Jonathan Dance (JD)

never run aggressive

3

aggressive is a very intensive and most likely unneeded task that is unlikely to finish in a dyno. for more on aggressive, see: http://metalinguist.wordpress.com/2007/12/06/the-woes-of-git-gc-aggressive-and-how-git-deltas-work/

[In DevCenter](https://devcenter.heroku.com/articles/two-factor-authentication#recovering-from-lock-out), we warn: > If you are locked out due to a two-factor issue, DO NOT reset your password. We should put this on the reset password page.

When API is in maintenance, you get a 'normal' 500 screen.  It'd be better to: - detect that API is in maintenance mode - show status information - send...

Log hooks/middlewares

3

I would like to use Scrolls as a single logging pipe, but what I need to do is also have a way to capture that data via another (additional) mechanism...

### What's wrong? `latest` is tracking PG14: https://github.com/hydradatabase/hydra/pkgs/container/hydra This might break things for people pulling down `latest`, they will need to run pg_upgrade on their data, so we should look...

### What's wrong? pg13 is 3 years old, I think we can at least announce we are deprecating support, and plan to remove support soon thereafter. We do need to...

Create repeatable benchmarks. Have "quick" benchmarks that run on a PR, and more substantial benchmarks when merged to main. Publicly display results of the benchmarks.

security: GUC to block access to local filesystem

5

Discussed this a _long_ time ago... but currently we allow DuckDB to read from the local filesystem. This is a security risk; the CSV reader is particularly easy to use...