@mastra/pg 1.13.0 → 1.13.3-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @mastra/pg
 
+## 1.13.3-alpha.0
+
+### Patch Changes
+
+- Security remediation for the 2026-06-17 "easy-day-js" supply-chain incident. Patch bump to publish clean versions and move the `latest` dist-tag forward, superseding the compromised versions that declared the malicious `easy-day-js` dependency. ([#18056](https://github.com/mastra-ai/mastra/pull/18056))
+
+- Updated dependencies [[`77a2351`](https://github.com/mastra-ai/mastra/commit/77a2351ee79296e360bce822cb3391f7cfd6489d)]:
+  - @mastra/core@1.43.1-alpha.0
+
+## 1.13.1
+
+### Patch Changes
+
+- Fix `PostgresStore` startup failing with `canceling statement due to statement timeout` when running behind a transaction pooler such as Supabase or PgBouncer. Initialization now reuses a single pooled connection for the duration of startup, so storage initializes reliably with observability enabled. Runtime queries are unaffected. Fixes #17679. ([#17833](https://github.com/mastra-ai/mastra/pull/17833))
+
+- Fixed skill updates creating duplicate versions when a snapshot had not meaningfully changed. Comparison previously relied on `JSON.stringify`, so reordered object keys (common with PostgreSQL JSONB) or optional fields round-tripping between `undefined` and `null` looked like changes. Skill snapshots are now compared by value, so repeated no-op publish/update cycles no longer increment the version number. ([#16811](https://github.com/mastra-ai/mastra/pull/16811))
+
+- Updated dependencies [[`de66bb0`](https://github.com/mastra-ai/mastra/commit/de66bb040570444c702ce4d8e1e228a5de2949cb), [`67bf8e2`](https://github.com/mastra-ai/mastra/commit/67bf8e206dfe583954d96015cf0d09f7ac50e45f), [`8216d05`](https://github.com/mastra-ai/mastra/commit/8216d0528d866eb9a07f5d4c87ea3bb1e1139b45), [`d18b23c`](https://github.com/mastra-ai/mastra/commit/d18b23c5e29dfc381e73e3c51fcf6c779afd1823), [`5eb94eb`](https://github.com/mastra-ai/mastra/commit/5eb94ebcf66d4e28c9e26d5821ac93379bab20a0), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`f9ee2ac`](https://github.com/mastra-ai/mastra/commit/f9ee2ac661af584e61bc063ac208c9035cd752ef), [`c853d53`](https://github.com/mastra-ai/mastra/commit/c853d535d2df84ab89db1adb4c28900c54c9a2d2), [`d8df1f8`](https://github.com/mastra-ai/mastra/commit/d8df1f8e947e1966c9d4e54713df56d0d0d65226), [`9192ddb`](https://github.com/mastra-ai/mastra/commit/9192ddbced8949113b30de444cbe763f075b59f5), [`ae96523`](https://github.com/mastra-ai/mastra/commit/ae965231f562d9766b0c90c49a69fc68acaa031c), [`17d5a92`](https://github.com/mastra-ai/mastra/commit/17d5a9211aa293b4d4418de3de70dc0394d58101), [`5573693`](https://github.com/mastra-ai/mastra/commit/5573693b589822250e20dfe6cf66e9ff3bc96da8), [`ec4da8a`](https://github.com/mastra-ai/mastra/commit/ec4da8a09e0d2ab452c6ee2c786042ea826b77e5), [`adc44e1`](https://github.com/mastra-ai/mastra/commit/adc44e13c7e570b91e86b20ea7556e61d819db31), [`ed346c0`](https://github.com/mastra-ai/mastra/commit/ed346c0bee2d8496690a4e538bfba1e46894660f), [`c9ce1b2`](https://github.com/mastra-ai/mastra/commit/c9ce1b28d10871110648f9d7b6d76e880b9fa999), [`3ef01fd`](https://github.com/mastra-ai/mastra/commit/3ef01fd130b53d5bd4f828beb174e516a2eb1158), [`245a9a3`](https://github.com/mastra-ai/mastra/commit/245a9a315705fce17ddd980f78a92504b6615c4a), [`dc0b611`](https://github.com/mastra-ai/mastra/commit/dc0b6119b769bd00ee2c5df9259fb376fe63077a), [`38b5de8`](https://github.com/mastra-ai/mastra/commit/38b5de8e5d1d41a69522addf53d96f4b3a1d5bf0), [`dc0b611`](https://github.com/mastra-ai/mastra/commit/dc0b6119b769bd00ee2c5df9259fb376fe63077a), [`dd6a66e`](https://github.com/mastra-ai/mastra/commit/dd6a66ea0b32e0dea8059aec6b35d151e2c87dc4), [`d785c59`](https://github.com/mastra-ai/mastra/commit/d785c593b67fcb4cdc4fab9fdbde5f3b7665efc0), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`8b984f4`](https://github.com/mastra-ai/mastra/commit/8b984f4361c202270ceb69257185c4756c9a7c56), [`bf08402`](https://github.com/mastra-ai/mastra/commit/bf084022374fa5d06ca70ed67a86dd64e379071b), [`81fe587`](https://github.com/mastra-ai/mastra/commit/81fe587275035715c1720ddf3fee0505cf053036), [`1fa3e12`](https://github.com/mastra-ai/mastra/commit/1fa3e123582b63cfe49de4ee52dc6a065e8d956a), [`403c438`](https://github.com/mastra-ai/mastra/commit/403c438e417278989ce247233d2c465b8d902cdd), [`f8ba195`](https://github.com/mastra-ai/mastra/commit/f8ba1954e27ee2b20586cc6cd9cf13c002c232f2)]:
+  - @mastra/core@1.43.0
+
 ## 1.13.0
 
 ### Minor Changes

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-pg
 description: Documentation for @mastra/pg. Use when working with @mastra/pg APIs, configuration, or implementation.
 metadata:
   package: "@mastra/pg"
-  version: "1.13.0"
+  version: "1.13.3-alpha.0"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.13.0",
+  "version": "1.13.3-alpha.0",
   "package": "@mastra/pg",
   "exports": {},
   "modules": {}

package/dist/index.cjs

@@ -15,6 +15,7 @@ var module$1 = require('module');
 var agent = require('@mastra/core/agent');
 var features = require('@mastra/core/features');
 var evals = require('@mastra/core/evals');
+var skills = require('@mastra/core/storage/domains/skills');
 
 var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
@@ -2164,6 +2165,161 @@ var TransactionClient = class {
     return Promise.all(promises);
   }
 };
+var PinnedClientAdapter = class {
+  constructor($pool, pinnedClient) {
+    this.$pool = $pool;
+    this.pinnedClient = pinnedClient;
+  }
+  $pool;
+  pinnedClient;
+  /**
+   * Serialization tail. Domain init() methods fire via Promise.all in
+   * MastraCompositeStore.#runInit(), so without our own gate every domain's
+   * query() lands on the same PoolClient concurrently. pg@8 queues those
+   * internally and emits a deprecation warning; pg@9 will throw. Chaining
+   * each new query off the previous one's settlement (success or failure)
+   * gives us deterministic FIFO ordering at the adapter layer and removes
+   * the reliance on pg's internal queue.
+   */
+  #tail = Promise.resolve();
+  /**
+   * Run `fn` after any previously enqueued work on this pinned client has
+   * settled. Failures in earlier calls don't poison the queue — we always
+   * resume on the next caller's turn.
+   */
+  #enqueue(fn) {
+    const next = this.#tail.then(fn, fn);
+    this.#tail = next.catch(() => void 0);
+    return next;
+  }
+  connect() {
+    throw new Error(
+      "PinnedClientAdapter.connect() is not supported during PostgresStore.init(). All DDL must flow through the pinned client."
+    );
+  }
+  none(query, values) {
+    return this.#enqueue(async () => {
+      await this.pinnedClient.query(query, values);
+      return null;
+    });
+  }
+  one(query, values) {
+    return this.#enqueue(async () => {
+      const result = await this.pinnedClient.query(query, values);
+      if (result.rows.length === 0) {
+        throw new Error(`No data returned from query: ${truncateQuery(query)}`);
+      }
+      if (result.rows.length > 1) {
+        throw new Error(`Multiple rows returned when one was expected: ${truncateQuery(query)}`);
+      }
+      return result.rows[0];
+    });
+  }
+  oneOrNone(query, values) {
+    return this.#enqueue(async () => {
+      const result = await this.pinnedClient.query(query, values);
+      if (result.rows.length === 0) {
+        return null;
+      }
+      if (result.rows.length > 1) {
+        throw new Error(`Multiple rows returned when one or none was expected: ${truncateQuery(query)}`);
+      }
+      return result.rows[0];
+    });
+  }
+  any(query, values) {
+    return this.#enqueue(async () => {
+      const result = await this.pinnedClient.query(query, values);
+      return result.rows;
+    });
+  }
+  manyOrNone(query, values) {
+    return this.any(query, values);
+  }
+  many(query, values) {
+    return this.#enqueue(async () => {
+      const result = await this.pinnedClient.query(query, values);
+      if (result.rows.length === 0) {
+        throw new Error(`No data returned from query: ${truncateQuery(query)}`);
+      }
+      return result.rows;
+    });
+  }
+  query(query, values) {
+    return this.#enqueue(() => this.pinnedClient.query(query, values));
+  }
+  tx(callback) {
+    return this.#enqueue(async () => {
+      await this.pinnedClient.query("BEGIN");
+      try {
+        const result = await callback(new TransactionClient(this.pinnedClient));
+        await this.pinnedClient.query("COMMIT");
+        return result;
+      } catch (error) {
+        try {
+          await this.pinnedClient.query("ROLLBACK");
+        } catch (rollbackError) {
+          console.error("Transaction rollback failed:", rollbackError);
+        }
+        throw error;
+      }
+    });
+  }
+};
+var RoutingDbClient = class {
+  #base;
+  #pinned = null;
+  constructor(base) {
+    this.#base = base;
+  }
+  /** Returns the currently active client (pinned if set, otherwise base). */
+  get active() {
+    return this.#pinned ?? this.#base;
+  }
+  /**
+   * Pin a DbClient so all subsequent calls route through it until unpinned.
+   * Throws if a client is already pinned to avoid silent overrides.
+   */
+  pin(client) {
+    if (this.#pinned) {
+      throw new Error("RoutingDbClient already has a pinned client");
+    }
+    this.#pinned = client;
+  }
+  unpin() {
+    this.#pinned = null;
+  }
+  get $pool() {
+    return this.#base.$pool;
+  }
+  connect() {
+    return this.active.connect();
+  }
+  none(query, values) {
+    return this.active.none(query, values);
+  }
+  one(query, values) {
+    return this.active.one(query, values);
+  }
+  oneOrNone(query, values) {
+    return this.active.oneOrNone(query, values);
+  }
+  any(query, values) {
+    return this.active.any(query, values);
+  }
+  manyOrNone(query, values) {
+    return this.active.manyOrNone(query, values);
+  }
+  many(query, values) {
+    return this.active.many(query, values);
+  }
+  query(query, values) {
+    return this.active.query(query, values);
+  }
+  tx(callback) {
+    return this.active.tx(callback);
+  }
+};
 
 // src/storage/db/constraint-utils.ts
 var POSTGRES_IDENTIFIER_MAX_LENGTH = 63;
@@ -17062,7 +17218,10 @@ var SkillsPG = class _SkillsPG extends storage.SkillsStorage {
         } = latestVersion;
         const newConfig = { ...latestConfig, ...configFields };
         const changedFields = SNAPSHOT_FIELDS5.filter(
-          (field) => field in configFields && JSON.stringify(configFields[field]) !== JSON.stringify(latestConfig[field])
+          (field) => field in configFields && !skills.skillSnapshotFieldValuesEqual(
+            configFields[field],
+            latestConfig[field]
+          )
         );
         if (changedFields.length > 0) {
           versionCreated = true;
@@ -19006,6 +19165,8 @@ function exportSchemas(schemaName) {
 }
 var PostgresStore = class extends storage.MastraCompositeStore {
   #pool;
+  // Narrowed to RoutingDbClient so init()'s pin/unpin path is type-checked.
+  // The public `db` getter still exposes it as DbClient.
   #db;
   #ownsPool;
   #poolClosed = false;
@@ -19024,7 +19185,7 @@ var PostgresStore = class extends storage.MastraCompositeStore {
         this.#pool = this.createPool(config);
         this.#ownsPool = true;
       }
-      this.#db = new PoolAdapter(this.#pool);
+      this.#db = new RoutingDbClient(new PoolAdapter(this.#pool));
       const domainConfig = {
         client: this.#db,
         schemaName: this.schema,
@@ -19080,11 +19241,13 @@ var PostgresStore = class extends storage.MastraCompositeStore {
     if (this.isInitialized) {
       return;
     }
+    const pinnedClient = await this.#pool.connect();
+    const pinned = new PinnedClientAdapter(this.#pool, pinnedClient);
     try {
-      this.isInitialized = true;
+      this.#db.pin(pinned);
       await super.init();
+      this.isInitialized = true;
     } catch (error$1) {
-      this.isInitialized = false;
       if (error$1 instanceof error.MastraError) {
         throw error$1;
       }
@@ -19096,6 +19259,9 @@ var PostgresStore = class extends storage.MastraCompositeStore {
         },
         error$1
       );
+    } finally {
+      this.#db.unpin();
+      pinnedClient.release();
     }
   }
   /**