
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@pgpmjs/migrate-client
Advanced tools
Typed GraphQL ORM client for the Constructive Migrate API (db_migrate schema)
Typed GraphQL ORM client for the Constructive Migrate API (db_migrate schema).
Generated from migrate.graphql via @constructive-io/graphql-codegen.
import { createClient } from '@pgpmjs/migrate-client';
const db = createClient({
endpoint: 'https://migrate.example.com/graphql',
headers: { Authorization: 'Bearer <token>' },
});
// Fetch all sql_actions for a database
const result = await db.sqlAction.findMany({
select: { id: true, name: true, deploy: true, revert: true, verify: true, content: true },
where: { databaseId: { equalTo: '<database-uuid>' } },
}).unwrap();
console.log(result.sqlActions.nodes);
pnpm generate
This runs codegen against schemas/migrate.graphql and outputs to src/.
๐ Quickstart: Getting Up and Running Get started with modular databases in minutes. Install prerequisites and deploy your first module.
๐ฆ Modular PostgreSQL Development with Database Packages Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
โ๏ธ Authoring Database Changes Master the workflow for adding, organizing, and managing database changes with pgpm.
๐งช End-to-End PostgreSQL Testing with TypeScript Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
โก Supabase Testing Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
๐ง Drizzle ORM Testing Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
๐ง Troubleshooting Common issues and solutions for pgpm, PostgreSQL, and testing.
SET LOCAL) into queriesโideal for setting role, jwt.claims, and other session settings.libpg_query, converting SQL into parse trees.Install skills for AI coding agents:
# All platform skills (security, blueprints, codegen, billing, etc.)
npx skills add constructive-io/constructive-skills
# Individual repo skills (pgpm, testing, CLI, search, etc.)
npx skills add https://github.com/constructive-io/constructive --skill pgpm
npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
๐ Built by the Constructive team โ creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on GitHub.
AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.
FAQs
Typed GraphQL ORM client for the Constructive Migrate API (db_migrate schema)
The npm package @pgpmjs/migrate-client receives a total of 1,084 weekly downloads. As such, @pgpmjs/migrate-client popularity was classified as popular.
We found that @pgpmjs/migrate-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.