pool-conduit VS tech-proposals

I understand that the "new" version of Persistent requires Servant Handler to be MonadUnliftIO which is not the case. I also understand that I am suppose to use acquireSqlConn somehowe (following this this), but I can't figure it out. Any ideas ?

I don't think there's any malicious intent. It seems pretty clear that the motivation here is to simplify the type checker considerably, which is a really good reason to do something. Heck, I've got an open issue for deleting a feature in persistent which (according to the lack of comments on the issue) only ever used by persistent's own test suite.

PR submitted: https://github.com/yesodweb/persistent/pull/1366 :)

Ha, I spotted a possible resource leak here. If stmtFinalize fail, then the connection won't be closed.

text Cloning b1e32adfe1da49cd9df997a13bd0c5b391486f5c from https://github.com/yesodweb/persistent.git No cabal file found for Repo from https://github.com/yesodweb/persistent.git, commit b1e32adfe1da49cd9df997a13bd0c5b391486f5c

As far as I know there is no such thing yet. The first step would be to actually collect the vulnerabilities in a central repository. The Haskell foundation has been working on such a repository, but I don't know the current status.

The Haskell foundation is working on An Advisory Repository for Haskell. That proposal also lists the necessary steps to get Dependabot support.

One body that is in a position to coordinate such funding efforts is the Haskell Foundation. Some relevant discussion is happening at https://github.com/haskellfoundation/tech-proposals/pull/27. If your work is willing to contribute funding then perhaps it would be beneficial to nudging it along if you chimed in and said so.