To limit supply-chain attack vectors I'm trying to absorb and consolidate all pg-* libraries depended on into this repo so it can be versioned in lock-step and there are no transitive dependencies (except devDependencies) outside of things in this repo. Longer term (I have a TODO comment about it in the code already) I want to remove pg-pass as a dependency and have it something someone can install optionally. It was added before the .password connection param could be made a function for inversion of control. Now that its possible to do whatever you want async to get the password, pg-pass eventually should be not included. In the mean time its a breaking change to remove it and adding pacakges to the monorepo is pretty easy.