Do not open a public issue for an undisclosed vulnerability. Use GitHub's private vulnerability reporting for alexandroit/stackline-pg-types.

Include the affected version, runtime, minimal reproduction, impact and any known mitigation. Reports are acknowledged as soon as practical and coordinated disclosure is preferred.

The published package has zero runtime dependencies. Parser components derived from the former production dependency chain are maintained in-tree with exact provenance and complete license notices. A release is blocked by an advisory, warning, invalid recursive tree, missing notice or nonzero production/full npm audit.

Parser registries use null-prototype dictionaries. Regression tests verify that dangerous keys cannot alter Object.prototype. Multi-megabyte malformed date, interval, array and bytea inputs run under hard child-process deadlines to prevent regular-expression or parser denial of service regressions.