[ajitpratap0]

Summary

• certifi 2026.7.22 → 2026.10.19 in .github/scripts/requirements-sentry.txt (Dependabot, critical: bundled emSign root CAs with compromised intermediate keys). Only certifi changed; regenerated with uv pip compile --generate-hashes --upgrade-package certifi.
• markdown-it 14.3.2 → 14.3.3 in vscode-extension/package-lock.json (Dependabot, high + low: quadratic-time rendering DoS). Lockfile only (npm update markdown-it --package-lock-only).
• Testcontainer startup bounded by the test deadline in pkg/schema/mysql and pkg/schema/postgres. The MariaDB container start ran into the 2-minute package -timeout on CI several times today (fix(tokenizer): point unterminated-literal errors at the opener (byte columns, a tab is one column) #827, fix(mcp): harden gosqlx-mcp HTTP server (rate limiting, timeouts, auth, tool errors) #831, fix(parser): parse composite fields and joined table functions #834). That panics and fails the whole package. Now the start uses a context ending 30s before the test binary deadline, so a slow pull or init returns an error and the existing t.Skipf("testcontainers unavailable") path skips the test.

Test Plan

• go vet ./pkg/schema/..., gofmt, go test -race -timeout 120s ./pkg/schema/... pass locally (Docker absent locally, so the containers skip; CI exercises the container path).
• Pre-commit hook (fmt, vet, short tests) passed.

Breaking Changes

None.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RkzVu3JY9Y6BRWfjesWts9

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
gosqlx-website	Ignored	Preview	Oct 21, 2026 3:01pm UTC

[github-actions]

Claude finished @ajitpratap0's task in 24s —— View job

---

Review of PR #837

Verdict: looks good, with a few minor notes.

• Read the diff and surrounding code

Dependency bumps

• certifi (hash-pinned, regenerated with only that package upgraded) and the markdown-it lockfile-only bump are minimal and appropriate. I didn't re-verify the hashes.

Testcontainer deadline (pkg/schema/mysql, pkg/schema/postgres)

• The approach is sound. startCtx is bounded by t.Deadline()-30s, and GenericContainer errors flow into the existing t.Skipf("testcontainers unavailable") path. The time import is already present in both files.
• Cleanup and later calls (Terminate, Host, MappedPort, PingContext) still use the unbounded ctx, so cancelling startCtx via defer cancel() when the helper returns doesn't affect the running container.

Minor points (non-blocking):

1. Shared package deadline. t.Deadline() is the whole binary's deadline, not the per-test one. If several tests start containers (MariaDB, MySQL variants), one slow start can consume nearly the whole budget. The remaining tests then skip with an expired context, and the 30s margin may be too small for later tests to finish their queries. This is still better than a package panic, but a per-start cap (for example min(deadline-30s, now+90s)) would keep a single slow image from starving the rest.
2. Skips can hide real failures. Any start error, including a genuine misconfiguration, becomes a skip. The existing code already did this, but it's worth a log line saying the cause was a deadline when startCtx.Err() != nil, so CI skips are diagnosable.
3. Duplication. The deadline block is copied in two packages. That's fine at this size, but a shared test helper would remove it if more loaders get added.
4. Edge case. If the remaining time is less than 30s, deadline.Add(-30s) is already in the past, so the start fails immediately and the test skips. That is acceptable behavior.

Tests: I couldn't run Docker here, so the container path is exercised only by CI. Nothing in this change is a security concern.
· branch chore/deps-and-mariadb-timeout

[github-actions]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Claude finished @ajitpratap0's task in 36s —— View job

---

Review of PR #837 (re-review after 5a8f6f4)

Verdict: looks good. I have no blocking issues.

• Read the dependency and test changes
• Checked that the follow-up commit addresses the earlier review

Follow-up commit (5a8f6f4)

• It addresses points 1 and 2 from the earlier review. Each start gets at most 75s and still ends 30s before the binary deadline. A skip caused by the budget now says so.
• containerStartContext computes min(now+75s, deadline-30s) correctly. If t.Deadline() is unset (-timeout 0), the 75s cap still applies. That is a sensible bound.
• defer cancel() runs when the helper returns. Cleanup, Host, MappedPort and PingContext use the unbounded ctx, so cancelling startCtx doesn't affect the running container.

Dependency bumps

• certifi is hash-pinned and markdown-it is a lockfile-only change. Both are minimal. I didn't re-verify the hashes.

Minor notes (non-blocking)

1. Slow-but-healthy pulls. 75s could be tight on a cold CI runner pulling MariaDB or MySQL. This only turns a package panic into a skip, but a consistently slow runner would silently lose integration coverage. Consider logging the elapsed time so you can tune the cap.
2. Leftover containers. If the context expires after the container is created but before the wait strategy passes, a container could be left behind. testcontainers normally cleans up on a failed start, and Ryuk (testcontainers' reaper container) reaps the rest. Check that Ryuk isn't disabled in CI.
3. Duplication. containerStartContext is identical in pkg/schema/mysql and pkg/schema/postgres. That is fine at this size. A shared internal test helper would be worth it if more loaders are added.
4. Mixed skip messages. The startCtx.Err() != nil check also fires when the failure is unrelated but happens to coincide with expiry. That is an acceptable edge case.

Tests: I didn't run them. Docker isn't available here, so the container path is exercised only by CI. Nothing in this change raises a security concern.
· branch chore/deps-and-mariadb-timeout

[github-actions]

Claude finished @ajitpratap0's task in 22s —— View job

---

Review of PR #837 (re-review after 5a8f6f4)

Verdict: looks good. I found no blocking issues. I read the diff but didn't run the tests. Docker isn't available here, so only CI exercises the container path.

Dependency bumps

• certifi is hash-pinned and markdown-it is a lockfile-only change. Both are minimal and appropriate. I didn't re-verify the hashes.

Testcontainer deadline (pkg/schema/mysql, pkg/schema/postgres)

• containerStartContext computes min(now+75s, deadline-30s). If -timeout 0 leaves t.Deadline() unset, the 75s cap still applies.
• Only GenericContainer uses startCtx. Terminate and later calls use the unbounded ctx, so the defer cancel() doesn't affect a running container.
• The new skip message separates budget expiry from other start failures.

Minor notes (non-blocking)

1. Leftover containers. If startCtx expires after the container is created but before the wait strategy passes, a container could be left behind. testcontainers normally cleans up after a failed start, and Ryuk (its reaper container) should reap the rest. Check that Ryuk isn't disabled in CI.
2. The 75s cap may be tight. A cold runner pulling the image could hit it. A consistently slow runner would then silently lose integration coverage. Logging the elapsed time would help tune the cap.
3. Duplication. containerStartContext is identical in both packages. That's fine now. If more loaders are added, move it to a shared test helper.
4. Skip message. The startCtx.Err() != nil check also fires when an unrelated failure happens to coincide with expiry. This is an acceptable edge case, and the underlying error is still printed.

No security concerns.
· branch chore/deps-and-mariadb-timeout