Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
The pg-pool npm package is a connection pool manager for PostgreSQL, built on top of the 'pg' library. It allows you to manage multiple database connections efficiently, providing features like connection pooling, transaction management, and error handling.
Connection Pooling
This feature allows you to create a pool of connections to the PostgreSQL database. The pool manages the connections, reusing them for multiple queries to improve performance.
const { Pool } = require('pg');
const pool = new Pool({
user: 'dbuser',
host: 'database.server.com',
database: 'mydb',
password: 'secretpassword',
port: 5432,
});
pool.query('SELECT NOW()', (err, res) => {
console.log(err, res);
pool.end();
});
Transaction Management
This feature allows you to manage transactions, ensuring that a series of database operations either all succeed or all fail, maintaining data integrity.
const { Pool } = require('pg');
const pool = new Pool();
(async () => {
const client = await pool.connect();
try {
await client.query('BEGIN');
const res = await client.query('INSERT INTO users(name) VALUES($1) RETURNING id', ['brianc']);
const insertPhotoText = 'INSERT INTO photos(user_id, photo_url) VALUES ($1, $2)';
const insertPhotoValues = [res.rows[0].id, 's3.bucket.foo'];
await client.query(insertPhotoText, insertPhotoValues);
await client.query('COMMIT');
} catch (e) {
await client.query('ROLLBACK');
throw e;
} finally {
client.release();
}
})();
Error Handling
This feature provides robust error handling, allowing you to catch and handle errors that occur during query execution.
const { Pool } = require('pg');
const pool = new Pool();
pool.query('SELECT * FROM non_existent_table', (err, res) => {
if (err) {
console.error('Error executing query', err.stack);
} else {
console.log(res.rows);
}
pool.end();
});
The 'pg' package is the core PostgreSQL client for Node.js. It provides a simple interface for executing SQL queries and managing database connections. Unlike pg-pool, it does not include built-in connection pooling, but it can be used in conjunction with pg-pool for that purpose.
Sequelize is a promise-based Node.js ORM for Postgres, MySQL, MariaDB, SQLite, and Microsoft SQL Server. It features solid transaction support, relations, eager and lazy loading, read replication, and more. While it provides connection pooling, it also offers a higher-level abstraction for database operations compared to pg-pool.
Knex.js is a SQL query builder for PostgreSQL, MySQL, MariaDB, SQLite3, and Oracle. It features both traditional node-style callbacks as well as a promise interface for cleaner async flow. Knex.js includes built-in connection pooling and transaction management, similar to pg-pool, but also provides a more flexible query building experience.
A connection pool for node-postgres
npm i pg-pool pg
to use pg-pool you must first create an instance of a pool
var Pool = require('pg-pool')
// by default the pool uses the same
// configuration as whatever `pg` version you have installed
var pool = new Pool()
// you can pass properties to the pool
// these properties are passed unchanged to both the node-postgres Client constructor
// and the node-pool (https://github.com/coopernurse/node-pool) constructor
// allowing you to fully configure the behavior of both
var pool2 = new Pool({
database: 'postgres',
user: 'brianc',
password: 'secret!',
port: 5432,
ssl: true,
max: 20, // set pool max size to 20
idleTimeoutMillis: 1000, // close idle clients after 1 second
connectionTimeoutMillis: 1000, // return an error after 1 second if connection could not be established
maxUses: 7500, // close (and replace) a connection after it has been used 7500 times (see below for discussion)
})
//you can supply a custom client constructor
//if you want to use the native postgres client
var NativeClient = require('pg').native.Client
var nativePool = new Pool({ Client: NativeClient })
//you can even pool pg-native clients directly
var PgNativeClient = require('pg-native')
var pgNativePool = new Pool({ Client: PgNativeClient })
The Pool constructor does not support passing a Database URL as the parameter. To use pg-pool on heroku, for example, you need to parse the URL into a config object. Here is an example of how to parse a Database URL.
const Pool = require('pg-pool');
const url = require('url')
const params = url.parse(process.env.DATABASE_URL);
const auth = params.auth.split(':');
const config = {
user: auth[0],
password: auth[1],
host: params.hostname,
port: params.port,
database: params.pathname.split('/')[1],
ssl: true
};
const pool = new Pool(config);
/*
Transforms, 'postgres://DBuser:secret@DBHost:#####/myDB', into
config = {
user: 'DBuser',
password: 'secret',
host: 'DBHost',
port: '#####',
database: 'myDB',
ssl: true
}
*/
pg-pool supports a fully promise-based api for acquiring clients
var pool = new Pool()
pool.connect().then(client => {
client.query('select $1::text as name', ['pg-pool']).then(res => {
client.release()
console.log('hello from', res.rows[0].name)
})
.catch(e => {
client.release()
console.error('query error', e.message, e.stack)
})
})
this ends up looking much nicer if you're using co or async/await:
// with async/await
(async () => {
var pool = new Pool()
var client = await pool.connect()
try {
var result = await client.query('select $1::text as name', ['brianc'])
console.log('hello from', result.rows[0])
} finally {
client.release()
}
})().catch(e => console.error(e.message, e.stack))
// with co
co(function * () {
var client = yield pool.connect()
try {
var result = yield client.query('select $1::text as name', ['brianc'])
console.log('hello from', result.rows[0])
} finally {
client.release()
}
}).catch(e => console.error(e.message, e.stack))
because its so common to just run a query and return the client to the pool afterward pg-pool has this built-in:
var pool = new Pool()
var time = await pool.query('SELECT NOW()')
var name = await pool.query('select $1::text as name', ['brianc'])
console.log(name.rows[0].name, 'says hello at', time.rows[0].now)
you can also use a callback here if you'd like:
var pool = new Pool()
pool.query('SELECT $1::text as name', ['brianc'], function (err, res) {
console.log(res.rows[0].name) // brianc
})
pro tip: unless you need to run a transaction (which requires a single client for multiple queries) or you
have some other edge case like streaming rows or using a cursor
you should almost always just use pool.query
. Its easy, it does the right thing :tm:, and wont ever forget to return
clients back to the pool after the query is done.
pg-pool still and will always support the traditional callback api for acquiring a client. This is the exact API node-postgres has shipped with for years:
var pool = new Pool()
pool.connect((err, client, done) => {
if (err) return done(err)
client.query('SELECT $1::text as name', ['pg-pool'], (err, res) => {
done()
if (err) {
return console.error('query error', err.message, err.stack)
}
console.log('hello from', res.rows[0].name)
})
})
When you are finished with the pool if all the clients are idle the pool will close them after config.idleTimeoutMillis
and your app
will shutdown gracefully. If you don't want to wait for the timeout you can end the pool as follows:
var pool = new Pool()
var client = await pool.connect()
console.log(await client.query('select now()'))
client.release()
await pool.end()
The pool should be a long-lived object in your application. Generally you'll want to instantiate one pool when your app starts up and use the same instance of the pool throughout the lifetime of your application. If you are frequently creating a new pool within your code you likely don't have your pool initialization code in the correct place. Example:
// assume this is a file in your program at ./your-app/lib/db.js
// correct usage: create the pool and let it live
// 'globally' here, controlling access to it through exported methods
var pool = new pg.Pool()
// this is the right way to export the query method
module.exports.query = (text, values) => {
console.log('query:', text, values)
return pool.query(text, values)
}
// this would be the WRONG way to export the connect method
module.exports.connect = () => {
// notice how we would be creating a pool instance here
// every time we called 'connect' to get a new client?
// that's a bad thing & results in creating an unbounded
// number of pools & therefore connections
var aPool = new pg.Pool()
return aPool.connect()
}
Every instance of a Pool
is an event emitter. These instances emit the following events:
Emitted whenever an idle client in the pool encounters an error. This is common when your PostgreSQL server shuts down, reboots, or a network partition otherwise causes it to become unavailable while your pool has connected clients.
Example:
const Pool = require('pg-pool')
const pool = new Pool()
// attach an error handler to the pool for when a connected, idle client
// receives an error by being disconnected, etc
pool.on('error', function(error, client) {
// handle this in the same way you would treat process.on('uncaughtException')
// it is supplied the error as well as the idle client which received the error
})
Fired whenever the pool creates a new pg.Client
instance and successfully connects it to the backend.
Example:
const Pool = require('pg-pool')
const pool = new Pool()
var count = 0
pool.on('connect', client => {
client.count = count++
})
pool
.connect()
.then(client => {
return client
.query('SELECT $1::int AS "clientCount"', [client.count])
.then(res => console.log(res.rows[0].clientCount)) // outputs 0
.then(() => client)
})
.then(client => client.release())
Fired whenever the a client is acquired from the pool
Example:
This allows you to count the number of clients which have ever been acquired from the pool.
var Pool = require('pg-pool')
var pool = new Pool()
var acquireCount = 0
pool.on('acquire', function (client) {
acquireCount++
})
var connectCount = 0
pool.on('connect', function () {
connectCount++
})
for (var i = 0; i < 200; i++) {
pool.query('SELECT NOW()')
}
setTimeout(function () {
console.log('connect count:', connectCount) // output: connect count: 10
console.log('acquire count:', acquireCount) // output: acquire count: 200
}, 100)
pg-pool & node-postgres support some of the same environment variables as psql
supports. The most common are:
PGDATABASE=my_db
PGUSER=username
PGPASSWORD="my awesome password"
PGPORT=5432
PGSSLMODE=require
Usually I will export these into my local environment via a .env
file with environment settings or export them in ~/.bash_profile
or something similar. This way I get configurability which works with both the postgres suite of tools (psql
, pg_dump
, pg_restore
) and node, I can vary the environment variables locally and in production, and it supports the concept of a 12-factor app out of the box.
In versions of node <=0.12.x
there is no native promise implementation available globally. You can polyfill the promise globally like this:
// first run `npm install promise-polyfill --save
if (typeof Promise == 'undefined') {
global.Promise = require('promise-polyfill')
}
You can use any other promise implementation you'd like. The pool also allows you to configure the promise implementation on a per-pool level:
var bluebirdPool = new Pool({
Promise: require('bluebird')
})
please note: in node <=0.12.x
the pool will throw if you do not provide a promise constructor in one of the two ways mentioned above. In node >=4.0.0
the pool will use the native promise implementation by default; however, the two methods above still allow you to "bring your own."
The maxUses config option can help an application instance rebalance load against a replica set that has been auto-scaled after the connection pool is already full of healthy connections.
The mechanism here is that a connection is considered "expended" after it has been acquired and released maxUses
number of times. Depending on the load on your system, this means there will be an approximate time in which any given connection will live, thus creating a window for rebalancing.
Imagine a scenario where you have 10 app instances providing an API running against a replica cluster of 3 that are accessed via a round-robin DNS entry. Each instance runs a connection pool size of 20. With an ambient load of 50 requests per second, the connection pool will likely fill up in a few minutes with healthy connections.
If you have weekly bursts of traffic which peak at 1,000 requests per second, you might want to grow your replicas to 10 during this period. Without setting maxUses
, the new replicas will not be adopted by the app servers without an intervention -- namely, restarting each in turn in order to build up new connection pools that are balanced against all the replicas. Adding additional app server instances will help to some extent because they will adopt all the replicas in an even way, but the initial app servers will continue to focus additional load on the original replicas.
This is where the maxUses
configuration option comes into play. Setting maxUses
to 7500 will ensure that over a period of 30 minutes or so the new replicas will be adopted as the pre-existing connections are closed and replaced with new ones, thus creating a window for eventual balance.
You'll want to test based on your own scenarios, but one way to make a first guess at maxUses
is to identify an acceptable window for rebalancing and then solve for the value:
maxUses = rebalanceWindowSeconds * totalRequestsPerSecond / numAppInstances / poolSize
In the example above, assuming we acquire and release 1 connection per request and we are aiming for a 30 minute rebalancing window:
maxUses = rebalanceWindowSeconds * totalRequestsPerSecond / numAppInstances / poolSize
7200 = 1800 * 1000 / 10 / 25
To run tests clone the repo, npm i
in the working dir, and then run npm test
I love contributions. Please make sure they have tests, and submit a PR. If you're not sure if the issue is worth it or will be accepted it never hurts to open an issue to begin the conversation. If you're interested in keeping up with node-postgres releated stuff, you can follow me on twitter at @briancarlson - I generally announce any noteworthy updates there.
The MIT License (MIT) Copyright (c) 2016 Brian M. Carlson
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Connection pool for node-postgres
The npm package pg-pool receives a total of 2,623,476 weekly downloads. As such, pg-pool popularity was classified as popular.
We found that pg-pool demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.