pgserve 2.6.4 → 2.6.6

package/CHANGELOG.md

@@ -14,6 +14,56 @@ All notable changes to `pgserve` are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres
 to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.6.6] - 2026-05-12
+
+**Hot-fix follow-up to v2.6.5.** v2.6.5 published to npm but build-tarballs
+still failed with the same `scratch: unbound variable` error because
+v2.6.5's fix (initialize `local scratch=""` before the trap) wasn't
+sufficient — bash's RETURN trap appears to evaluate `$scratch` AFTER
+the function frame is popped, in the parent scope where the local
+is no longer visible.
+
+### Fixed
+
+- `scripts/fetch-postgres-bins.sh` (both `stage_from_pkg` and
+  `stage_from_url`) — make the RETURN trap unbound-safe regardless of
+  bash function-scope quirks by guarding the rm with
+  `[[ -n "${scratch:-}" ]] && rm -rf "$scratch"`. Defensive default-empty
+  expansion protects against:
+  - in-function fire (normal): scratch is a tempdir → rm runs
+  - out-of-function fire (bash 5.x scope quirk): scratch is empty → skipped
+  - pre-mktemp fire (early return): scratch is empty → skipped
+
+### Same payload as v2.6.5
+
+All v2.6.4 + v2.6.5 changes carry forward. v2.6.6 is purely the
+build-tarballs / GH Releases completion. The npm runtime surface is
+identical across v2.6.4/5/6.
+
+## [2.6.5] - 2026-05-12
+
+**Hot-fix follow-up to v2.6.4.** v2.6.4 published to npm cleanly but the
+GitHub Releases pipeline failed at `build-tarballs.yml` due to a latent
+bug in `scripts/fetch-postgres-bins.sh` — `stage_from_url` declared
+`local scratch` without initialization, and the function's RETURN trap
+referenced `$scratch` under `set -u`, triggering an `unbound variable`
+error that propagated across function frames and masked the real
+fetch state. (Codex P2 caught the same pattern in `stage_from_pkg`
+during PR #84 review; `stage_from_url` was missed at that time.)
+
+### Fixed
+
+- `scripts/fetch-postgres-bins.sh:156` — initialize `local scratch=""`
+  before installing the RETURN trap, mirroring the fix already applied
+  to `stage_from_pkg` at line 119.
+
+### Same payload as v2.6.4
+
+All v2.6.4 changes carry forward unchanged. v2.6.5 is purely the
+GitHub Releases pipeline completion — npm consumers on
+`pgserve: ^2.x` who already picked up v2.6.4 will see v2.6.5 on next
+install but the runtime surface is identical.
+
 ## [2.6.4] - 2026-05-12
 
 **Final v2.x maintenance release** — the last `pgserve`-named npm publish.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgserve",
-  "version": "2.6.4",
+  "version": "2.6.6",
   "description": "Embedded PostgreSQL server with true concurrent connections - zero config, auto-provision databases",
   "main": "src/index.js",
   "type": "module",

package/scripts/fetch-postgres-bins.sh

@@ -117,7 +117,7 @@ stage_from_pkg() {
   # `scratch: unbound variable` and mask the real fetch error
   # (chatgpt-codex P2 review on PR #84).
   local scratch=""
-  trap 'rm -rf "$scratch"' RETURN
+  trap '[[ -n "${scratch:-}" ]] && rm -rf "$scratch"' RETURN
   scratch=$(mktemp -d) || return 1
 
   pushd "$scratch" >/dev/null
@@ -153,9 +153,16 @@ stage_from_url() {
   url="${url//\{pf\}/$pf}"
   echo "    -> source: $url"
 
-  local scratch
-  scratch=$(mktemp -d)
-  trap 'rm -rf "$scratch"' RETURN
+  # Initialize before installing trap — same fix stage_from_pkg has at
+  # line 119. Under `set -u` the RETURN trap fires on any early-return
+  # path (including ones where `mktemp` hasn't run yet); referencing an
+  # unset `$scratch` from the trap would print
+  # `scratch: unbound variable` and leak across function frames,
+  # masking the real fetch error (codex P2 review on PR #84 fixed this
+  # for stage_from_pkg; stage_from_url was missed at the time).
+  local scratch=""
+  trap '[[ -n "${scratch:-}" ]] && rm -rf "$scratch"' RETURN
+  scratch=$(mktemp -d) || return 1
 
   curl -fsSL "$url" -o "${scratch}/pg.tar.gz"
   tar -xzf "${scratch}/pg.tar.gz" -C "$scratch"