Skip to content

fix(credits): static pg/libsql-pg imports for the module pool - #141

Merged
ralyodio merged 1 commit into
masterfrom
fix/credits-pg-pool
Oct 27, 2026
Merged

ralyodio merged 1 commit into
masterfrom
fix/credits-pg-pool

Conversation

@ralyodio

Copy link
Copy Markdown
Collaborator

Follow-up to #140. In production every /api/credits and /api/invites call 500'd with TypeError: i is not a function: require('@profullstack/libsql-pg') (an ESM server external) from the Next bundle came back without connectionSettings. Both pg and libsql-pg are now static imports.

Verified with bun run build && bun run start against a scratch Postgres database: redeem ok (7 days, plan paid), second redeem already_redeemed, two concurrent invite accepts (one pending, the other already_invited and still unused). bun test tests/ 272 pass, tsc --noEmit clean.

🤖 Generated with Claude Code

require() of the ESM server external @profullstack/libsql-pg from the Next
bundle returned no connectionSettings, so every credits/invites API call 500'd
in production ("i is not a function"). Verified against a production build on
a scratch Postgres database: redeem, already_redeemed, concurrent invite accept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​types/​pg@​8.23.11001007385100

View full report

@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

22 finding(s)

HIGH/CRITICAL: 2 | MEDIUM: 14 | LOW: 6

Severity Rule Location
HIGH sh-remote-script-execution public/install.sh:302
HIGH sh-remote-script-execution public/install.sh:305
MEDIUM js-open-redirect app/dashboard/[[...tab]]/page.tsx:67
MEDIUM js-open-redirect app/signup/page.tsx:46
MEDIUM js-unescaped-html-sink components/PitFooter.tsx:30
MEDIUM js-open-redirect components/PitSearch.tsx:118
MEDIUM js-unescaped-html-sink components/Tenant.tsx:29
MEDIUM js-unescaped-html-sink components/Tenant.tsx:30
MEDIUM js-unescaped-html-sink components/Tenant.tsx:78
MEDIUM js-unescaped-html-sink components/Tenant.tsx:150
MEDIUM sql-template-interpolation lib/db.ts:1227
MEDIUM sql-template-interpolation lib/db.ts:1257
MEDIUM redos-nested-quantifier lib/markdown.ts:109
MEDIUM sh-remote-script-execution public/install.sh:123
MEDIUM sh-remote-script-execution public/install.sh:127
MEDIUM sh-remote-script-execution public/install.sh:146
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:18
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:25
LOW secret-generic-credential tests/domain-webhook-active.test.mjs:30
LOW secret-generic-credential tests/project-webhook-management.test.mjs:53
LOW secret-generic-credential tests/signup-profile.test.mjs:28
LOW secret-generic-credential tests/signup-profile.test.mjs:39

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9feae10 into master Oct 27, 2026
5 checks passed
@ralyodio
ralyodio deleted the fix/credits-pg-pool branch October 27, 2026 03:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant