[pyramation]

Summary

Moves the 18 line onto the new libpg-query@18.2.0. It fixes input being silently cut off at non-BMP characters or an embedded NUL, and lets the WASM module recover after an exception escapes a call. The build is now pinned to an exact C commit and emsdk 6.0.3, and the release records x-publish.wasmSha256. Before this PR, every package here pins libpg-query to exactly 18.1.5, so their users can't get the fixes.

• libpg-query goes from 18.1.5 to 18.2.0 in the 9 packages that pin it: parser, plpgsql-parser, parse, plpgsql-parse, plpgsql-deparser, lint, and the devDeps of deparser, pgsql-types and transform-ast. No API changes.
• pnpm-lock.yaml: only the libpg-query specifier, version and integrity lines change, so the existing formatting is kept. pnpm install --frozen-lockfile passes.
• config/versions.json and the pg13–17 tagged packages are intentionally unchanged, so they are not republished. Users who want the fixes upgrade to 18.

Testing

pnpm build passes, and so does pnpm -r --no-bail test, except for 3 failures that also fail on main with 18.1.5:

• @pgsql/cli and pgsql-types have no tests (jest reports "No tests found").
• One plpgsql-parse round-trip snapshot (status = v_status,total) fails; I checked out main and confirmed it fails there too.

Link to Devin session: https://app.devin.ai/sessions/bcd8b2f791164247acb7a659b481efc2
Open in Devin Desktop: https://app.devin.ai/desktop/session/bcd8b2f791164247acb7a659b481efc2?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟡 1 medium

📍 Findings outside the diff (1) — 🟡 1 medium — defects on lines GitHub can't attach comments to

🟡 Medium — Bump libpg-query without bumping subpackage versions · versions.json:3–44 · unchanged line

// config/versions.json
3	    "13": {
4	      "libpg-query": "13.8.0",
5	      "pgsql-parser": "13.19.1",
6	      "pgsql-deparser": "13.19.1",
7	      "@pgsql/types": "13.11.1",
8	      "npmTag": "pg13"
9	    },
10	    "14": {
11	      "libpg-query": "14.5.0",
12	      "pgsql-parser": "14.1.1",
13	      "pgsql-deparser": "14.1.1",
14	      "@pgsql/types": "14.1.1",

The diff bumps libpg-query for every PG line (13.8.0, 14.5.0, 15.7.0, 16.8.0, 17.8.0, 18.2.0) but leaves each row's pgsql-parser/pgsql-deparser version unchanged (e.g. 13.19.1, 18.0.0) (config/versions.json:3-44). prepare-versions.ts stamps the generated subpackage version from these same fields (packages/parser/config/package.template.json:3), so the regenerated packages declare identical version numbers while pinning a new libpg-query dependency. Since npm versions are immutable, npm publish will fail with E409 and the pg13…pg18 dist-tags will keep resolving to packages still depending on the old WASM binaries.

---

The change updates the PostgreSQL version matrix in config/versions.json and aligns every package manifest's libpg-query pin with the new 18.2.0 release. The lockfile already agrees with the new pin, and per-PG-version subpackage generation reads from the updated matrix.

Files	Change
config/versions.json	Bumps libpg-query per PG version row (13.8.0, 14.5.0, 15.7.0, 16.8.0, 17.8.0, 18.2.0) without changing pgsql-parser/pgsql-deparser subpackage versions
packages/*/package.json (deparser, lint, parse, parser, pgsql-types, plpgsql-deparser, plpgsql-parse, plpgsql-parser, transform-ast)	Updates libpg-query dependency pins to the new version

_{Reviewed commit: 46ae9bd}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	libpg-query@​18.1.5 ⏵ 18.2.0	+1		+1	+4

View full report