PostgREST · wolfgangwalther · Jul 10, 2025 · Jul 10, 2025 · Jul 10, 2025 · Jul 10, 2025
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -30,8 +30,18 @@ concurrency:
 
 jobs:
   static:
-    name: Nix - Linux x86-64 static
-    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Linux aarch64
+            runs-on: ubuntu-24.04-arm
+            artifact: aarch64
+          - name: Linux x86-64
+            runs-on: ubuntu-24.04
+            artifact: x86-64
+    name: Nix - ${{ matrix.name }} static
+    runs-on: ${{ matrix.runs-on }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Setup Nix Environment
@@ -44,17 +54,17 @@ jobs:
       - name: Save built executable as artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: postgrest-linux-static-x86-64
+          name: postgrest-linux-static-${{ matrix.artifact }}
           path: result/bin/postgrest
           if-no-files-found: error
 
       - name: Build Docker image
-        run: nix-build -A docker.image --out-link postgrest-docker.tar.gz
+        run: nix-build -A docker.image --out-link postgrest-docker-${{ matrix.artifact }}.tar.gz
       - name: Save built Docker image as artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: postgrest-docker-x86-64
-          path: postgrest-docker.tar.gz
+          name: postgrest-docker-${{ matrix.artifact }}
+          path: postgrest-docker-${{ matrix.artifact }}.tar.gz
           if-no-files-found: error
 
 
@@ -87,15 +97,6 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - name: Linux aarch64
-            runs-on: ubuntu-24.04-arm
-            cache: |
-              ~/.stack/pantry
-              ~/.stack/snapshots
-              ~/.stack/stack.sqlite3
-            artifact: postgrest-ubuntu-aarch64
-            deps: sudo apt-get update && sudo apt-get install libpq-dev
-
           - name: MacOS aarch64
             runs-on: macos-14
             cache: |

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -75,6 +75,9 @@ jobs:
 
           mkdir -p release-bundle
 
+          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-aarch64.tar.xz" \
+            -C artifacts/postgrest-linux-static-aarch64 postgrest
+
           tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-linux-static-x86-64.tar.xz" \
             -C artifacts/postgrest-linux-static-x86-64 postgrest
 
@@ -87,9 +90,6 @@ jobs:
           tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-freebsd-x86-64.tar.xz" \
             -C artifacts/postgrest-freebsd-x86-64 postgrest
 
-          tar cJvf "release-bundle/postgrest-${GITHUB_REF_NAME}-ubuntu-aarch64.tar.xz" \
-            -C artifacts/postgrest-ubuntu-aarch64 postgrest
-
           zip --junk-paths "release-bundle/postgrest-${GITHUB_REF_NAME}-windows-x86-64.zip" \
             artifacts/postgrest-windows-x86-64/postgrest.exe
 
@@ -139,49 +139,43 @@ jobs:
       DOCKER_REPO: ${{ vars.DOCKER_REPO }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Download x86-64 Docker image
+      - name: Download aarch64 Docker image
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: postgrest-docker-x86-64
-      - name: Download aarch64 binary
+          name: postgrest-docker-aarch64
+      - name: Download x86-64 Docker image
         uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
-          name: postgrest-ubuntu-aarch64
+          name: postgrest-docker-x86-64
       - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
       - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
         with:
           username: ${{ vars.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASS }}
-      - name: Build aarch64 Docker image
-        run: |
-          # This only pushes the image via digest, not a tag. This will not appear
-          # in the image list on Docker Hub, yet. It will be later added to the main
-          # tag's manifest.
-          docker buildx build \
-            -t "$DOCKER_REPO/postgrest" \
-            --platform linux/arm64 \
-            --output push-by-digest=true,type=image,push=true \
-            --metadata-file metadata.json \
-            .
-          echo "SHA256_ARM=$(jq -r '."containerimage.digest"' metadata.json)" >> "$GITHUB_ENV"
       - name: Publish images on Docker Hub
         run: |
-          docker load -i postgrest-docker.tar.gz
+          docker load -i postgrest-docker-aarch64.tar.gz
+          docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
+          docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
+          SHA256_ARM64=$(docker inspect postgrest:latest | jq -r '.[0].Id')
 
+          docker load -i postgrest-docker-x86-64.tar.gz
           docker tag postgrest:latest "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
           docker push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
-          docker buildx imagetools create --append \
-            -t "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}" \
-            "$DOCKER_REPO/postgrest@$SHA256_ARM"
+          SHA256_AMD64=$(docker inspect postgrest:latest | jq -r '.[0].Id')
+
+          docker manifest create "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}" \
+            "$DOCKER_REPO/postgrest@$SHA256_ARM64" \
+            "$DOCKER_REPO/postgrest@$SHA256_AMD64"
+          docker manifest push "$DOCKER_REPO/postgrest:${GITHUB_REF_NAME}"
 
           # Only tag 'latest' for full releases
           if [ "${GITHUB_REF_NAME}" != "devel" ]; then
             echo "Pushing to 'latest' tag for full release of ${GITHUB_REF_NAME} ..."
-            docker tag postgrest:latest "$DOCKER_REPO"/postgrest:latest
-            docker push "$DOCKER_REPO"/postgrest:latest
-            docker buildx imagetools create --append \
-              -t "$DOCKER_REPO/postgrest:latest" \
-              "$DOCKER_REPO/postgrest@$SHA256_ARM"
+            docker manifest create "$DOCKER_REPO/postgrest:latest" \
+              "$DOCKER_REPO/postgrest@$SHA256_ARM64" \
+              "$DOCKER_REPO/postgrest@$SHA256_AMD64"
+            docker manifest push "$DOCKER_REPO/postgrest:latest"
           else
             echo "Skipping push to 'latest' tag for pre-release..."
           fi

diff --git a/default.nix b/default.nix
@@ -1,6 +1,6 @@
 { system ? builtins.currentSystem
 
-, compiler ? "ghc948"
+, compiler ? "ghc967"
 
 , # Commit of the Nixpkgs repository that we want to use.
   # It defaults to reading the inputs from flake.lock, which serves
@@ -104,9 +104,7 @@ rec {
 
   # Tooling for analyzing Haskell imports and exports.
   hsie =
-    pkgs.callPackage nix/hsie {
-      inherit (pkgs.haskell.packages."${compiler}") ghcWithPackages;
-    };
+    pkgs.callPackage nix/hsie { };
 
   ### Tools
 

diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -2,7 +2,7 @@
   description = "REST API for any Postgres database";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-25.05-darwin";
+    nixpkgs.url = "github:wolfgangwalther/nixpkgs/haskell-static-template-haskell";
   };
 
   nixConfig = {

diff --git a/nix/hsie/default.nix b/nix/hsie/default.nix
@@ -1,4 +1,4 @@
-{ ghcWithPackages
+{ haskell
 , runCommand
 }:
 let
@@ -14,7 +14,7 @@ let
     ps.ghc-paths
     ps.optparse-applicative
   ];
-  ghc = ghcWithPackages modules;
+  ghc = haskell.packages.ghc94.ghcWithPackages modules;
   hsie =
     runCommand "haskellimports" { inherit name src; }
       ''

diff --git a/nix/overlays/haskell-packages.nix b/nix/overlays/haskell-packages.nix
@@ -2,7 +2,7 @@
 
 self: super:
 let
-  inherit (self.haskell) lib;
+  # inherit (self.haskell) lib;
 
   overrides =
     _: prev:
@@ -49,15 +49,6 @@ let
       # Before upgrading fuzzyset to 0.3, check: https://github.com/PostgREST/postgrest/issues/3329
       # jailbreak, because hspec limit for tests
       fuzzyset = prev.fuzzyset_0_2_4;
-
-      # Downgrade hasql and related packages while we are still on GHC 9.4 for the static build.
-      hasql = lib.dontCheck (lib.doJailbreak prev.hasql_1_6_4_4);
-      hasql-dynamic-statements = lib.dontCheck prev.hasql-dynamic-statements_0_3_1_5;
-      hasql-implicits = lib.dontCheck prev.hasql-implicits_0_1_1_3;
-      hasql-notifications = lib.dontCheck prev.hasql-notifications_0_2_2_2;
-      hasql-pool = lib.dontCheck prev.hasql-pool_1_0_1;
-      hasql-transaction = lib.dontCheck prev.hasql-transaction_1_1_0_1;
-      postgresql-binary = lib.dontCheck (lib.doJailbreak prev.postgresql-binary_0_13_1_3);
     };
 in
 {

diff --git a/postgrest.cabal b/postgrest.cabal
@@ -16,11 +16,10 @@ extra-source-files: CHANGELOG.md
 cabal-version:      >= 1.10
 
 tested-with:
-    -- nix
-    GHC == 9.4.8
     -- cabal on Ubuntu
+    -- nix
     -- stack on FreeBSD, MacOS, Ubuntu, Windows
-  , GHC == 9.6.7
+    GHC == 9.6.7
     -- cabal on Ubuntu
   , GHC == 9.8.4
 
@@ -111,10 +110,10 @@ library
                     , either                    >= 4.4.1 && < 5.1
                     , extra                     >= 1.7.0 && < 2.0
                     , fuzzyset                  >= 0.2.4 && < 0.3
-                    , hasql                     >= 1.6.1.1 && < 1.7
+                    , hasql                     >= 1.7 && < 1.9
                     , hasql-dynamic-statements  >= 0.3.1 && < 0.4
-                    , hasql-notifications       >= 0.2.2.2 && < 0.2.3
-                    , hasql-pool                >= 1.0.1 && < 1.1
+                    , hasql-notifications       >= 0.2.2.0 && < 0.3
+                    , hasql-pool                >= 1.1 && < 1.3
                     , hasql-transaction         >= 1.0.1 && < 1.2
                     , heredoc                   >= 0.2 && < 0.3
                     , http-types                >= 0.12.2 && < 0.13
@@ -129,8 +128,6 @@ library
                     , network-uri               >= 2.6.1 && < 2.8
                     , optparse-applicative      >= 0.13 && < 0.19
                     , parsec                    >= 3.1.11 && < 3.2
-                    -- Technically unused, can be removed after updating to hasql >= 1.7
-                    , postgresql-libpq          >= 0.10
                     , prometheus-client         >= 1.1.1 && < 1.2.0
                     , protolude                 >= 0.3.1 && < 0.4
                     , regex-tdfa                >= 1.2.2 && < 1.4
@@ -266,7 +263,7 @@ test-suite spec
                     , bytestring        >= 0.10.8 && < 0.13
                     , case-insensitive  >= 1.2 && < 1.3
                     , containers        >= 0.5.7 && < 0.7
-                    , hasql-pool        >= 1.0.1 && < 1.1
+                    , hasql-pool        >= 1.0.1 && < 1.3
                     , hasql-transaction >= 1.0.1 && < 1.2
                     , heredoc           >= 0.2 && < 0.3
                     , hspec             >= 2.3 && < 2.12

diff --git a/src/PostgREST/AppState.hs b/src/PostgREST/AppState.hs
@@ -214,21 +214,34 @@ initPool AppConfig{..} observer = do
 -- | Run an action with a database connection.
 usePool :: AppState -> SQL.Session a -> IO (Either SQL.UsageError a)
 usePool AppState{stateObserver=observer, stateMainThreadId=mainThreadId, ..} sess = do
-  observer PoolRequest
+    observer PoolRequest
 
-  res <- SQL.use statePool sess
+    res <- SQL.use statePool sess
 
-  observer PoolRequestFullfilled
+    observer PoolRequestFullfilled
 
-  whenLeft res (\case
-    SQL.AcquisitionTimeoutUsageError ->
-      observer $ PoolAcqTimeoutObs SQL.AcquisitionTimeoutUsageError
-    err@(SQL.ConnectionUsageError e) ->
-      let failureMessage = BS.unpack $ fromMaybe mempty e in
-      when (("FATAL:  password authentication failed" `isInfixOf` failureMessage) || ("no password supplied" `isInfixOf` failureMessage)) $ do
-        observer $ ExitDBFatalError ServerAuthError err
-        killThread mainThreadId
-    err@(SQL.SessionUsageError (SQL.QueryError tpl _ (SQL.ResultError resultErr))) -> do
+    whenLeft res (\case
+      SQL.AcquisitionTimeoutUsageError ->
+        observer $ PoolAcqTimeoutObs SQL.AcquisitionTimeoutUsageError
+      err@(SQL.ConnectionUsageError e) ->
+        let failureMessage = BS.unpack $ fromMaybe mempty e in
+        when (("FATAL:  password authentication failed" `isInfixOf` failureMessage) || ("no password supplied" `isInfixOf` failureMessage)) $ do
+          observer $ ExitDBFatalError ServerAuthError err
+          killThread mainThreadId
+      err@(SQL.SessionUsageError (SQL.QueryError tpl _ (SQL.ResultError resultErr))) ->
+        handleResultError err tpl resultErr
+      err@(SQL.SessionUsageError (SQL.PipelineError (SQL.ResultError resultErr))) ->
+        -- Passing the empty template will not work for schema cache queries, see TODO further below.
+        handleResultError err mempty resultErr
+      err@(SQL.SessionUsageError (SQL.QueryError _ _ (SQL.ClientError _))) ->
+        -- An error on the client-side, usually indicates problems with connection
+        observer $ QueryErrorCodeHighObs err
+      SQL.SessionUsageError (SQL.PipelineError (SQL.ClientError _))  -> pure ()
+      )
+
+    return res
+  where
+    handleResultError err tpl resultErr = do
       case resultErr of
         SQL.UnexpectedResult{} -> do
           observer $ ExitDBFatalError ServerPgrstBug err
@@ -261,12 +274,6 @@ usePool AppState{stateObserver=observer, stateMainThreadId=mainThreadId, ..} ses
         SQL.ServerError{} ->
           when (Error.status (Error.PgError False err) >= HTTP.status500) $
             observer $ QueryErrorCodeHighObs err
-    err@(SQL.SessionUsageError (SQL.QueryError _ _ (SQL.ClientError _))) ->
-      -- An error on the client-side, usually indicates problems wth connection
-        observer $ QueryErrorCodeHighObs err
-    )
-
-  return res
 
 -- | Flush the connection pool so that any future use of the pool will
 -- use connections freshly established after this call.

diff --git a/src/PostgREST/Error.hs b/src/PostgREST/Error.hs
@@ -526,18 +526,22 @@ instance JSON.ToJSON SQL.UsageError where
 
 instance ErrorBody SQL.UsageError where
   code    (SQL.ConnectionUsageError _)                   = "PGRST000"
+  code    (SQL.SessionUsageError (SQL.PipelineError e))  = code e
   code    (SQL.SessionUsageError (SQL.QueryError _ _ e)) = code e
   code    SQL.AcquisitionTimeoutUsageError               = "PGRST003"
 
   message (SQL.ConnectionUsageError _) = "Database connection error. Retrying the connection."
+  message (SQL.SessionUsageError (SQL.PipelineError e))  = message e
   message (SQL.SessionUsageError (SQL.QueryError _ _ e)) = message e
   message SQL.AcquisitionTimeoutUsageError = "Timed out acquiring connection from connection pool."
 
   details (SQL.ConnectionUsageError e) = JSON.String . T.decodeUtf8 <$> e
+  details (SQL.SessionUsageError (SQL.PipelineError e))  = details e
   details (SQL.SessionUsageError (SQL.QueryError _ _ e)) = details e
   details SQL.AcquisitionTimeoutUsageError               = Nothing
 
   hint    (SQL.ConnectionUsageError _)                   = Nothing
+  hint    (SQL.SessionUsageError (SQL.PipelineError e))  = hint e
   hint    (SQL.SessionUsageError (SQL.QueryError _ _ e)) = hint e
   hint    SQL.AcquisitionTimeoutUsageError               = Nothing
 
@@ -586,8 +590,13 @@ instance ErrorBody SQL.CommandError where
 pgErrorStatus :: Bool -> SQL.UsageError -> HTTP.Status
 pgErrorStatus _      (SQL.ConnectionUsageError _) = HTTP.status503
 pgErrorStatus _      SQL.AcquisitionTimeoutUsageError = HTTP.status504
+pgErrorStatus _      (SQL.SessionUsageError (SQL.PipelineError (SQL.ClientError _)))       = HTTP.status503
 pgErrorStatus _      (SQL.SessionUsageError (SQL.QueryError _ _ (SQL.ClientError _)))      = HTTP.status503
-pgErrorStatus authed (SQL.SessionUsageError (SQL.QueryError _ _ (SQL.ResultError rError))) =
+pgErrorStatus authed (SQL.SessionUsageError (SQL.PipelineError (SQL.ResultError rError)))  = mapSQLtoHTTP authed rError
+pgErrorStatus authed (SQL.SessionUsageError (SQL.QueryError _ _ (SQL.ResultError rError))) = mapSQLtoHTTP authed rError
+
+mapSQLtoHTTP :: Bool -> SQL.ResultError -> HTTP.Status
+mapSQLtoHTTP authed rError =
   case rError of
     (SQL.ServerError c m d _ _) ->
       case BS.unpack c of

diff --git a/src/PostgREST/Metrics.hs b/src/PostgREST/Metrics.hs
@@ -53,7 +53,7 @@ observationMetrics MetricsState{..} obs = case obs of
   (PoolAcqTimeoutObs _) -> do
     incCounter poolTimeouts
   (HasqlPoolObs (SQL.ConnectionObservation _ status)) -> case status of
-     SQL.ReadyForUseConnectionStatus  -> do
+     SQL.ReadyForUseConnectionStatus _ -> do
       incGauge poolAvailable
      SQL.InUseConnectionStatus        -> do
       decGauge poolAvailable