search

ForbesLindesay / atdatabases

TypeScript clients for databases that prevent SQL Injection
https://www.atdatabases.org
MIT License
609 stars 47 forks source link

Update mysql2 to >=v3.9.4 #323

Closed crisward closed 2 weeks ago

crisward commented 7 months ago

mysql2 <=3.9.3 Severity: critical mysql2 Remote Code Execution (RCE) via the readCodeFor function - https://github.com/advisories/GHSA-fpw7-j2hg-69v5 mysql2 vulnerable to Prototype Poisoning - https://github.com/advisories/GHSA-49j4-86m8-q2jw mysql2 cache poisoning vulnerability - https://github.com/advisories/GHSA-mqr2-w7wj-jjgr

Thanks.

pk910 commented 5 months ago

Got the same due to using @databases/mysql-test (4.0.2). Will there be an update or is the package stale?