[robinbowes]

Summary

postgres.js, the postgres driver behind openDatabase, moves from 3.4.9 to 4.0.0. v4 rewrites the pool, protocol and socket layer below an unchanged API.

 apps/web/package.json     "postgres": "^3.4.9"  →  "^4.0.0"
 apps/evals/package.json + "postgres": "^4.0.0"   (devDependency)

Why apps/evals gains the dependency: it imports drizzle-orm, whose postgres peer resolved to 3.4.9 there and 4.0.0 in apps/web. pnpm then installs two copies of Drizzle, and their SQL<…> types don't mix, so the evals typecheck failed. Declaring it gives one drizzle-orm@0.45.4(postgres@4.0.0), and no postgres@3 is left in the lockfile.

What v4 changes and how it reaches the kit:

v4 change	In the kit
Server-typed parameters: a Date meets a timestamp/date column as UTC	Doesn't apply. All 42 timestamp columns are withTimezone: true, there are no date() columns, and the SQL templates compare columns with now(), not with raw Date values.
sql.array() removed	Not used anywhere, including the analytics plugin.
Workers: workerd export condition on cloudflare:sockets	build:api succeeds. The API bundle grows from 708 to 731 KiB gzip.
Stricter transaction and connection rules	The driver conformance suite passes under both drivers.

The options and hooks the seam relies on still work in v4: prepare: false and fetch_types: false are applied at runtime, and client.options.parsers is still the map ARRAY_PARSERS merges into. tests/driver/driver.test.ts round-trips text[], int[], bigint[] and bool[] through those parsers.

Evidence

• Before: with the bump alone, apps/evals typecheck fails with 11 drizzle-orm type errors from the two copies.
  After: pnpm gate passes on Node 26.13.0: api 638, the other web projects 1807 + 5 skipped, driver conformance under neon 13, cli 58, evals 25, and build:api succeeds.
• The analytics plugin: I reproduced kit.yml's plugins job in a throwaway worktree (analytics 3.4.2, GATE_SUITE_DRIVER=neon). All green: api 685 including the plugin's cube-isolation tests, the other web projects 1859, driver 13.
• The review gate found no defects. The four things it couldn't check without dependencies installed (the parsers hook, the two options, the unsafe() cast, the plugin's source) were checked locally as above.

Merge Danger

Door: two-way

Blast Radius: database

Every query goes through the new pool and protocol. The conformance suite and the full suite under both drivers are the evidence; nothing in the kit's own code changes.

🤖 Generated with Claude Code