Skip to content

Remove deprecated mcp command and harden D1 import identifiers - #1360

Merged
no-itsbackpack merged 4 commits into
mainfrom
fix/d1-import-security
Aug 19, 2026
Merged

Remove deprecated mcp command and harden D1 import identifiers#1360
no-itsbackpack merged 4 commits into
mainfrom
fix/d1-import-security

Conversation

@no-itsbackpack

Copy link
Copy Markdown
Contributor

Removes the deprecated local pscale mcp command. MCP clients should use the hosted server at https://mcp.pscale.dev/mcp/planetscale.

Also quotes and validates identifiers written into D1 import pgloader scripts, and keeps per-table load files inside the work directory.

Use the hosted MCP server instead of the local pscale mcp command.
Quote and validate identifiers written into D1 import pgloader scripts,
and keep per-table load files inside the work directory.

Co-authored-by: Cursor <cursoragent@cursor.com>
@no-itsbackpack
no-itsbackpack requested a review from a team as a code owner August 19, 2026 21:35
pgloader string literals cannot contain a single quote, so LIKE filters
must not interpolate those names. Drop the leftover README note about
the removed local mcp command.

Co-authored-by: Cursor <cursoragent@cursor.com>

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit ed25b07. Configure here.

Comment thread internal/import/d1/pgloader.go

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: medium. Left a non-blocking comment because Cursor Bugbot skipped and reported an unresolved identifier-quoting finding that needs human review. No reviewers were assigned.

Open in Web View Automation 

Sent by Cursor Approval Agent: cli-reviewer

no-itsbackpack and others added 2 commits August 19, 2026 16:51
Names containing a double quote use pgloader's single-quoted form, which
its CAST grammar accepts as an identifier. Also cover rejection of a
column name that cannot be quoted.

Co-authored-by: Cursor <cursoragent@cursor.com>
The test name already says what it covers.

Co-authored-by: Cursor <cursoragent@cursor.com>
@no-itsbackpack
no-itsbackpack merged commit 823ce48 into main Aug 19, 2026
4 checks passed
@no-itsbackpack
no-itsbackpack deleted the fix/d1-import-security branch August 19, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants