build(deps): bump the db-prod group across 1 directory with 5 updates

[dependabot]

Bumps the db-prod group with 5 updates in the /db directory:

Package	From	To
@clickhouse/client	1.18.3	1.20.0
cassandra-driver	4.8.0	4.9.0
kysely	0.28.17	0.29.2
pg	8.20.0	8.21.0
umzug	3.8.2	3.8.3

Updates @clickhouse/client from 1.18.3 to 1.20.0

Release notes

Sourced from @​clickhouse/client's releases.

1.20.0

Bug Fixes

• (Node.js only) Fixed a race condition in ResultSet.json() and ResultSet.stream() on JSONEachRow (and other streamable) result sets where calling json() on a fast/small response could throw Stream has been already consumed if the underlying stream ended between internal readableEnded checks. The consumption guard has been hardened: the stream is now shielded through a single consume() path that marks the result set as consumed in the appropriate branches, after format validation, so a successful json() call no longer races against the stream finishing. (#603) kudos to @​lord007tn and @​Onyx2406

#603: ClickHouse/clickhouse-js#603

1.19.0

Improvements

• Re-exported the ResponseHeaders type from @clickhouse/client and @clickhouse/client-web. Previously this type was only available from @clickhouse/client-common; it is now part of the public re-export surface of both flavored packages, alongside the other commonly used types. This is part of an ongoing effort to make @clickhouse/client-common an internal-only package so downstream consumers can depend solely on @clickhouse/client or @clickhouse/client-web. (#758)

#758: ClickHouse/clickhouse-js#758

Bug Fixes

• Enum type parsing now correctly unescapes backslash escape sequences in enum names. Previously, parseEnumType returned enum names with raw escape sequences (e.g., f\' instead of f'). Now it properly decodes escape sequences including \' (single quote), \\ (backslash), \n (newline), \t (tab), and \r (carriage return). This matches the behavior of ClickHouse string literals and ensures consistency with how the client encodes strings when sending data to the server. If you were relying on the previous incorrect behavior where backslash escape sequences were preserved in enum names, you will need to update your code to handle properly unescaped values.

Example:

// Before (incorrect):
parseEnumType({
  columnType: "Enum8('f\\'' = 1)",
  sourceType: "Enum8('f\\'' = 1)",
})
// returned: { values: { 1: "f\\'" } }  // with backslash
// After (correct):
parseEnumType({
columnType: "Enum8('f\'' = 1)",
sourceType: "Enum8('f\'' = 1)",
})
// returns: { values: { 1: "f'" } }     // unescaped

1.18.5

Improvements

• (Node.js only) Added max_response_headers_size client option that forwards the maxHeaderSize option to the underlying http(s).request call. This raises the per-request limit on the total size of HTTP response headers received from the server (Node.js default is ~16 KB). It is most useful when running long-running queries with send_progress_in_http_headers enabled — the X-ClickHouse-Progress headers accumulate over the lifetime of the request and can exceed the default limit, causing the request to fail with HPE_HEADER_OVERFLOW. Setting this option avoids the need to use the global --max-http-header-size Node.js CLI flag or the NODE_OPTIONS environment variable. Has no effect for the Web client (which uses fetch) and no effect when a custom http_agent is configured with a request implementation that does not honor the option.

const client = createClient({
  request_timeout: 400_000,
  max_response_headers_size: 1024 * 1024, // accept up to 1 MiB of response headers
  clickhouse_settings: {
    send_progress_in_http_headers: 1,
    http_headers_progress_interval_ms: '110000',
  },
})
</tr></table> 

... (truncated)

Changelog

Sourced from @​clickhouse/client's changelog.

1.20.0

New Features

• Added an optional tracer API that the user can pass through the client config (tracer) and that gets called around key lifecycle operations (query, command, exec, insert, ping). The ClickHouseTracer interface is a structural subset of the OpenTelemetry Tracer/Span APIs, so a raw OTEL tracer (trace.getTracer(...)) can be passed to the client as-is - but the client itself ships no tracing dependency. Each operation runs inside tracer.startActiveSpan(...), so auto-instrumented child spans nest under the ClickHouse operation spans; for OpenTelemetry, this requires the AsyncLocalStorageContextManager to be registered (the default in the OpenTelemetry Node.js SDK). Tracer exceptions are NOT caught, so a broken tracer will break client operations. See docs/howto/tracing.md for the full surface description, and examples/node/coding/otel_tracing.ts for a runnable Node.js example. (#776)

import { createClient } from "@clickhouse/client";
import { trace } from "@opentelemetry/api";
// a raw OpenTelemetry tracer is structurally compatible - no adapter needed
const client = createClient({
url: "http://localhost:8123",
tracer: trace.getTracer("@​clickhouse/client"),
});

Migration Notes

• TypeScript: ClickHouseLogLevel is now exported as a literal numeric union type (0 | 1 | 2 | 3 | 4 | 127) instead of a TypeScript enum type. If you were assigning arbitrary number values to ClickHouseLogLevel, you may need to narrow/cast those values during migration.

Improvements

• Added TypeScript typings for the remaining HTTP-specific ClickHouse settings, so they are now suggested by autocomplete when used in clickhouse_settings: buffer_size, compress, decompress, quota_key, and stacktrace (in addition to the existing wait_end_of_query, default_format, session_timeout, and session_check).

await client.query({
  query: "SELECT 1",
  clickhouse_settings: {
    // Buffer the entire response on the server before sending it to the client
    wait_end_of_query: 1,
    buffer_size: "1048576",
  },
});

Bug Fixes

• (Node.js only) Fixed a race condition in ResultSet.json() and ResultSet.stream() on JSONEachRow (and other streamable) result sets where calling json() on a fast/small response could throw Stream has been already consumed if the underlying stream ended between internal readableEnded checks. The consumption guard has been hardened: the stream is now shielded through a single consume() path that marks the result set as consumed in the appropriate branches, after format validation, so a successful json() call no longer races against the stream finishing. (#603)

#603: ClickHouse/clickhouse-js#603

1.19.0

Improvements

• Re-exported the ResponseHeaders type from @clickhouse/client and @clickhouse/client-web. Previously this type was only available from @clickhouse/client-common; it is now part of the public re-export surface of both flavored packages, alongside the other commonly used types. This is part of an ongoing effort to make @clickhouse/client-common an internal-only package so downstream consumers can depend solely on @clickhouse/client or @clickhouse/client-web. (#758)

#758: ClickHouse/clickhouse-js#758 #776: ClickHouse/clickhouse-js#776

... (truncated)

Commits

• 97f135e Merge pull request #806 from ClickHouse/main
• 8b1d694 Split combined tests workflow into separate node and web workflows (#807)
• 7ae476f Clarify query() vs exec() in JSDocs (#804)
• 2c9823b Skills update 3 (#805)
• 8165ca9 Add QBit data type example with JSON formats (#781)
• 86c1762 Document UUID → UInt128 insert patterns with round-trip assertion (#780)
• 1e21970 Run unit tests under Bun, make MAX_STRING_LENGTH handling engine-agnostic, an...
• e217f80 Npm audit fix 1 (#796)
• 4ad8457 Add AI_POLICY.md (#786)
• 09e4b11 Update CHANGELOG.md (#792)
• Additional commits viewable in compare view

Updates cassandra-driver from 4.8.0 to 4.9.0

Changelog

Sourced from cassandra-driver's changelog.

4.9.0

2026-04-23

This release marks the first release of the driver under the Apache Software
Foundation, following its donation from DataStax.

Features

• [NODEJS-692] - Add Node.js v24 support
• [CASSNODEJS-2] - Update CONTRIBUTING.md after ASF donation, drop Node.js 18 support
• [CASSNODEJS-4] - Update DRIVER_NAME after donation to ASF
• [CASSNODEJS-3] - Public CI after Donation

Bug fixes

• [PR #432] - Fix retry on socket error
• [NODEJS-693] - Remove broken jsdoc from 4.8.0
• [NODEJS-691] - Fix generated timestamp on retry

Commits

• 1c0a7df ninja-fix: Changelog and version bump for 4.9.0
• e5957d6 CASSNODEJS-3: Public CI after Donation
• d3ddcbf CASSNODEJS-4 Update DRIVER_NAME after donation to ASF
• 65507c5 Bump picomatch from 2.3.1 to 2.3.2
• b0a6b61 Bump serialize-javascript and mocha
• 8fa4399 Bump tar-fs from 2.1.2 to 2.1.4
• 6c70446 CASSNODEJS-2 Update CONTRIBUTING.md after ASF donation (#453)
• 3b4ce72 Donation to Apache Cassandra and ASF
• acea0b9 NODEJS-691 Fix generated timestamp on retry (#438)
• c0a6c5f Added NPM badge to README.md (#437)
• Additional commits viewable in compare view

Updates kysely from 0.28.17 to 0.29.2

Release notes

Sourced from kysely's releases.

0.29.2

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

• fix: $narrowType mishandling branded types. by @​igalklebanov in kysely-org/kysely#1851

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.29.1...v0.29.2

0.29.1

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

• fix: regression in piping of plugins' result transformations. by @​igalklebanov in kysely-org/kysely#1840

📖 Documentation

📦 CICD & Tooling

• ci: test node.js v26. by @​igalklebanov in kysely-org/kysely#1841
• ci: harden github workflows with the help of zizmor scans. by @​igalklebanov in kysely-org/kysely#1843
• ci: split node tests by variant. by @​igalklebanov in kysely-org/kysely#1848

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: kysely-org/kysely@v0.29.0...v0.29.1

... (truncated)

Commits

• e17673f 0.29.2
• 9e010f9 bump pnpm.
• 39c6772 bump wrangler.
• 00400f8 fix: $narrowType mishandling branded types. (#1851)
• 3abc5fe 0.29.1
• 5134c00 ci: split node tests by variant. (#1848)
• a8d53c1 chore(deps): bump step-security/harden-runner from 2.19.2 to 2.19.3 (#1844)
• 77bac3e chore(deps-dev): bump @​types/node from 25.7.0 to 25.8.0 (#1846)
• 0b0aaa8 chore(deps-dev): bump tsx from 4.21.0 to 4.22.0 (#1845)
• 763c4aa ci: harden github workflows with the help of zizmor scans. (#1843)
• Additional commits viewable in compare view

Updates pg from 8.20.0 to 8.21.0

Changelog

Sourced from pg's changelog.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

Commits

• 544b1ce Publish
• cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
• f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
• f252870 cleanup: pg utils (#3675)
• c8da6ab Assorted test cleanup (#3673)
• fa47e73 fix: Client#end callback being called multiple times when first is no-op (#...
• 88a7e60 cleanup: Move declaration to more natural place
• 2095247 cleanup: Combine duplicated code in Client#query and avoid unneeded early n...
• 0ac3edd fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 (#3669)
• be880d4 Assorted test fixes and cleanup (#3672)
• Additional commits viewable in compare view

Updates umzug from 3.8.2 to 3.8.3

Release notes

Sourced from umzug's releases.

v3.8.3

mostly just a security patch update

pnpm audit --prod output before 4272daa25ac2fed4e71973f04253f8219f42c26c:

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Validator is Vulnerable to Incomplete Filtering of One │
│                     │ or More Instances of Special Elements                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ validator                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.22                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=13.15.22                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @rushstack/ts-command-line@4.19.1 >                │
│                     │ @rushstack/terminal@0.10.0 >                           │
│                     │ @rushstack/node-core-library@4.0.2 > z-schema@5.0.5 >  │
│                     │ validator@13.11.0                                      │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-vghf-hv5q-vc2g      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Picomatch has a ReDoS vulnerability via extglob        │
│                     │ quantifiers                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ picomatch                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <4.0.4                                         │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.0.4                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > tinyglobby@0.2.13 > fdir@6.4.4 > picomatch@4.0.2   │
│                     │                                                        │
│                     │ . > tinyglobby@0.2.13 > picomatch@4.0.2                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2c7-rcm5-vvqj      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ validator.js has a URL validation bypass vulnerability │
│                     │ in its isURL function                                  │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ validator                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.20                                              │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=13.15.20                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @rushstack/ts-command-line@4.19.1 >                │
</tr></table> 

... (truncated)

Commits

• d79c19f 3.8.3
• b70ce38 Merge branch 'main' of https://github.com/sequelize/umzug
• 4272daa Clear production dependency audit findings
• abda313 chore(deps): update dependency uuid to v14 [security] (#719)
• 61d255d chore(deps): update dependency lodash to v4.18.1 [security] (#721)
• fed3a8d bump test timeout? (#711)
• 165efc6 update vitest coverage package
• 9c7e96f no output in tests
• 8bce216 bump sqlite3 and vitest
• 317623c lint fix
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[dependabot]

Dependabot can't access a private package registry without explicit configuration. Because of this, Dependabot cannot update this pull request.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.