Upgrade deps available to reduce vulnerabilities

sqlectron / sqlectron-gui

A simple and lightweight SQL client desktop with cross database and platform support.

https://sqlectron.github.io/

MIT License

4.58k stars 524 forks source link

Upgrade deps available to reduce vulnerabilities #664

Closed maxcnunes closed 3 years ago

maxcnunes commented 3 years ago

Will close https://github.com/sqlectron/sqlectron-gui/issues/533 and https://github.com/sqlectron/sqlectron-gui/issues/618.

Upgrade a few dependencies to reduce the number of vulnerabilities reported by NPM audit.

The most important update is for JointJS which required allowing unsafe-eval in CSP rules (more details in https://github.com/sqlectron/sqlectron-gui/issues/663).

With this upgrading, now NPM audit has just a few vulnerabilities listed and it seems they are all from storybook deps, which is only a dev dependency:

found 53 vulnerabilities (49 moderate, 4 high) in 3826 scanned packages

maxcnunes commented 3 years ago

@MasterOdin I intend to release a new version once this change is merged

MasterOdin commented 3 years ago

I'm not convinced it's worth keeping the diagram feature around. Testing out this PR, sqlectron generates the following diagram

This is the same though that 1.31.0 also generated, so it would seem this has been broken for some time, making me wonder if anyone is actually using this feature.

For reference, DBBeaver generates the following diagram:

maxcnunes commented 3 years ago

I was testing on MySQL only, which seems to be generating the diagram properly:

I just tested it on Postgres and I get the same error as you. I guess this is an issue for adapters with schema support (PG, MSSQL). That means if anyone is really using this feature it is only on MySQL otherwise we would have got a report for it already. Since it is already like that, I would like to get it merged as it is now, and I created this ticket specifically for the fixing to support the other adapters.