A four-line feature change made a helper function documented as \"pure, no server-only imports\" start importing the Postgres driver. Because that helper lives in a file the public profile route imports directly, the driver — and the Node-only `Buffer` global it depends on — shipped to every visitor's browser. The server kept returning HTTP 200 with a correct HTML shell the whole time; every public profile page (`lastplayed.io/u/:username`) simply never hydrated client-side for ~5 hours.
started2026-07-05 22:26 UTC
PR #276 (Guilty Pleasure) merged and deployed. cardFactsFrom(), a helper documented as having no server-only imports, began importing ~/server/guilty-pleasure directly. The /u/:username client bundle started shipping the postgres driver — and the Buffer global it needs at module scope — into every browser. Pages kept returning 200 OK with a correct HTML shell; React never hydrated underneath it.
investigating2026-07-06 02:20 UTC
Incident reported and investigation began. Local repro attempts (dev mode, a fresh local production build, static bundle analysis) all came back clean — unknown at the time, the local checkout was two commits behind what was actually deployed.
investigating2026-07-06 02:57 UTC
Reproduced directly against the live production URL: a real browser threw ReferenceError: Buffer is not defined in the deployed _username-*.js chunk, confirming the bug existed only in the version actually running in production.
root cause2026-07-06 03:03 UTC
Root cause isolated: the deployed chunk contained postgres npm driver code (unique signature traced to node_modules/postgres/src/bytes.js), reached because cardFactsFrom() had gained a direct import of ~/server/guilty-pleasure in #276, which transitively imports getDb() and the driver.
implementing fix2026-07-06 03:14 UTC
Fix authored: the artist-masking logic was moved out of the plain cardFactsFrom() helper and into the getProfileCardFacts createServerFn handler, which is already safely stripped from the client bundle. cardFactsFrom() restored to zero server-only imports. Verified against a rebuilt production bundle in a real browser (0 console errors) and an independent code review, with no issues found.
implementing fix2026-07-06 03:17 UTC
Fix (PR #277) merged to main; cluster deployment triggered.
resolved2026-07-06 03:27 UTC
Live re-verification against production: lastplayed.io/u/:username loads with zero Buffer errors across two separate page loads. Incident closed as fully resolved, not mitigated — the leaked dependency was removed at its source.