[pyramation]

Summary

@pgsql/traverse@18.8.3 listed pg-proto-parser as a runtime dependency, so pg-proto-parser → @launchql/protobufjs was installed for every consumer of safegres, @pgpmjs/transform, @pgpmjs/slice and graphile-function-source, and from there for pgpm, @pgpmjs/core, pgsql-test and others downstream. This came from constructive-io/pgsql-parser#376, which shipped in @pgsql/traverse@18.8.4.

npx makage deps ../pgsql-parser --install bumps to that release:

package	from	to
plpgsql-parser	18.6.3	18.6.4
@pgsql/lint	18.3.5	18.3.6
@pgsql/traverse	18.8.3	18.8.4
@pgsql/transform	18.18.3	18.18.4
@pgsql/semantics	18.2.3	18.2.4
@pgsql/scripts	18.5.3	18.5.4
@pgsql/utils	18.3.3	18.3.4
pg-proto-parser (devDependency of pg-ast)	1.32.5	1.32.6

After this, the only importer that still reaches @launchql/protobufjs is the pg-proto-parser devDependency of postgres/pg-ast, which runs at build time for codegen. So the @launchql entries in pnpm-workspace.yaml stay for this repo, but published packages no longer carry them to downstream repos.

The lockfile was run through prettier to keep the committed format. Part of constructive-io/constructive-planning#2459.

Link to Devin session: https://app.devin.ai/sessions/10c9e261a5334448b61df498ecd447d1
Open in Devin Desktop: https://app.devin.ai/desktop/session/10c9e261a5334448b61df498ecd447d1?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found.

---

This PR is a routine dependency-refresh: it raises patch versions of the shared PostgreSQL parsing/analysis toolchain across the four packages that consume it, keeping every manifest on the same resolved versions. No source code, configuration, or lockfile content changes; the root lockfile already pins the new versions, so manifests and lockfile agree with no drift.

_{Reviewed commit: ec0134b}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pg-proto-parser@​1.32.5 ⏵ 1.32.6	+5			-8
	@​pgsql/​lint@​18.3.5 ⏵ 18.3.6				+1
	@​pgsql/​scripts@​18.5.3 ⏵ 18.5.4				+1
	@​pgsql/​transform@​18.18.3 ⏵ 18.18.4	+3			+1
	@​pgsql/​semantics@​18.2.3 ⏵ 18.2.4	+3			+1
	@​pgsql/​traverse@​18.8.3 ⏵ 18.8.4	+1			+1
	@​pgsql/​utils@​18.3.3 ⏵ 18.3.4	+2			+1
	plpgsql-parser@​18.6.3 ⏵ 18.6.4				+1

View full report