Repository navigation
Migronaut v2: add baseline + out-of-order detection, harden redaction - #2
Merged
Merged
Conversation
…ilience Implements the August 2026 multi-agent code review (45 confirmed findings across maintainability, performance, security, scalability, resilience, governance and observability, plus the competitive analysis). Features - `migronaut baseline` — adopt an existing database with no prior migration tool: mark files on disk as applied (disk checksum, one shared batch, `origin: 'baseline'`) without executing them. Forward-only, idempotent, confirmation-gated, runs under the lock. - Out-of-order detection — a bulk `up` flags pending migrations sorting before the newest applied one. New `onOutOfOrder: 'warn' | 'error' | 'allow'` (env `MIGRONAUT_ON_OUT_OF_ORDER`), `MIGRATION_OUT_OF_ORDER` (exit 23), `StatusRow.outOfOrder`, and an `ordering` audit check. - Failed-attempt traces — a failing `up` leaves a best-effort `status:'failed'` record (error, `failedAt`, `runId`); never demotes an applied record, and a successful apply clears it. - Audit-trail read surface on `StatusRow` (executedBy, environment, runId, revertedAt, origin), `onKit` on `runMigrations`, exported `createLogger`, and a `cwd` option on `MigratorKit`. Security - Redaction now masks query-string secrets (tlsCertificateKeyFilePassword, proxyPassword, sslKeyPassword, secret authMechanismProperties values) and empty-username passwords — in logs, errors, `--json`, events and `init`-generated configs. - Terminal sanitization covers the whole C1 block (DCS/OSC/PM/APC), and bin's last-resort handlers sanitize their output. Resilience - Server-time `appliedAt`/`revertedAt`/`failedAt` stamps, so revert ordering survives host clock skew. - A non-transactional changelog-write failure after a committed body reports `phase: 'changelog-write'` instead of the generic migration failure. - `timeoutMs` aborts `ctx.signal`; SIGINT during pre-connect aborts the run; partial results survive hook/load and lock-release failures; `release()` without an owner token is a no-op. Performance - Bounded import checksum fan-out (EMFILE), single-round-trip uncontended lock acquire, cached strict drift check, covered-index `dry-run up`, stall-based `lockWaitTimeoutMs`. Docs and tests - New guides (baseline, seeding, mongoose, vs-migrate-mongo), refreshed ARCHITECTURE/README/SECURITY/CHANGELOG, four new sync pins, ESM-interop test. 712 tests green; coverage 97/94/98. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
`should abort the context signal when the timeout fires` awaits a promise that can only settle from `withTimeout`'s `unref()`ed timer, with a mock context as the only other handle. Node 24 keeps the loop alive there; Node 22 drains it, so the test runner cancelled the test — and, by cascade, the two suites after it (`fail 0`, `cancelled 3`, exit 1) on every Node 22 job. tests/helpers/event-loop.js exists for exactly this, and the sibling timeout test already used it; this one did not. Reproduced and verified on Node v22.23.1: 467/467 unit and 713/713 full, cancelled 0.
v1.0.0 is published on npm, so the contract changes in this cycle need a major
bump rather than folding into 1.0.0: `^1.0.0` would otherwise auto-upgrade
consumers into them.
Major because of three narrow breaks, now documented under their own CHANGELOG
heading with migration notes:
- `unlock --json` requires `--yes` (previously force-released the lock)
- `StatusRow.status` / `MigrationStatus` gained 'failed'
- `MigronautErrorCode` gained 'MIGRATION_OUT_OF_ORDER' (exit 23)
Everything else this cycle is additive, and the most commonly scripted surface
is untouched: `pendingMigrations()` / `list('pending')` still report a file as
pending even when a failed attempt was recorded for it.
Version references updated in the four hand-synced places: package.json,
CHANGELOG.md, SECURITY.md's supported-versions table, ARCHITECTURE.md's
snapshot line, and the docs site version dropdown.
Alex-Dolid
changed the title
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…ilience
Implements the August 2026 multi-agent code review (45 confirmed findings across maintainability, performance, security, scalability, resilience, governance and observability, plus the competitive analysis).
Features
migronaut baseline— adopt an existing database with no prior migration tool: mark files on disk as applied (disk checksum, one shared batch,origin: 'baseline') without executing them. Forward-only, idempotent, confirmation-gated, runs under the lock.upflags pending migrations sorting before the newest applied one. NewonOutOfOrder: 'warn' | 'error' | 'allow'(envMIGRONAUT_ON_OUT_OF_ORDER),MIGRATION_OUT_OF_ORDER(exit 23),StatusRow.outOfOrder, and anorderingaudit check.upleaves a best-effortstatus:'failed'record (error,failedAt,runId); never demotes an applied record, and a successful apply clears it.StatusRow(executedBy, environment, runId, revertedAt, origin),onKitonrunMigrations, exportedcreateLogger, and acwdoption onMigratorKit.Security
--json, events andinit-generated configs.Resilience
appliedAt/revertedAt/failedAtstamps, so revert ordering survives host clock skew.phase: 'changelog-write'instead of the generic migration failure.timeoutMsabortsctx.signal; SIGINT during pre-connect aborts the run; partial results survive hook/load and lock-release failures;release()without an owner token is a no-op.Performance
dry-run up, stall-basedlockWaitTimeoutMs.Docs and tests