[bgentry]

Upgrade the node-postgres type definitions to 8.23.1 consistently across the workspace, PostgreSQL driver, CLI, and examples. Aligning these packages gives applications and the driver the same Pool and ClientBase definitions under strict TypeScript checking.

[bgentry]

🤖 Codex review: Dependency security and compatibility checks are clear on b1b7950f9124ee70c499c06760c975b9835bf48e.

Upgrade

• @types/pg: 8.20.0 → 8.23.1 across seven workspace manifests/importers. The node-postgres example's previous range was ^8.11.0, resolving to 8.20.0.

Security review

• Compared actual published declarations and metadata, verified tarball SHA-512 against both registry metadata and the lockfile, and reused matching signature/source evidence. Publisher remains Microsoft's types account and source remains DefinitelyTyped. No lifecycle scripts, executable code, native artifacts, or bins are introduced.
• This is the sole changed package identity. All retained integrity and metadata entries are unchanged; type transitives remain @types/node 26.1.1, pg-protocol 1.13.0, and pg-types 2.2.0. The Prisma adapter only retargets its types edge. Current exact-version advisory queries found no records for these reviewed types/transitives.

Compatibility verification

• Frozen install, build:all, typecheck:tests, typecheck:next, migration/API/docs/snippet/legacy-fixture checks, lint/format/license checks — passed.
• Full local tests — 1,381 unit tests and 190 integration tests passed. All nine package archives and eight packed examples passed validation. No tracked drift after verification.
• Hosted JavaScript CI passed on Node 24 and 26, including package consumers and PostgreSQL 14–18 integration coverage. No source compatibility shim or weakening of type checks was needed.

Review status

• This is a comment-only review because the authenticated account authored the PR. An independent maintainer approved this exact head, and all 35 hosted checks passed, including the remaining CodeQL analysis.

Residual risk

• No blocking issue identified within this dependency change; registry provenance verification does not provide a reproducible build proof.