From 9f3a82dd63ef9b3bd95dcb5efeab49a1cbf8951a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Guti=C3=A9rrez?= <35082514+alezmad@users.noreply.github.com> Date: Thu, 16 Apr 2026 12:55:04 +0100 Subject: [PATCH] fix(broker): use sql.unsafe for SET lock_timeout in migrate Co-Authored-By: Claude Opus 4.6 (1M context) --- apps/broker/src/migrate.ts | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/apps/broker/src/migrate.ts b/apps/broker/src/migrate.ts index 28cb4e5..c4f4d7c 100644 --- a/apps/broker/src/migrate.ts +++ b/apps/broker/src/migrate.ts @@ -49,15 +49,12 @@ export async function runMigrationsOnStartup(): Promise { const sql = postgres(url, { max: 1, onnotice: () => { /* quiet */ }, - // Statement-level safety net in case a long ALTER holds row locks. - // 5 min per statement is plenty for schema DDL. - statement_timeout: 5 * 60 * 1000, }); try { - // Set a lock_timeout for this session — PG will refuse to block more - // than N ms on any lock acquisition (we only hold one at a time). - await sql`SET lock_timeout = ${LOCK_ACQUIRE_TIMEOUT_MS}`; + // SET doesn't accept parameterized values ($1) — use unsafe() for + // the literal. The value is a hardcoded constant, not user input. + await sql.unsafe(`SET lock_timeout = '${LOCK_ACQUIRE_TIMEOUT_MS}ms'`); // Try to grab the advisory lock; poll if someone else holds it. const deadline = Date.now() + LOCK_ACQUIRE_TIMEOUT_MS;