[pyramation]

Summary

Moves every pgsql-parser dependency onto the latest release, which is built on libpg-query@18.2.0. That build fixes silent input truncation at non-BMP characters / embedded NUL, and recovers the WASM module after an exception escapes a call (previously the parser could stay broken for the rest of the process).

Generated with npx makage deps ../pgsql-parser --install (22 ranges), plus packages/safegres direct libpg-query ^18.1.4 → ^18.2.0 so it explicitly requires the fixed build.

package	dependency	from → to
@pgpmjs/transform	@pgsql/scripts	^18.4.12 → ^18.5.0
@pgpmjs/transform	@pgsql/semantics	^18.1.13 → ^18.2.0
@pgpmjs/transform	@pgsql/transform	^18.17.12 → ^18.18.0
@pgpmjs/transform	plpgsql-parser	^18.5.14 → ^18.6.0
@pgpmjs/slice	plpgsql-parser	^18.5.14 → ^18.6.0
@pgpmjs/core	pgsql-deparser / pgsql-parser	^18.3.12 / ^18.2.12 → ^18.4.0 / ^18.3.0
pgpm	pgsql-deparser	^18.3.12 → ^18.4.0
safegres	@pgsql/lint / @pgsql/traverse	^18.2.12 / ^18.7.14 → ^18.3.0 / ^18.8.0
safegres	pgsql-deparser / pgsql-parser	^18.3.12 / ^18.2.12 → ^18.4.0 / ^18.3.0
safegres	libpg-query	^18.1.4 → ^18.2.0
node-type-registry	@pgsql/utils / pgsql-deparser	^18.2.14 / ^18.3.12 → ^18.3.0 / ^18.4.0
csv-to-pg	@pgsql/utils / pgsql-deparser / pgsql-parser	^18.2.14 / ^18.3.12 / ^18.2.12 → ^18.3.0 / ^18.4.0 / ^18.3.0
@constructive-io/query-builder	pgsql-deparser	^18.3.12 → ^18.4.0
pg-ast	pgsql-deparser	^18.3.12 → ^18.4.0
graphile-sql-expression-validator	pgsql-deparser / pgsql-parser	^18.3.12 / ^18.2.12 → ^18.4.0 / ^18.3.0
graphile-function-source	plpgsql-parser	^18.5.14 → ^18.6.0

Lockfile re-formatted with prettier after install (diff limited to the bumped packages); it now resolves only libpg-query@18.2.0. pnpm install --frozen-lockfile is clean.

Local: pnpm build passes; tests pass for safegres, pgpm/core, pgpm/transform, pgpm/slice, pgpm/cli, csv-to-pg, pg-ast, query-builder, node-type-registry, graphile-sql-expression-validator, graphile-function-source.

Link to Devin session: https://app.devin.ai/sessions/8efd15a3044f470b85232d30590b6930
Open in Devin Desktop: https://app.devin.ai/desktop/session/8efd15a3044f470b85232d30590b6930?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This PR is a coordinated dependency version bump across 11 packages in the monorepo, with no source-code changes.

Files	Change
postgres/pg-ast, postgres/query-builder	Bump @pgsql parser/deparser/ast toolchain versions to the new aligned range.
pgpm/core, pgpm/transform, pgpm/slice, pgpm/cli	Bump shared @pgsql/deparser dependencies and related workspace references to match.
graphile/graphile-function-source, graphile/graphile-sql-expression-validator, packages/csv-to-pg, packages/node-type-registry, packages/safegres	Bump their @pgsql-family dependency versions to stay consistent with the monorepo-wide upgrade.

All changes are confined to package.json manifests; the lockfile already pins the new versions, and no code, behavior, or schema changes are included.

_{Reviewed commit: 3a32f74}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgsql/​lint@​18.2.12 ⏵ 18.3.0				+1
	@​pgsql/​semantics@​18.1.13 ⏵ 18.2.0				+1
	@​pgsql/​scripts@​18.4.12 ⏵ 18.5.0	+1			+1
	@​pgsql/​transform@​18.17.12 ⏵ 18.18.0	-1			+1
	@​pgsql/​utils@​18.2.14 ⏵ 18.3.0	-1			+1
	libpg-query@​18.1.5 ⏵ 18.2.0	+1		+1	+4
	@​pgsql/​traverse@​18.7.14 ⏵ 18.8.0	+1			+1
	pgsql-deparser@​18.3.12 ⏵ 18.4.0	+1			+1
	pgsql-parser@​18.2.12 ⏵ 18.3.0	+1			+1
	plpgsql-parser@​18.5.14 ⏵ 18.6.0

View full report