
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@mastra/spanner
Advanced tools
Affected versions:
Google Cloud Spanner provider for Mastra - db storage capabilities (GoogleSQL dialect)
Google Cloud Spanner storage adapter for Mastra. Implements the GoogleSQL dialect.
npm install @mastra/spanner
GOOGLE_APPLICATION_CREDENTIALS).localhost:9010.import { SpannerStore } from '@mastra/spanner';
const store = new SpannerStore({
id: 'spanner-storage',
projectId: 'my-gcp-project',
instanceId: 'my-instance',
databaseId: 'mastra',
});
process.env.SPANNER_EMULATOR_HOST = 'localhost:9010';
const store = new SpannerStore({
id: 'spanner-storage',
projectId: 'test-project',
instanceId: 'test-instance',
databaseId: 'test-db',
// Skip auth checks when talking to the emulator
spannerOptions: { servicePath: 'localhost', port: 9010, sslCreds: undefined },
});
The store automatically detects the SPANNER_EMULATOR_HOST env var and uses
unauthenticated channels when set. You can also create the instance/database
through the emulator using the standard gcloud CLI.
If you already manage a Spanner client elsewhere, pass the database directly:
import { Spanner } from '@google-cloud/spanner';
import { SpannerStore } from '@mastra/spanner';
const spanner = new Spanner({ projectId: 'my-project' });
const database = spanner.instance('my-instance').database('mastra');
const store = new SpannerStore({
id: 'spanner-storage',
database,
});
STRING(MAX) for text/JSON
payloads, INT64, FLOAT64, BOOL and TIMESTAMP.database.updateSchema(...) (long-running operation).INSERT OR UPDATE. Deletes use DELETE WHERE TRUE (Spanner has no
TRUNCATE).The adapter implements the following storage domains:
memory: threads, messages, resourcesworkflows: workflow snapshots and run statescores: evaluation scoresbackgroundTasks: background tool execution stateagents: thin agent records and versioned config snapshotsmcpClients: MCP client configurations with version historymcpServers: MCP server configurations with version historyskills: skill records and versioned skill snapshotsblobs: content-addressable blob store (used by the skills domain)promptBlocks: prompt block records and versioned template/rules snapshotsscorerDefinitions: scorer definition records and versioned scoring-config snapshotsschedules: cron-driven workflow schedules and trigger history (consumed by WorkflowScheduler)observability: AI tracing spans (per-trace and per-span records) used by the Studio traces UIStart the emulator:
docker compose up -d
Then run the tests:
ENABLE_TESTS=true pnpm test
FAQs
Google Cloud Spanner provider for Mastra - db storage capabilities (GoogleSQL dialect)
The npm package @mastra/spanner receives a total of 982 weekly downloads. As such, @mastra/spanner popularity was classified as not popular.
We found that @mastra/spanner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.