{ "interval": { "intervalStart": "2026-01-08T00:00:00.000Z", "intervalEnd": "2026-01-09T00:00:00.000Z", "intervalType": "day" }, "repository": "elizaos/eliza", "overview": "From 2026-01-08 to 2026-01-09, elizaos/eliza had 1 new PRs (0 merged), 5 new issues, and 3 active contributors.", "topIssues": [ { "id": "I_kwDOMT5cIs7iLvxT", "title": "New copy for agent builder", "author": "borisudovicic", "number": 6348, "repository": "elizaos/eliza", "body": "Old copy:\n\n\"Screenshot\n\nNew copy: \n\nHi, I'm Eliza. I can help build your agent in two different ways:\n\n1. You can describe what you're imagining - personality, purpose, whatever - and I'll create the agent conversationally as we go. \n2. You can also build the agent manually on the right. \n\nSo, what are we making?", "createdAt": "2026-01-08T22:49:51Z", "closedAt": null, "state": "OPEN", "commentCount": 0 }, { "id": "I_kwDOMT5cIs7iLnBm", "title": "New copy for agent edit", "author": "borisudovicic", "number": 6347, "repository": "elizaos/eliza", "body": "Old copy:\n\n\"Screenshot\n\nNew copy: \n\nYou can update your agent conversationally in this space, or edit them directly on the right. What needs tweaking?", "createdAt": "2026-01-08T22:35:52Z", "closedAt": null, "state": "OPEN", "commentCount": 0 }, { "id": "I_kwDOMT5cIs7iLihv", "title": "On mobile, in agent builder, can we set name of agent to start with capital letter by default", "author": "borisudovicic", "number": 6346, "repository": "elizaos/eliza", "body": "", "createdAt": "2026-01-08T22:28:57Z", "closedAt": null, "state": "OPEN", "commentCount": 0 }, { "id": "I_kwDOMT5cIs7iLhl8", "title": "Web search doesn't work sometimes", "author": "borisudovicic", "number": 6345, "repository": "elizaos/eliza", "body": "", "createdAt": "2026-01-08T22:27:30Z", "closedAt": null, "state": "OPEN", "commentCount": 0 }, { "id": "I_kwDOMT5cIs7iLg4d", "title": "Can we make these boxes the same size?", "author": "borisudovicic", "number": 6344, "repository": "elizaos/eliza", "body": "[Screen Recording 2026-01-08 at 17.26.08.mov](https://uploads.linear.app/186bdefa-3633-464a-80cd-6e86fe765a5c/f7471f51-502f-4a36-aca5-e0e858155799/c8840a41-adda-49d9-8155-af781b198362?signature=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwYXRoIjoiLzE4NmJkZWZhLTM2MzMtNDY0YS04MGNkLTZlODZmZTc2NWE1Yy9mNzQ3MWY1MS01MDJmLTRhMzYtYWNhNS1lMGU4NTgxNTU3OTkvYzg4NDBhNDEtYWRkYS00OWQ5LTgxNTUtYWY3ODFiMTk4MzYyIiwiaWF0IjoxNzY3OTEyODQ3LCJleHAiOjE3OTk0ODM0MDd9.pwSIUAikEzl_2sFHVq8xRwjoxccUzYWy8h3CY2Lb4JU)", "createdAt": "2026-01-08T22:26:31Z", "closedAt": null, "state": "OPEN", "commentCount": 0 } ], "topPRs": [ { "id": "PR_kwDOMT5cIs68JNPi", "title": "feat(plugin-sql): add Neon serverless support & improve RLS security", "author": "standujar", "number": 6343, "body": "## Summary\r\n\r\nThis PR introduces several improvements to the plugin-sql package focused on security, clarity, and Neon serverless database support.\r\n\r\n### Key Changes\r\n\r\n1. **Neon Serverless Support** - Added dedicated adapter and connection manager for Neon databases using `@neondatabase/serverless`, providing WebSocket-based connections optimized for serverless environments.\r\n\r\n2. **Unified RLS Context Method** - Renamed `withEntityContext` to `withIsolationContext` to better reflect that it handles both Server RLS (`app.server_id`) and Entity RLS (`app.entity_id`) context in a single transaction.\r\n\r\n3. **SQL Injection Protection** - Migrated from `sql.raw()` string interpolation to `set_config()` with parameterized queries for setting RLS context variables. This provides defense-in-depth against SQL injection.\r\n\r\n## Technical Details\r\n\r\n### RLS Context Setting - Before vs After\r\n\r\n**Before (vulnerable to SQL injection):**\r\n```typescript\r\nawait tx.execute(sql.raw(`SET LOCAL app.entity_id = '${entityId}'`));\r\n```\r\n\r\n**After (parameterized and secure):**\r\n```typescript\r\nawait tx.execute(sql`SELECT set_config('app.entity_id', ${entityId}, true)`);\r\n```\r\n\r\nBoth approaches are functionally identical:\r\n- `set_config('app.entity_id', $1, true)` with params `[entityId]`\r\n- The third parameter `true` means transaction-local (same as `SET LOCAL`)\r\n\r\nThe key difference is that `set_config()` supports parameterized queries while `SET LOCAL` does not, providing proper SQL injection protection.\r\n\r\n### Neon Serverless Architecture\r\n\r\n```\r\n┌─────────────────────────────────────────────────────────┐\r\n│ NeonDatabaseAdapter │\r\n│ - Extends BaseDrizzleAdapter │\r\n│ - Auto-detects Neon URLs (*.neon.tech) │\r\n│ - WebSocket-based connections for edge/serverless │\r\n└─────────────────────────────────────────────────────────┘\r\n │\r\n ▼\r\n┌─────────────────────────────────────────────────────────┐\r\n│ NeonConnectionManager │\r\n│ - Uses @neondatabase/serverless Pool │\r\n│ - Connection pooling handled by Neon's proxy │\r\n│ - withIsolationContext() for RLS │\r\n└─────────────────────────────────────────────────────────┘\r\n```\r\n\r\n## Files Changed\r\n\r\n| File | Change |\r\n|------|--------|\r\n| `src/neon/adapter.ts` | New Neon database adapter |\r\n| `src/neon/manager.ts` | New Neon connection manager with `withIsolationContext` |\r\n| `src/pg/manager.ts` | Updated to use `set_config()` with parameterization |\r\n| `src/base.ts` | Renamed method to `withIsolationContext` |\r\n| `src/rls.ts` | Updated `current_server_id()` to read from `app.server_id` |\r\n| `src/index.node.ts` | Added Neon URL detection and adapter selection |\r\n| `src/pglite/adapter.ts` | Added `withIsolationContext` (no-op for PGLite) |\r\n| `src/__tests__/integration/postgres/rls-*.test.ts` | Updated to use `SET app.server_id` |\r\n| `src/__tests__/unit/pg/manager.test.ts` | Updated to verify `set_config()` usage |\r\n\r\n## Test Plan\r\n\r\n- [x] Unit tests pass (160 tests)\r\n- [x] Server unit tests pass (431 tests)\r\n- [x] PostgreSQL integration tests pass (41 tests)\r\n- [x] RLS integration tests pass (28 tests)\r\n - [x] rls-entity.test.ts (8 tests)\r\n - [x] rls-server.test.ts (5 tests)\r\n - [x] rls-logs.test.ts (8 tests)\r\n - [x] rls-message-server-agents.test.ts (7 tests)\r\n- [x] Server integration tests pass (10 tests)\r\n\r\n## Breaking Changes\r\n\r\n- `withEntityContext` renamed to `withIsolationContext` - update any direct calls to this method\r\n\r\n## Security Considerations\r\n\r\nThis PR addresses a potential SQL injection vector identified in PR review:\r\n\r\n| Aspect | Before | After |\r\n|--------|--------|-------|\r\n| Query Type | String interpolation | Parameterized query |\r\n| SQL Injection | Possible (if UUID validation bypassed) | Not possible |\r\n| Behavior | Transaction-local | Transaction-local |\r\n| Performance | Same | Same |\r\n\r\nWhile UUID validation already provides protection, using parameterized queries adds defense-in-depth following security best practices.\r\n\r\n## References\r\n\r\n- [PostgreSQL set_config documentation](https://www.postgresql.org/docs/current/config-setting.html)\r\n- [Crunchy Data - Row Level Security for Tenants](https://www.crunchydata.com/blog/row-level-security-for-tenants-in-postgres)\r\n- [Permit.io - Postgres RLS Implementation Guide](https://www.permit.io/blog/postgres-rls-implementation-guide)", "repository": "elizaos/eliza", "createdAt": "2026-01-08T15:23:18Z", "mergedAt": "2026-01-09T21:09:43Z", "additions": 649, "deletions": 204 } ], "codeChanges": { "additions": 0, "deletions": 0, "files": 0, "commitCount": 4 }, "completedItems": [], "topContributors": [ { "username": "standujar", "avatarUrl": "https://avatars.githubusercontent.com/u/16385918?u=718bdcd1585be8447bdfffb8c11ce249baa7532d&v=4", "totalScore": 47.749655968942854, "prScore": 47.749655968942854, "issueScore": 0, "reviewScore": 0, "commentScore": 0, "summary": null }, { "username": "kamiyo-ai", "avatarUrl": "https://avatars.githubusercontent.com/u/197570892?u=4c83683aeb4fdfcb6c7e747ec6fd77619964952b&v=4", "totalScore": 14.346573590279972, "prScore": 14.346573590279972, "issueScore": 0, "reviewScore": 0, "commentScore": 0, "summary": null }, { "username": "borisudovicic", "avatarUrl": "https://avatars.githubusercontent.com/u/31806472?u=8935f4d43fd7e4eb9bf5ff92d54d4d2f8ac8a786&v=4", "totalScore": 10, "prScore": 0, "issueScore": 10, "reviewScore": 0, "commentScore": 0, "summary": null }, { "username": "greptile-apps", "avatarUrl": "https://avatars.githubusercontent.com/in/867647?v=4", "totalScore": 9.2, "prScore": 0, "issueScore": 0, "reviewScore": 9, "commentScore": 0.2, "summary": null } ], "newPRs": 1, "mergedPRs": 0, "newIssues": 5, "closedIssues": 0, "activeContributors": 3 }