Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: brianc/node-postgres
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: master
Choose a base ref
...
head repository: avallete/node-postgres
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: master
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 2 commits
  • 8 files changed
  • 2 contributors

Commits on May 11, 2026

  1. fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2 

    `pg`'s SCRAM-SHA-256 client passes the raw password into PBKDF2 with no
normalization, while PostgreSQL's server (and libpq) apply SASLprep
(B.1 mapping -> NFKC -> prohibition + bidi check) when computing the
stored verifier. Passwords whose NFKC form differs from themselves
(e.g. containing U+00A8 dieresis, U+2011 non-breaking hyphen, U+00BC
vulgar one quarter, NBSP, soft hyphen) authenticate with psql/libpq
but fail against pg with `28P01`.

Wire `@mongodb-js/saslprep` (the maintained fork used by mongodb's
official Node driver) into `continueSession` before `crypto.deriveKey`,
with a try/catch fallback to the raw password on prohibited / bidi
violations to match `libpq`'s `pg_saslprep` behavior.

Also adds:

- Unit tests covering the soft-hyphen B.1 mapping equivalence, the
  Roman-numeral-IX NFKC asymmetry, the prohibited-char fallback, and a
  deterministic snapshot for the original bug-report password.
- A gated integration test block (SCRAM_TEST_PGUSER_UNICODE /
  SCRAM_TEST_PGPASSWORD_UNICODE) covering raw + NFKC-equivalent + wrong
  password.
- A `scram_unicode_test` role (password `U&'IX-\2168'`) provisioned in
  CI plus matching env vars so the new integration tests run on every
  Node version.
- A Cloudflare Workers regression guard that exercises
  `sasl.continueSession` to ensure `@mongodb-js/saslprep` resolves
  cleanly under workerd.
- A `pg@8.21.0` CHANGELOG entry.
    @avallete
    avallete committed May 11, 2026
    Configuration menu
    Copy the full SHA
    4eb0b86 View commit details
    Browse the repository at this point in the history

  2. Merge pull request #1 from avallete/fix/scram-saslprep 

    fix: apply SASLprep (RFC 4013) to passwords before SCRAM-SHA-256 PBKDF2
    @avallete
    avallete authored May 11, 2026
    Configuration menu
    Copy the full SHA
    0ef69fb View commit details
    Browse the repository at this point in the history
Loading