fix: connection pool leak in StartClient (sqlstore.New opens unbounded pool every reconnect)

[jefersonfborba]

Problem

StartClient() (called on every reconnect: disconnect retries, session
checks, ConnectInstance API calls) creates the whatsmeow session store
container via:

container, err = sqlstore.New(context.Background(), "postgres", w.config.PostgresAuthDB, dbLog)

sqlstore.New() calls sql.Open() internally, opening a brand-new,
unbounded Postgres connection pool on every call — and the resulting
container is never closed anywhere in StartClient(). Each reconnect
leaks one idle connection that is never released.

On a shared Postgres instance, this accumulates over days until
max_connections is exhausted, and every other service/database sharing
that Postgres starts failing with:

FATAL: remaining connection slots are reserved for non-replication superuser connections (SQLSTATE 53300)

We hit this in production 4 times over ~10 days (self-hosted, shared
Postgres): 2026-07-31, 2026-08-04, 2026-08-06 (escalated to exhausting even
the superuser-reserved slots, requiring a full docker restart of the
shared Postgres — affecting unrelated projects on the same server), and
2026-08-08 (~43 idle evogo_auth_user connections, oldest ~1d19h,
106/100 connections at capture time).

Root cause

whatsmeowService already opens authDB once, at startup, with a
correctly bounded pool (initPostgresAuthDB in cmd/evolution-go/main.go):

db.SetMaxOpenConns(25)
db.SetMaxIdleConns(5)
db.SetConnMaxLifetime(5 * time.Minute)
db.SetConnMaxIdleTime(1 * time.Minute)

...and injects it into whatsmeowService.authDB via NewWhatsmeowService.
But StartClient() never uses it for the whatsmeow session store — it
opens a fresh, unbounded pool from the DSN string every time instead.

Fix

Use sqlstore.NewWithDB(w.authDB, "postgres", dbLog) — which wraps an
existing *sql.DB instead of opening a new one — reusing the
already-pooled, already-limited connection. Since NewWithDB skips the
auto-upgrade that New() performs, container.Upgrade(ctx) is called
explicitly right after.

The sqlite fallback path (PostgresAuthDB == "") is untouched — it isn't
the source of this leak (local file, not a shared server).

Validation

I wasn't able to run go build ./... for this PR — my local Docker
daemon has a corrupted/read-only containerd filesystem unrelated to this
repo, and I don't have a local Go toolchain. The change is a 2-line
semantic substitution (confirmed against go.mau.fi/whatsmeow's
store/sqlstore/container.go — NewWithDB(db *sql.DB, dialect string, log waLog.Logger) *Container
signature matches exactly what's used here), but please run a build/lint
pass before merging — I couldn't verify it locally this time.

Related

Full incident history (4 occurrences, mitigation steps, pg_stat_activity
snapshots) documented downstream in a consumer project's backlog:
https://github.com/jefersonfborba/tabloides/blob/master/docs/backlog.md
(search "BL-028").

Summary by Sourcery

Reuse the existing pooled Postgres connection for the Whatsmeow session store to prevent connection pool leaks on client reconnects.

Bug Fixes:

• Fix a Postgres connection leak caused by opening a new, unbounded connection pool on every StartClient reconnect without closing it.

Enhancements:

• Standardize session store initialization to use a shared Postgres DB handle when configured, while keeping the sqlite fallback behavior unchanged.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

This PR fixes a Postgres connection pool leak in whatsmeowService.StartClient by reusing the already-pooled authDB connection via sqlstore.NewWithDB and simplifying the debug/non-debug branching for database logging, while leaving the sqlite fallback logic intact.

Sequence diagram for StartClient Postgres session store initialization

sequenceDiagram
  participant whatsmeowService
  participant authDB as sql.DB_authDB
  participant sqlstore as sqlstore
  participant container as sqlstore.Container

  whatsmeowService->>whatsmeowService: StartClient(cd *ClientData)
  alt WaDebug enabled
    whatsmeowService->>whatsmeowService: waLog.Stdout("Database", WaDebug, true)
  end
  alt PostgresAuthDB configured
    whatsmeowService->>sqlstore: NewWithDB(authDB, "postgres", dbLog)
    sqlstore-->>whatsmeowService: container
    whatsmeowService->>container: Upgrade(context.Background())
  else PostgresAuthDB not configured
    whatsmeowService->>sqlstore: New(context.Background(), "sqlite", dsn, dbLog)
    sqlstore-->>whatsmeowService: container
  end

Loading

File-Level Changes

Change	Details	Files
Reuse the shared, bounded Postgres *sql.DB (w.authDB) for the whatsmeow sqlstore container instead of opening a new, unbounded pool on every StartClient call, and explicitly run the container schema upgrade.	Introduce a reusable dbLog variable that is conditionally initialized when WaDebug is set. Replace sqlstore.New calls for the Postgres path with sqlstore.NewWithDB(w.authDB, "postgres", dbLog) to avoid creating new pools. Call container.Upgrade(context.Background()) after NewWithDB to perform the schema auto-upgrade that New previously handled. Simplify the control flow to a single Postgres vs sqlite branch, using dbLog consistently rather than duplicating debug/non-debug variants.	pkg/whatsmeow/service/whatsmeow.go

Possibly linked issues

• #Postgres connection leak: StartClient creates a new sqlstore.Container per (re)connect and never closes it: The PR reuses w.authDB via NewWithDB, preventing new unbounded pools per reconnect and fixing the described leak.
• #: PR changes StartClient to use shared authDB via NewWithDB, fixing the PostgreSQL connection pool leak.
• #Postgres connection leak: each (re)connect on a logged-out instance leaks an unclosed sqlstore pool (evogo_auth/evogo_users): PR changes StartClient to reuse the existing authDB pool, directly fixing the Postgres leak described in the issue.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}