
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
zero-pglite
Advanced tools
Drop-in replacement for the Docker-based development backend that Rocicorp's Zero requires. Instead of running PostgreSQL, zero-cache, and MinIO in Docker containers, zerolite bundles everything into a single process using PGlite (PostgreSQL compiled to WASM).
The goal is simple: bun install && bun dev with zero system dependencies.
zerolite starts four things in one process:
The trick is in the TCP proxy. zero-cache needs logical replication to stay in sync with the upstream database. PGlite doesn't support logical replication natively, so zerolite fakes it. Every mutation is captured by triggers into a changes table, then encoded into the pgoutput binary protocol and streamed to zero-cache through the replication connection. zero-cache can't tell the difference.
The proxy also handles multi-database routing. zero-cache expects three separate databases (upstream, CVR, change), but PGlite is a single database. zerolite maps database names to schemas, so zero_cvr becomes the zero_cvr schema and zero_cdb becomes zero_cdb.
npm install zerolite
or with bun:
bun add zerolite
You also need @rocicorp/zero installed in your project for the zero-cache binary.
import { startZeroLite } from 'zerolite'
const { config, stop } = await startZeroLite({
pgPort: 6434,
zeroPort: 5849,
s3Port: 10201,
migrationsDir: 'src/database/migrations',
seedFile: 'src/database/seed.sql',
})
// your app connects to zero-cache at localhost:5849
// database is at postgresql://user:password@localhost:6434/postgres
// when done
await stop()
All options are optional and have sensible defaults. See src/config.ts for the full list.
The proxy intercepts several things to convince zero-cache it's talking to a real PostgreSQL server with logical replication enabled:
IDENTIFY_SYSTEM returns a fake system ID and timelineCREATE_REPLICATION_SLOT persists slot info in a local table and returns a valid LSNSTART_REPLICATION enters streaming mode, encoding changes as pgoutput binary messagescurrent_setting('wal_level') always returns logicalpg_replication_slots queries are redirected to a local tracking tableSET TRANSACTION SNAPSHOT is silently accepted (PGlite doesn't support imported snapshots)ALTER ROLE ... REPLICATION returns successREAD ONLY is stripped from transaction starts to avoid PGlite serialization issuesThe pgoutput encoder produces spec-compliant binary messages: Begin, Relation, Insert, Update, Delete, Commit, and Keepalive. All column values are encoded as text (typeOid 25), which zero-cache handles fine since it re-maps types downstream anyway.
78 tests across 5 test files covering the full stack from binary encoding to TCP-level integration:
bun test
The test suite includes a zero-cache compatibility layer that decodes pgoutput messages into the same typed format that zero-cache's PgoutputParser produces, validating end-to-end compatibility.
This is a development tool. It is not suitable for production use.
src/
index.ts main entry, orchestrates startup
config.ts configuration with defaults
pg-proxy.ts tcp proxy with query rewriting
pglite-manager.ts pglite instance and migration runner
s3-local.ts minimal s3 http server
replication/
handler.ts replication protocol state machine
pgoutput-encoder.ts binary pgoutput message encoder
change-tracker.ts trigger installation and change reader
MIT
FAQs
PGlite-powered zero-sync development backend. No Docker required.
We found that zero-pglite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.