-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update dependency knex to v2 [SECURITY] #52
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/npm-knex-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
October 9, 2024 08:49
5d3ad41
to
39bb72f
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Oct 9, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
October 11, 2024 05:08
39bb72f
to
0f1fbc3
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Oct 11, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
October 29, 2024 05:58
0f1fbc3
to
b5850be
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Oct 29, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
November 1, 2024 08:24
b5850be
to
4e19fa2
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Nov 1, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
November 18, 2024 11:47
4e19fa2
to
3087a09
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Nov 18, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
November 19, 2024 05:56
3087a09
to
ba8cae4
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Nov 19, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 2, 2024 23:46
ba8cae4
to
3d5e548
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Dec 2, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 5, 2024 02:52
3d5e548
to
5ee2f14
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Dec 5, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 21, 2024 15:01
5ee2f14
to
97429ae
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Dec 21, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 22, 2024 09:01
97429ae
to
a69309c
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Dec 22, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 24, 2024 08:49
a69309c
to
50e3ace
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Dec 24, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
December 25, 2024 17:46
50e3ace
to
07c0840
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Dec 25, 2024
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
January 15, 2025 03:41
07c0840
to
a7f4511
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Jan 15, 2025
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
January 17, 2025 11:18
a7f4511
to
d7c24a8
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Jan 17, 2025
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
January 23, 2025 20:19
d7c24a8
to
d35bb8f
Compare
renovate
bot
changed the title
Update dependency knex to v2 [SECURITY]
Update dependency knex to ^0.95.0 [SECURITY]
Jan 23, 2025
renovate
bot
force-pushed
the
renovate/npm-knex-vulnerability
branch
from
January 25, 2025 06:57
d35bb8f
to
727fe0c
Compare
renovate
bot
changed the title
Update dependency knex to ^0.95.0 [SECURITY]
Update dependency knex to v2 [SECURITY]
Jan 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.15.2
->^2.4.0
GitHub Vulnerability Alerts
CVE-2019-10757
knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
CVE-2016-20018
Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query. This vulnerability has been fixed in version 2.4.0.
Release Notes
knex/knex (knex)
v2.4.0
Compare Source
New features:
Bug fixes
Typings:
v2.3.0
Compare Source
New features:
Typings:
v2.2.0
Compare Source
New features:
Bug fixes:
Typings:
v2.1.0
Compare Source
New features:
Bug fixes:
Typings:
v2.0.0
Compare Source
Breaking changes
Test / internal changes:
v1.0.7
Compare Source
Bug fixes:
v1.0.6
Compare Source
Bug fixes:
v1.0.5
Compare Source
New features:
Bug fixes:
Typings:
Knex
match the generic parameter types ofknex
#5021v1.0.4
Compare Source
New features:
Bug fixes:
Typings:
Documentation:
v1.0.3
Compare Source
Bug fixes:
Typings:
Improvements:
Documentation:
v1.0.2
Compare Source
New features:
Bug fixes:
Typings:
v1.0.1
Compare Source
Bug fixes:
v1.0.0
Compare Source
Breaking changes
sqlite3
driver with@vscode/sqlite3
;RETURNING
operation to be consistent withSELECT
;New features:
Bug fixes:
Typings:
v0.95.15
Compare Source
Bug fixes:
v0.95.14
Compare Source
Bug fixes:
v0.95.13
Compare Source
Bug fixes:
Typings:
v0.95.12
Compare Source
New features:
Bug fixes:
Typings:
v0.95.11
Compare Source
New features:
Bug fixes:
Improvements:
v0.95.10
Compare Source
Improvements:
Typings:
v0.95.9
Compare Source
New features:
Typings:
v0.95.8
Compare Source
New features:
Bug fixes:
Typings:
v0.95.7
Compare Source
New features:
Typings:
v0.95.6
Compare Source
Typings:
v0.95.5
Compare Source
New features:
Bug fixes:
Typings:
v0.95.4
Compare Source
Typings:
v0.95.3
Compare Source
New features:
Bug fixes:
Typings:
v0.95.2
Compare Source
New features:
Bug fixes:
Typings:
Test / internal changes:
v0.95.1
Compare Source
Bug fixes:
v0.95.0
Compare Source
Note: there are many breaking changes in this version, particularly in TypeScript support. Please see
UPGRADING.md
for details.New features:
Bug fixes:
type
was set to'module'
inpackage.json
#4295Typings:
Test / internal changes:
v0.21.21
Compare Source
v0.21.20
Compare Source
v0.21.19
Compare Source
v0.21.18
Compare Source
v0.21.17
Compare Source
Bug fixes:
New features:
v0.21.16
Compare Source
Bug fixes:
v0.21.15
Compare Source
New features:
Typings:
Test / internal changes:
v0.21.14
Compare Source
New features:
Bug fixes:
Test / internal changes:
v0.21.13
Compare Source
New features:
dropForeign
#4092Bug fixes:
Typings:
Test / internal changes:
v0.21.12
Compare Source
Typings:
v0.21.11
Compare Source
Typings:
v0.21.10
Compare Source
New features:
Bug fixes:
Typings:
v0.21.9
Compare Source
New features:
Bug fixes:
v0.21.8
Compare Source
Bug fixes:
v0.21.7
Compare Source
New features:
Bug fixes:
Typings:
Test / internal changes:
v0.21.6
Compare Source
New features:
Bug fixes:
Typings:
v0.21.5
Compare Source
New features:
Test / internal changes:
v0.21.4
Compare Source
New features:
Bug fixes:
v0.21.3
Compare Source
New features:
Bug fixes:
Typings:
null
as valid binding type #3946Test / internal changes:
v0.21.2
Compare Source
New features:
void
as return type on migration generator ts stub #3865Typings:
Test / internal changes:
v0.21.1
Compare Source
v0.21.0
Compare Source
Improvements
Breaking changes
pg-query-stream
:Changed stream.close to stream.destroy which is the official way to terminate a readable stream. This is a breaking change if you rely on the stream.close method on pg-query-stream...though should be just a find/replace type operation to upgrade as the semantics remain very similar (not exactly the same, since internals are rewritten, but more in line with how streams are "supposed" to behave).
Test / internal changes:
v0.20.15
Compare Source
Bug fixes:
.finally(..)
on knex's Promise-alikes #3800Typings:
.distinctOn
#3784v0.20.14
Compare Source
New features:
Typings:
interface Knex
andfunction Knex
should have the same types #3787Test / internal changes:
v0.20.13
Compare Source
Bug fixes:
Typings:
v0.20.12
Compare Source
Bug fixes:
Typings:
Test / internal changes:
v0.20.11
Compare Source
Breaking changes:
map
,spread
andreduce
on QueryBuilder instance.New features:
Bug fixes:
Typings:
Test / internal changes:
v0.20.10
Compare Source
Bug fixes:
Typings:
fn.now
takes optionally a precision argument. #3662Test / internal changes:
v0.20.9
Compare Source
Bug f
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.