search

zkitter / zkitterd

MIT License
10 stars 2 forks source link

Upgrade sequelize #58

Closed sripwoud closed 1 year ago

sripwoud commented 1 year ago

sequelize is used as ORM library in zkitterd. Versions < 6.21.2 are vulnerable to SQL injection attacks. https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2959225

Raw queries with string replacement are especially used for the posts search endpoint.

I don't expect breaking changes as it is a minor upgrade (didn't check though).

0xtsukino commented 1 year ago

https://github.com/zkitter/zkitterd/blob/main/package.json sequelize at 6.26 on master