fix: normalize pg-boss sslmode to verify-full to silence deprecation warning #SUPERLOG - #439
fix: normalize pg-boss sslmode to verify-full to silence deprecation warning #SUPERLOG#439superlog-app[bot] wants to merge 1 commit into
Conversation
…warning #SUPERLOG Delivery-Id: f08632815ca6594ef044e8b16d5a06ddcf24ee9451df0950f71d82ef9532de6d Delivery-Base: main
![superlog-app[bot]](https://avatars.githubusercontent.com/in/3485414?s=60&v=4){kind=small}
| } | ||
| return url.toString(); | ||
| } catch { | ||
| return connectionString; |
There was a problem hiding this comment.
logs · warning — Log an error when DATABASE_URL cannot be parsed as a URL
Add an error-level log in the catch block so operators know the SSL normalization was skipped and pg-boss will receive the raw connection string; without it, a malformed DATABASE_URL silently bypasses the fix and the deprecation warning (or a future SSL regression) will reappear with no diagnostic trail.
| return connectionString; | |
| } catch (err) { | |
| logger.error({ err }, "toVerifyFullSsl: failed to parse DATABASE_URL; using original connection string"); | |
| return connectionString; | |
| } |
Useful? React with 👍 / 👎.
| url.searchParams.set("sslmode", "verify-full"); | ||
| } | ||
| return url.toString(); | ||
| } catch { |
There was a problem hiding this comment.
logs · warning — Log an error when DATABASE_URL cannot be parsed as a URL in the worker
Add an error-level log in the catch block so operators know the SSL normalization was skipped in the worker; without it, a malformed DATABASE_URL silently bypasses the fix and the deprecation warning (or a future SSL regression) will reappear with no diagnostic trail.
| } catch { | |
| } catch (err) { | |
| logger.error({ err }, "toVerifyFullSsl: failed to parse DATABASE_URL; using original connection string"); | |
| return connectionString; | |
| } |
Useful? React with 👍 / 👎.
1 participant
Summary
On every cold-start,
responder-control-plane(the Superlog API on Vercel) emits a Node.js process warning to stderr becausepg-bossinitializes with aDATABASE_URLcontainingsslmode=require. Vercel classifies all stderr output asERRORseverity, which opens a recurring noisy incident.Root cause
pg-bossuses thepgpackage (pg@8.21.0) internally. When pg-boss parses the connection string viapg-connection-string@2.13.0, it emits aprocess.emitWarningif thesslmodevalue isrequire,prefer, orverify-ca. These modes are currently aliased toverify-fullbut will adopt weaker standard libpq semantics inpg-connection-stringv3.0.0 /pgv9.0.0 (no server certificate verification).Affected files:
apps/api/src/user-created-publisher.ts— pg-boss for user-created events (hit on the/api/auth/sign-up/emailcold-start observed in the incident)apps/worker/src/jobs/runner.ts— pg-boss for background job runnerFix
Add a
toVerifyFullSslhelper in each file that normalises thesslmodequery param fromrequire | prefer | verify-ca→verify-fullbefore passing the connection string toPgBoss. This:pgboss-migrate.tsalready avoids this by using the env-var path (explicitsslobject option), so it is not affected.Incident: d6b3bec2-d51c-479a-bd65-8a7ff95a82eb
Was this PR helpful? Leave feedback — goes straight to the Superlog team.
Summary by cubic
Normalize
sslmodeinDATABASE_URLtoverify-fullbefore initializingpg-bossto stop deprecation warnings and Vercel ERROR logs. Keeps strict TLS verification now and inpgv9.toVerifyFullSsl()inapps/api/src/user-created-publisher.tsandapps/worker/src/jobs/runner.ts.require/prefer/verify-ca→verify-fullbeforepg-connection-stringruns.verify-fullbehavior.Written for commit dc4f64d. Summary will update on new commits.