brianc · May 8, 2020 · May 8, 2020 · May 10, 2020 · May 10, 2020 · May 12, 2020
diff --git a/.travis.yml b/.travis.yml
@@ -7,27 +7,25 @@ before_script: |
 
 env:
   - CC=clang CXX=clang++ npm_config_clang=1 PGUSER=postgres PGDATABASE=postgres
-  # test w/ new faster parsing code
-  - CC=clang CXX=clang++ npm_config_clang=1 PGUSER=postgres PGDATABASE=postgres PG_FAST_CONNECTION=true
 
 node_js:
   - lts/dubnium
   - lts/erbium
   # node 13.7 seems to have changed behavior of async iterators exiting early on streams
   # if 13.8 still has this problem when it comes down I'll talk to the node team about the change
-  # in the mean time...peg to 13.6 
+  # in the mean time...peg to 13.6
   - 13.6
   - 14
 
 addons:
-  postgresql: "10"
+  postgresql: '10'
 
 matrix:
   include:
     # Run tests/paths that require password authentication
     - node_js: lts/erbium
       env:
-        - CC=clang CXX=clang++ npm_config_clang=1 PGUSER=postgres PGDATABASE=postgres PGPASSWORD=test-password
+        - CC=clang CXX=clang++ npm_config_clang=1 PGUSER=postgres PGDATABASE=postgres PGPASSWORD=test-password SCRAM_TEST_PGUSER=scram_test SCRAM_TEST_PGPASSWORD=test4scram
       before_script: |
         sudo -u postgres sed -i \
           -e '/^local/ s/trust$/peer/' \
@@ -36,28 +34,31 @@ matrix:
         sudo -u postgres psql -c "ALTER ROLE postgres PASSWORD 'test-password'; SELECT pg_reload_conf()"
         yarn build
         node packages/pg/script/create-test-tables.js postgresql:///
+        sudo -u postgres -- psql \
+          -c "SET password_encryption = 'scram-sha-256'" \
+          -c "CREATE ROLE scram_test login password 'test4scram'"
 
     - node_js: lts/carbon
       addons:
-        postgresql: "9.5"
+        postgresql: '9.5'
       dist: precise
 
     # different PostgreSQL versions on Node LTS
     - node_js: lts/erbium
       addons:
-        postgresql: "9.3"
+        postgresql: '9.3'
     - node_js: lts/erbium
       addons:
-        postgresql: "9.4"
+        postgresql: '9.4'
     - node_js: lts/erbium
       addons:
-        postgresql: "9.5"
+        postgresql: '9.5'
     - node_js: lts/erbium
       addons:
-        postgresql: "9.6"
+        postgresql: '9.6'
 
     # PostgreSQL 9.2 only works on precise
     - node_js: lts/carbon
       addons:
-        postgresql: "9.2"
+        postgresql: '9.2'
       dist: precise
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,15 @@ For richer information consult the commit log on github with referenced pull req
 
 We do not include break-fix version release in this file.
 
+### pg@8.1.0
+
+- Switch to using [monorepo](https://github.com/brianc/node-postgres/tree/master/packages/pg-connection-string) version of `pg-connection-string`. This includes better support for SSL argument parsing from connection strings and ensures continuity of support.
+- Add `&ssl=no-verify` option to connection string and `PGSSLMODE=no-verify` environment variable support for the pure JS driver. This is equivalent of passing `{ ssl: { rejectUnauthorize: false } }` to the client/pool constructor. The advantage of having support in connection strings and environment variables is it can be "externally" configured via environment variables and CLI arguments much more easily, and should remove the need to directly edit any application code for [the SSL default changes in 8.0](https://node-postgres.com/announcements#2020-02-25). This should make using `pg@8.x` significantly less difficult on environments like Heroku for example.
+
+### pg-pool@3.2.0
+
+- Same changes to `pg` impact `pg-pool` as they both use the same connection parameter and connection string parsing code for configuring SSL.
+
 ### pg-pool@3.1.0
 
 - Add [maxUses](https://github.com/brianc/node-postgres/pull/2157) config option.
@@ -12,8 +21,8 @@ We do not include break-fix version release in this file.
 
 #### note: for detailed release notes please [check here](https://node-postgres.com/announcements#2020-02-25)
 
-- Remove versions of node older than `6 lts` from the test matrix.  `pg>=8.0` may still work on older versions but it is no longer officially supported.
-- Change default behavior when not specifying `rejectUnauthorized` with the SSL connection parameters.  Previously we defaulted to `rejectUnauthorized: false` when it was not specifically included.  We now default to `rejectUnauthorized: true.`  Manually specify `{ ssl: { rejectUnauthorized: false } }` for old behavior.
+- Remove versions of node older than `6 lts` from the test matrix. `pg>=8.0` may still work on older versions but it is no longer officially supported.
+- Change default behavior when not specifying `rejectUnauthorized` with the SSL connection parameters. Previously we defaulted to `rejectUnauthorized: false` when it was not specifically included. We now default to `rejectUnauthorized: true.` Manually specify `{ ssl: { rejectUnauthorized: false } }` for old behavior.
 - Change [default database](https://github.com/brianc/node-postgres/pull/1679) when not specified to use the `user` config option if available. Previously `process.env.USER` was used.
 - Change `pg.Pool` and `pg.Query` to [be](https://github.com/brianc/node-postgres/pull/2126) an [es6 class](https://github.com/brianc/node-postgres/pull/2063).
 - Make `pg.native` non enumerable.
@@ -27,16 +36,17 @@ We do not include break-fix version release in this file.
 
 ### pg-query-stream@3.0.0
 
-- [Rewrote stream internals](https://github.com/brianc/node-postgres/pull/2051) to better conform to node stream semantics.  This should make pg-query-stream much better at respecting [highWaterMark](https://nodejs.org/api/stream.html#stream_new_stream_readable_options) and getting rid of some edge case bugs when using pg-query-stream as an async iterator.  Due to the size and nature of this change (effectively a full re-write) it's safest to bump the semver major here, though almost all tests remain untouched and still passing, which brings us to a breaking change to the API....
-- Changed `stream.close` to `stream.destroy` which is the [official](https://nodejs.org/api/stream.html#stream_readable_destroy_error) way to terminate a readable stream.  This is a __breaking change__ if you rely on the `stream.close` method on pg-query-stream...though should be just a find/replace type operation to upgrade as the semantics remain very similar (not exactly the same, since internals are rewritten, but more in line with how streams are "supposed" to behave).
-- Unified the `config.batchSize` and `config.highWaterMark` to both do the same thing: control how many rows are buffered in memory.  The `ReadableStream` will manage exactly how many rows are requested from the cursor at a time.  This should give better out of the box performance and help with efficient async iteration.
+- [Rewrote stream internals](https://github.com/brianc/node-postgres/pull/2051) to better conform to node stream semantics. This should make pg-query-stream much better at respecting [highWaterMark](https://nodejs.org/api/stream.html#stream_new_stream_readable_options) and getting rid of some edge case bugs when using pg-query-stream as an async iterator. Due to the size and nature of this change (effectively a full re-write) it's safest to bump the semver major here, though almost all tests remain untouched and still passing, which brings us to a breaking change to the API....
+- Changed `stream.close` to `stream.destroy` which is the [official](https://nodejs.org/api/stream.html#stream_readable_destroy_error) way to terminate a readable stream. This is a **breaking change** if you rely on the `stream.close` method on pg-query-stream...though should be just a find/replace type operation to upgrade as the semantics remain very similar (not exactly the same, since internals are rewritten, but more in line with how streams are "supposed" to behave).
+- Unified the `config.batchSize` and `config.highWaterMark` to both do the same thing: control how many rows are buffered in memory. The `ReadableStream` will manage exactly how many rows are requested from the cursor at a time. This should give better out of the box performance and help with efficient async iteration.
 
 ### pg@7.17.0
 
 - Add support for `idle_in_transaction_session_timeout` [option](https://github.com/brianc/node-postgres/pull/2049).
 
 ### 7.16.0
-- Add optional, opt-in behavior to test new, [faster query pipeline](https://github.com/brianc/node-postgres/pull/2044).  This is experimental, and not documented yet.  The pipeline changes will grow significantly after the 8.0 release.
+
+- Add optional, opt-in behavior to test new, [faster query pipeline](https://github.com/brianc/node-postgres/pull/2044). This is experimental, and not documented yet. The pipeline changes will grow significantly after the 8.0 release.
 
 ### 7.15.0
 
@@ -161,7 +171,7 @@ Promise support & other goodness lives now in [pg-pool](https://github.com/brian
 - Included support for tcp keep alive. Enable it as follows:
 
 ```js
-var client = new Client({ keepAlive: true });
+var client = new Client({ keepAlive: true })
 ```
 
 This should help with backends incorrectly considering idle clients to be dead and prematurely disconnecting them.
@@ -173,12 +183,12 @@ This should help with backends incorrectly considering idle clients to be dead a
 Example:
 
 ```js
-var client = new Client();
-client.connect();
-client.query("SELECT $1::text as name", ["brianc"]).then(function(res) {
-  console.log("hello from", res.rows[0]);
-  client.end();
-});
+var client = new Client()
+client.connect()
+client.query('SELECT $1::text as name', ['brianc']).then(function (res) {
+  console.log('hello from', res.rows[0])
+  client.end()
+})
 ```
 
 ### v5.0.0

diff --git a/packages/pg-cursor/package.json b/packages/pg-cursor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pg-cursor",
-  "version": "2.1.11",
+  "version": "2.2.0",
   "description": "Query cursor extension for node-postgres",
   "main": "index.js",
   "directories": {
@@ -17,6 +17,6 @@
   "license": "MIT",
   "devDependencies": {
     "mocha": "^6.2.2",
-    "pg": "^8.1.0"
+    "pg": "^8.2.0"
   }
 }
diff --git a/packages/pg-protocol/package.json b/packages/pg-protocol/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pg-protocol",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "The postgres client/server binary protocol, implemented in TypeScript",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

diff --git a/packages/pg-protocol/src/inbound-parser.test.ts b/packages/pg-protocol/src/inbound-parser.test.ts
@@ -210,8 +210,21 @@ describe('PgPacketStream', function () {
   testForMessage(md5PasswordBuffer, expectedMD5PasswordMessage)
   testForMessage(SASLBuffer, expectedSASLMessage)
   testForMessage(SASLContinueBuffer, expectedSASLContinueMessage)
+
+  // this exercises a found bug in the parser:
+  // https://github.com/brianc/node-postgres/pull/2210#issuecomment-627626084
+  // and adds a test which is deterministic, rather than relying on network packet chunking
+  const extendedSASLContinueBuffer = Buffer.concat([SASLContinueBuffer, Buffer.from([1, 2, 3, 4])])
+  testForMessage(extendedSASLContinueBuffer, expectedSASLContinueMessage)
+
   testForMessage(SASLFinalBuffer, expectedSASLFinalMessage)
 
+  // this exercises a found bug in the parser:
+  // https://github.com/brianc/node-postgres/pull/2210#issuecomment-627626084
+  // and adds a test which is deterministic, rather than relying on network packet chunking
+  const extendedSASLFinalBuffer = Buffer.concat([SASLFinalBuffer, Buffer.from([1, 2, 4, 5])])
+  testForMessage(extendedSASLFinalBuffer, expectedSASLFinalMessage)
+
   testForMessage(paramStatusBuffer, expectedParameterStatusMessage)
   testForMessage(backendKeyDataBuffer, expectedBackendKeyDataMessage)
   testForMessage(readyForQueryBuffer, expectedReadyForQueryMessage)

diff --git a/packages/pg-protocol/src/parser.ts b/packages/pg-protocol/src/parser.ts
@@ -296,11 +296,11 @@ export class Parser {
         break
       case 11: // AuthenticationSASLContinue
         message.name = MessageName.authenticationSASLContinue
-        message.data = this.reader.string(length - 4)
+        message.data = this.reader.string(length - 8)
         break
       case 12: // AuthenticationSASLFinal
         message.name = MessageName.authenticationSASLFinal
-        message.data = this.reader.string(length - 4)
+        message.data = this.reader.string(length - 8)
         break
       default:
         throw new Error('Unknown authenticationOk message type ' + code)

diff --git a/packages/pg-query-stream/package.json b/packages/pg-query-stream/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pg-query-stream",
-  "version": "3.0.8",
+  "version": "3.1.0",
   "description": "Postgres query result returned as readable stream",
   "main": "index.js",
   "scripts": {
@@ -26,12 +26,12 @@
     "concat-stream": "~1.0.1",
     "eslint-plugin-promise": "^3.5.0",
     "mocha": "^6.2.2",
-    "pg": "^8.1.0",
+    "pg": "^8.2.0",
     "stream-spec": "~0.3.5",
     "stream-tester": "0.0.5",
     "through": "~2.3.4"
   },
   "dependencies": {
-    "pg-cursor": "^2.1.11"
+    "pg-cursor": "^2.2.0"
   }
 }
diff --git a/packages/pg/README.md b/packages/pg/README.md
@@ -5,7 +5,7 @@
 <span class="badge-npmversion"><a href="https://npmjs.org/package/pg" title="View this project on NPM"><img src="https://img.shields.io/npm/v/pg.svg" alt="NPM version" /></a></span>
 <span class="badge-npmdownloads"><a href="https://npmjs.org/package/pg" title="View this project on NPM"><img src="https://img.shields.io/npm/dm/pg.svg" alt="NPM downloads" /></a></span>
 
-Non-blocking PostgreSQL client for Node.js.  Pure JavaScript and optional native libpq bindings.
+Non-blocking PostgreSQL client for Node.js. Pure JavaScript and optional native libpq bindings.
 
 ## Install
 
@@ -14,30 +14,31 @@ $ npm install pg
 ```
 
 ---
-## :star: [Documentation](https://node-postgres.com) :star:
 
+## :star: [Documentation](https://node-postgres.com) :star:
 
 ### Features
 
-* Pure JavaScript client and native libpq bindings share _the same API_
-* Connection pooling
-* Extensible JS ↔ PostgreSQL data-type coercion
-* Supported PostgreSQL features
-  * Parameterized queries
-  * Named statements with query plan caching
-  * Async notifications with `LISTEN/NOTIFY`
-  * Bulk import & export with `COPY TO/COPY FROM`
+- Pure JavaScript client and native libpq bindings share _the same API_
+- Connection pooling
+- Extensible JS ↔ PostgreSQL data-type coercion
+- Supported PostgreSQL features
+  - Parameterized queries
+  - Named statements with query plan caching
+  - Async notifications with `LISTEN/NOTIFY`
+  - Bulk import & export with `COPY TO/COPY FROM`
 
 ### Extras
 
-node-postgres is by design pretty light on abstractions.  These are some handy modules we've been using over the years to complete the picture.
+node-postgres is by design pretty light on abstractions. These are some handy modules we've been using over the years to complete the picture.
 The entire list can be found on our [wiki](https://github.com/brianc/node-postgres/wiki/Extras).
 
 ## Support
 
-node-postgres is free software.  If you encounter a bug with the library please open an issue on the [GitHub repo](https://github.com/brianc/node-postgres). If you have questions unanswered by the documentation please open an issue pointing out how the documentation was unclear & I will do my best to make it better!
+node-postgres is free software. If you encounter a bug with the library please open an issue on the [GitHub repo](https://github.com/brianc/node-postgres). If you have questions unanswered by the documentation please open an issue pointing out how the documentation was unclear & I will do my best to make it better!
 
 When you open an issue please provide:
+
 - version of Node
 - version of Postgres
 - smallest possible snippet of code to reproduce the problem
@@ -49,30 +50,25 @@ You can also follow me [@briancarlson](https://twitter.com/briancarlson) if that
 node-postgres's continued development has been made possible in part by generous finanical support from [the community](https://github.com/brianc/node-postgres/blob/master/SPONSORS.md) and these featured sponsors:
 
 <div align="center">
-<a href="https://www.timescale.com" target="_blank">
-  <img height="80" src="https://node-postgres.com/timescale.svg" />
-</a>
-<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAABCAQAAAB0m0auAAAADElEQVR42mNkIBIAAABSAAI2VLqiAAAAAElFTkSuQmCC" />
 <a href="https://crate.io" target="_blank">
   <img height="80" src="https://node-postgres.com/crate-io.png" />
 </a>
 </div>
 
 If you or your company are benefiting from node-postgres and would like to help keep the project financially sustainable [please consider supporting](https://github.com/sponsors/brianc) its development.
 
-
 ## Contributing
 
-__:heart: contributions!__
+**:heart: contributions!**
 
-I will __happily__ accept your pull request if it:
-- __has tests__
+I will **happily** accept your pull request if it:
+
+- **has tests**
 - looks reasonable
 - does not break backwards compatibility
 
 If your change involves breaking backwards compatibility please please point that out in the pull request & we can discuss & plan when and how to release it and what type of documentation or communicate it will require.
 
-
 ## Troubleshooting and FAQ
 
 The causes and solutions to common errors can be found among the [Frequently Asked Questions (FAQ)](https://github.com/brianc/node-postgres/wiki/FAQ)
@@ -81,21 +77,20 @@ The causes and solutions to common errors can be found among the [Frequently Ask
 
 Copyright (c) 2010-2020 Brian Carlson (brian.m.carlson@gmail.com)
 
- Permission is hereby granted, free of charge, to any person obtaining a copy
- of this software and associated documentation files (the "Software"), to deal
- in the Software without restriction, including without limitation the rights
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- copies of the Software, and to permit persons to whom the Software is
- furnished to do so, subject to the following conditions:
-
- The above copyright notice and this permission notice shall be included in
- all copies or substantial portions of the Software.
-
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- THE SOFTWARE.
-
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/packages/pg/lib/client.js b/packages/pg/lib/client.js
@@ -18,9 +18,6 @@ var ConnectionParameters = require('./connection-parameters')
 var Query = require('./query')
 var defaults = require('./defaults')
 var Connection = require('./connection')
-if (process.env.PG_FAST_CONNECTION) {
-  Connection = require('./connection-fast')
-}
 
 var Client = function (config) {
   EventEmitter.call(this)