize/blob/master/LICENSE)
 
@@ -86,7 +87,8 @@ Every exported symbol carries its own documentation, so an editor is the fastest
 reference. The same content is published, symbol by symbol, as the
 [API reference](https://imqueue.org/api/pg-sequelize/latest/) — searchable, and linkable
 when you need to point someone at one thing. The wider ecosystem documentation is at
-[imqueue.org](https://imqueue.org/docs/).
+[imqueue.org](https://imqueue.org/docs/). Current version, licence and Node floor
+for every package: [imqueue.org/status.json](https://imqueue.org/status.json).
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imqueue/pg-sequelize",
-  "version": "4.2.0",
+  "version": "4.2.2",
   "description": "Sequelize/Postgres toolkit for @imqueue microservices — turns a query described as data (filters, paging, ordering, fields) into one efficient statement, plus database views as models and the Postgres index options Sequelize cannot express",
   "keywords": [
     "imqueue",
@@ -46,7 +46,7 @@
   "author": "imqueue.com <support@imqueue.com>",
   "license": "GPL-3.0-only",
   "dependencies": {
-    "@imqueue/rpc": "^3.4.1",
+    "@imqueue/rpc": "^3.7.1",
     "pg": "^8.22.0",
     "reflect-metadata": "^0.2.2",
     "sequelize": "^6.37.8",

package/src/helpers/query.js

@@ -505,6 +505,18 @@ export var query;
      * Recursively creates entity and all it's relations from a given input
      * using a given model.
      *
+     * @remarks
+     * Ownership of the transaction is all-or-nothing: the call that opened one
+     * both commits it on success and rolls it back on failure, and every other
+     * call leaves it entirely alone. It used to commit without rolling back, so
+     * a rejected `save()` — a unique or foreign-key violation, a NOT NULL, an
+     * invalid enum — unwound past the commit and left the transaction open. In
+     * sequelize 6 a pooled connection is bound to the `Transaction` and only
+     * `commit()` or `rollback()` returns it, so nothing ever handed it back:
+     * `pool.max` failed inserts (5 by default) exhausted the pool and every
+     * later query failed with `SequelizeConnectionAcquireTimeoutError` until
+     * the process restarted.
+     *
      * @param model - Model to create.
      * @param input - One entity, or several.
      * @param fields - Requested fields map, deciding what comes back.
@@ -520,39 +532,59 @@ export var query;
         // the synchronous require(esm) path used by CommonJS consumers
         // cannot evaluate (bindings would stay undefined)
         const { database } = await import('../index.js');
+        // One flag for both ends of the lifecycle, so the commit and the
+        // rollback below cannot select different sets of calls: this call opened
+        // the transaction (`createEntity` passes doCommit=false when the caller
+        // supplied one) and is not a nested relation create (those inherit the
+        // caller's transaction and carry a `parent`).
+        const ownsTransaction = !transaction && !parent && doCommit;
         transaction =
             transaction ||
                 (await database().transaction({
                     autocommit: false,
                 }));
-        // todo: this could be optimized through bulk operations
-        if (isArray(input) && parentProperty && parent) {
-            parent.appendChild(parentProperty, await Promise.all(input.map(inputItem => doCreateEntity(model, inputItem, fields, transaction, parentProperty, parent, true, doCommit))));
-            return parent;
-        }
-        if (fields) {
-            primaryKeys(model).forEach(name => !fields[name] && (fields[name] = false));
-        }
-        const fieldNames = Object.keys(input);
-        const relationArgs = prepareInput(input, filtered(model.associations, fieldNames), model, fields, transaction, parent);
-        const entity = new model(input);
-        await entity.save({
-            transaction,
-            returning: fields
-                ? filtered(model.rawAttributes, Object.keys(fields), model)
-                : true,
-        });
-        if (!noAppend && parentProperty && parent) {
-            parent.appendChild(parentProperty, entity);
+        try {
+            // todo: this could be optimized through bulk operations
+            if (isArray(input) && parentProperty && parent) {
+                parent.appendChild(parentProperty, await Promise.all(input.map(inputItem => doCreateEntity(model, inputItem, fields, transaction, parentProperty, parent, true, doCommit))));
+                return parent;
+            }
+            if (fields) {
+                primaryKeys(model).forEach(name => !fields[name] && (fields[name] = false));
+            }
+            const fieldNames = Object.keys(input);
+            const relationArgs = prepareInput(input, filtered(model.associations, fieldNames), model, fields, transaction, parent);
+            const entity = new model(input);
+            await entity.save({
+                transaction,
+                returning: fields
+                    ? filtered(model.rawAttributes, Object.keys(fields), model)
+                    : true,
+            });
+            if (!noAppend && parentProperty && parent) {
+                parent.appendChild(parentProperty, entity);
+            }
+            await Promise.all(relationArgs.map(async (args) => {
+                args.push(entity);
+                await doCreateEntity(...args);
+            }));
+            if (ownsTransaction) {
+                await transaction.commit();
+            }
+            return entity;
         }
-        await Promise.all(relationArgs.map(async (args) => {
-            args.push(entity);
-            await doCreateEntity(...args);
-        }));
-        if (!parent && doCommit) {
-            await transaction.commit();
+        catch (err) {
+            if (ownsTransaction) {
+                // swallowed deliberately: a rollback that fails must not
+                // replace the error that caused it, and every path out of
+                // rollback() has dealt with the connection anyway — released on
+                // success, destroyed by forceCleanup() when the ROLLBACK itself
+                // errors, and already gone on the two guard clauses that throw
+                // before touching it
+                await transaction.rollback().catch(() => { });
+            }
+            throw err;
         }
-        return entity;
     }
     /**
      * The counting counterpart of {@link query.autoQuery}, for the same fields and filter.