Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency typeorm to v0.2.25 [SECURITY] #32

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update dependency typeorm to v0.2.25 [SECURITY] #32

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Mar 22, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
typeorm (source) 0.2.11 -> 0.2.25 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2020-8158

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

Release Notes

typeorm/typeorm (typeorm)

v0.2.25

Compare Source

Bug Fixes
Features
Performance Improvements
  • An optimized version of EntityMetadata#compareIds() for the common case (#​5419) (a9bdb37)

v0.2.24

Compare Source

Bug Fixes
Features

v0.2.23

Compare Source

Bug Fixes
Features

v0.2.22

Compare Source

Bug Fixes
Features
BREAKING CHANGES
  • aliases for very long relation names may be replaced with hashed strings.
    Fix: avoid collisions by using longest possible hash.
    Retain more entropy by not using only 8 characters of hashed aliases.

v0.2.21

Compare Source

Bug Fixes
Features

v0.2.20

Compare Source

Bug Fixes
Features

v0.2.19

Compare Source

Bug Fixes
  • "database" option error in driver when use "url" option for connection (690e6f5)
  • "hstore injection" & properly handle NULL, empty string, backslashes & quotes in hstore key/value pairs (#​4720) (3abe5b9)
  • add SaveOptions and RemoveOptions into ActiveRecord (#​4318) (a6d7ba2)
  • apostrophe in Postgres enum strings breaks query (#​4631) (445c740)
  • change PrimaryColumn decorator to clone passed options (#​4571) (3cf470d), closes #​4570
  • createQueryBuilder relation remove works only if using ID (#​2632) (#​4734) (1d73a90)
  • resolve issue with conversion string to simple-json (#​4476) (d1594f5), closes #​4440
  • sqlite connections don't ignore the schema property (#​4599) (d8f1c81)
  • the excessive stack depth comparing types FindConditions<?> and FindConditions<?> problem (#​4470) (7a0beed)
  • views generating broken Migrations (#​4726) (c52b3d2), closes #​4123
Features

v0.2.18

Compare Source

Bug fixes
  • fixed loadRelationCountAndMap when entities' primary keys are strings (#​3946)
  • fixed QueryExpressionMap not cloning all values correctly (#​4156)
  • fixed transform embeddeds with no columns but with nested embeddeds (mongodb) (#​4131)
  • fixed the getMany() result being droped randomly bug when using the buffer as primary key. (#​4220)
Features
  • adds typeorm migration:show command (#​4173)
  • deprecate column readonly option in favor of update and insert options (#​4035)
  • support sql.js v1.0 (#​4104)
  • added support for orUpdate in SQLlite (#​4097)
  • added support for dirty_read (NOLOCK) in SQLServer (#​4133)
  • extend afterLoad() subscriber interface to take LoadEvent (issue #​4185)
  • relation decorators (e.g. @OneToMany) now also accept string instead of typeFunction, which prevents circular dependency issues in the frontend/browser (issue #​4190)
  • added support for metadata reflection in typeorm-class-transformer-shim.js (issue #​4219)
  • added sqlJsConfig to input config when initializing sql.js (issue #​4559)

v0.2.17

Compare Source

Bug fixes
  • fixed transform embeddeds with boolean values (mongodb) (#​3900)
  • fixed issue with schema inheritance in STI pattern (#​3957)
  • revert changes from #​3814 (#​3828)
  • fix performance issue when inserting into raw tables with QueryBuilder
    (#​3931)
  • sqlite date hydration is susceptible to corruption (#​3949)
  • fixed mongodb uniques, support 3 ways to define uniques (#​3986)
  • fixed mongodb TTL index (#​4044)
Features
  • added deferrable options for foreign keys (postgres) (#​2191)
  • added View entity implementation (#​1024). Read more at View entities
  • added multiple value transformer support (#​4007)

v0.2.16

Compare Source

Bug fixes
  • removed unused parameters from insert, update, delete methods (#​3888)
  • fixed: migration generator produces duplicated changes (#​1960)
  • fixed: unique constraint not created on embedded entity field (#​3142)
  • fixed: FK columns have wrong length when PrimaryGeneratedColumn('uuid') is used (#​3604)
  • fixed: column option unique sqlite error (#​3803)
  • fixed: 'uuid' in PrimaryGeneratedColumn causes Many-to-Many Relationship to Fail (#​3151)
  • fixed: sync enums on schema sync (#​3694)
  • fixed: changes in enum type is not reflected when generating migration (in definition file) (#​3244)
  • fixed: migration will keep create and drop indexes if index name is the same across tables (#​3379)
Features
  • added lock option in FindOptions

v0.2.15

Compare Source

Bug fixes
  • fixed bug in connection.dropDatabase method (#​1414)
  • fixed "deep relations" not loaded/mapped due to the built-in max length of Postgres (#​3118)
  • updated all dependencies
  • fixed types issue from #​3725
  • removed sql-function-support (() => syntax) in parameters to prevent security considerations
  • fix sync schema issue with postgres enum in case capital letters in entity name (#​3536)
Features
  • added uuidExtension option to Postgres connection options, which allows TypeORM to use the newer pgcrypto extension to generate UUIDs

v0.2.14

Compare Source

Bug fixes
  • fixed migration issue with postgres numeric enum type - change queries are not generated if enum is not modified (#​3587)
  • fixed mongodb entity listeners in optional embeddeds (#​3450)
  • fixes returning invalid delete result
  • reverted lazy loading properties not enumerable feature to fix related bugs
Features
  • added CockroachDB support
  • added browser entry point to package.json (3583)
  • replaced backend-only drivers by dummy driver in browser builds
  • added useLocalForage option to Sql.js connection options, which enables asynchronous load and save operations of the datatbase from the indexedDB (#​3554)
  • added simple-enum column type (#​1414)

v0.2.13

Compare Source

Bug Fixes
  • fixed undefined object id field in case property name is _id (3517)
  • allow to use mongodb index options in Index decorator (#​3592)
  • fixed entity embeddeds indices in mongodb (#​3585)
  • fixed json/jsonb column data types comparison (#​3496)
  • fixed increment/decrement value of embedded entity (#​3182)
  • fixed missing call transformer.from() in case column is NULL (#​3395)
  • fixed signatures of update/insert methods, some find* methods in repositories, entity managers, BaseEntity and QueryBuilders
  • handle embedded documents through multiple levels in mongodb (#​3551)
  • fixed hanging connections in mssql driver (#​3327)
Features
  • Injection 2nd parameter(options) of constructor to ioredis/cluster is now possible(#​3538)

v0.2.12

Compare Source

Bug Fixes
  • fixed mongodb entity listeners and subscribers (#​1527)
  • fixed connection options builder - paramters parsed from url are assigned on top of options (#​3442)
  • fixed issue with logical operator precedence in QueryBuilder whereInIds (#​2103)
  • fixed missing isolationLevel in Connection.transaction() method (#​3363)
  • fixed broken findOne method with custom join column name
  • fixed issue with uuid in mysql (#​3374)
  • fixed missing export of Exclusion decorator
  • fixed ignored extra options in mongodb driver (#​3403, #​1741)
  • fixed signature of root getRepository function to accept EntitySchema<Entity> (#​3402)
  • fixed false undefined connection options passed into mongodb client (#​3366)
  • fixed ER_DUP_FIELDNAME with simple find (#​3350)
Features
  • added tslib to reduce package size (#​3457, #​3458)
  • queries are simplified in findByIds and whereInIds for simple entities with single primary key (#​3431)
  • added ioredis and ioredis-cluster cache support (#​3289,#​3364)
  • added LessThanOrEqual and MoreThanOrEqual find options (#​3373)
  • improve support of string, numeric and heterogeneous enums in postgres and mysql (#​3414)
  • default value of enum array in postgres is now possible define as typescript array (#​3414)
@&#8203;Column({
    type: "enum",
    enum: StringEnum,
    array: true,
    default: [StringEnum.ADMIN]
})
stringEnums: StringEnum[];
Breaking changes
  • UpdateQueryBuilder now throw error if update values are not provided or unknown property is passed into .set() method (#​2849,#​3324)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-typeorm-vulnerability branch from 351f56d to 9bbe347 Compare August 8, 2024 06:00
@renovate renovate bot changed the title Update dependency typeorm to ^0.3.0 [SECURITY] Update dependency typeorm to v0.2.25 [SECURITY] Aug 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants