Refuse a malformed admin DSN before postgres 4 connects to the host it misreads

Release-Bump: major

.gitea/workflows/renovate.yml

@@ -21,7 +21,7 @@ jobs:
             -e RENOVATE_PLATFORM=gitea \
             -e RENOVATE_REPOSITORIES=${{ github.repository }} \
             -e RENOVATE_TOKEN \
-            renovate/renovate:44.199.2
+            renovate/renovate:44.222.3
 
   # After the renovate job, cut ONE tag covering the renovate-bot commits merged to main since the
   # last tag (batch per run). Targets origin/main — the real post-merge tip; the checkout SHA is the

package-lock.json

@@ -6,10 +6,10 @@
     "": {
       "name": "plainpages",
       "dependencies": {
-        "@larvit/log": "2.3.0",
+        "@larvit/log": "2.4.0",
         "ejs": "7.0.2",
         "lucide-static": "1.70.0",
-        "postgres": "3.4.9"
+        "postgres": "4.1.0"
       },
       "devDependencies": {
         "@mdn/browser-compat-data": "8.1.8",
@@ -23,9 +23,9 @@
       }
     },
     "node_modules/@larvit/log": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.3.0.tgz",
-      "integrity": "sha512-gLRMDWrFnoMGdAr9NXMXRKOUeceU6Qd/CW0c6qDO+DLFT1xWrqO2ubsHyPqPzlZHVUO3w3Bk7kOWo6C2Ykn4ZQ==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@larvit/log/-/log-2.4.0.tgz",
+      "integrity": "sha512-0BA1S0eSzQMOP527Vy2DL9Zb68TiCgyDACr0gDiI2b/1zfY6Axq9XhR/ZJnF9URIAhQwFPYs3W6lh/T9K8vqgQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -427,12 +427,12 @@
       "license": "ISC"
     },
     "node_modules/postgres": {
-      "version": "3.4.9",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.9.tgz",
-      "integrity": "sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-4.1.0.tgz",
+      "integrity": "sha512-s+0WH67YAyLdBQUb6XczbziBhY+C9uiQsg9S8R5RHdZhk6sdyK6202E+T2tXpiInSEEjDLRSJ3OpYBe3PN6MsQ==",
       "license": "Unlicense",
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       },
       "funding": {
         "type": "individual",

package.json

@@ -16,10 +16,10 @@
     "test": "node --test \"src/**/*.test.ts\" \"plugins/**/*.test.ts\" \"examples/**/*.test.ts\" \"registry-cleanup/**/*.test.ts\" \"release-tooling/**/*.test.ts\""
   },
   "dependencies": {
-    "@larvit/log": "2.3.0",
+    "@larvit/log": "2.4.0",
     "ejs": "7.0.2",
     "lucide-static": "1.70.0",
-    "postgres": "3.4.9"
+    "postgres": "4.1.0"
   },
   "devDependencies": {
     "@mdn/browser-compat-data": "8.1.8",

src/logger.test.ts

@@ -56,7 +56,7 @@ test("createLogger: a set endpoint actually exports log records over OTLP/HTTP",
   try {
     const log = createLogger({ otlpEndpoint: "http://collector:4318", stderr: () => {}, stdout: () => {} });
     log.info("exported");
-    await new Promise((r) => setTimeout(r, 50)); // export is fire-and-forget in the background
+    await log.flush(); // the queue batches records for up to a second
   } finally {
     globalThis.fetch = orig;
   }

src/plugin-host/storage-provisioning.ts

@@ -20,6 +20,7 @@ export interface ProvisionResult {
 // so it is swallowed here. The driver, not `new URL`, decides what parses: it takes a multi-host DSN.
 function connect(adminUrl: string): ReturnType<typeof postgres> {
   try {
+    new URL(adminUrl); // postgres 4 connects to whatever a malformed DSN parses to, and its error names that host
     return postgres(adminUrl, { connect_timeout: 10, max: 1 });
   } catch {
     throw new Error("PLUGIN_DB_ADMIN_URL must be a Postgres URL (its value is not shown; percent-encode special characters in a password)");