Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency pg-promise to v10 #37

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mend-for-jackfan.us.kg[bot]
Copy link

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot commented Dec 11, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
pg-promise ^4.4.6 -> ^10.7.0 age adoption passing confidence

By merging this PR, the below issues will be automatically resolved and closed:

Severity CVSS Score CVE GitHub Issue
Critical 9.8 CVE-2017-16082 #11
Medium 5.3 CVE-2022-25883 #36

Release Notes

vitaly-t/pg-promise (pg-promise)

v10.7.0

Compare Source

  • Implemented #​756
  • Updated dependencies

v10.6.2

Compare Source

  • Minor code refactoring + dev dependencies updated.

v10.6.1

Compare Source

  • Updated the driver dependency, with the fix for #​748

v10.6.0

Compare Source

  • Refactoring out some old code and documentation
  • Multiple dependencies updated, including the latest driver + TypeScript v4

v10.5.8

Compare Source

  • Dependencies updated, including the driver, which should bring performance improvements for bytea type, see this PR.

v10.5.7

Compare Source

  • Improved TypeScript declarations, including #​735
  • Updated dependencies

v10.5.6

Compare Source

  • Dependencies updated, including pg driver to v8.2.1

v10.5.5

Compare Source

  • Fixed invalid setters in the code

v10.5.4

Compare Source

  • Dependences updated, including pg driver to v8.1.0

v10.5.3

Compare Source

  • Minor TypeScript declaration fix for #​722

v10.5.2

Compare Source

  • Fixing #​717 - adding NodeJS v14 support.
  • Dependencies updated.

v10.5.1

Compare Source

  • Dependencies updated, including the driver to v8.0.2

v10.5.0

Compare Source

  • Driver has been updated to version 8.0.0; See its changelog.
  • Removed hiding password in connection, as the driver now handles it.
  • Removed idleTimeoutMillis (in TypeScript) from defaults, due to this bug, and #​703
  • Updated dependencies + documentation

v10.4.4

Compare Source

  • Dependencies updated, including the driver to v7.18.2
  • Added test coverage for the color console

v10.4.3

Compare Source

  • Improving error reporting for event handlers.
  • Refactoring strings to use ES6 syntax everywhere.
  • DEV dependencies updated.

v10.4.2

Compare Source

  • Improved errors + warnings reporting.

v10.4.1

Compare Source

v10.4.0

Compare Source

  • Updated driver to the latest 7.18.1, see #​687
  • Dropped support for pg-query-stream < 3.0.0, see #​695
  • Dropped support for Nodejs < 8.0.0 (because of the new streams)

v10.3.5

Compare Source

  • Fixed #​680, and potentially similar connectivity issues, to auto-kill non-queryable connections.

This is an important overall-connectivity fix on the base driver, which sometimes would give us a dead connection.

v10.3.4

Compare Source

  • Fixed #​682
  • Minor code refactoring + documentation updates

There has been a discrepancy with the driver, as it's undergone many changes when it comes to supporting connection timeouts.

Property connect_timeout now has been removed from the defaults of the driver, and property connectionTimeoutMillis added to the connection parameters, which is the only correct way to set the connection timeout:

const db = pgp({
    database: 'my-db'
    /* other connection properties */

    connectionTimeoutMillis: 2000 // set connection timeout to 2 seconds
});

Note that this change affects only TypeScript clients.

v10.3.3

Compare Source

Method proc had a limited functionality, without supporting procedures with output parameters. The method's signature has been revised, to let you get the output values + optionally transform them.

Example

Say, you have a procedure like this one:

CREATE OR REPLACE PROCEDURE test_proc(INOUT output1 INT, INOUT output2 TEXT)
LANGUAGE plpgsql AS $$
BEGIN
    output1 := 123;
    output2 := concat(output2, '-hello!');
END;$$;

Then the following calls can be made now:

await db.proc('test_proc', [null, 'world']);
//=> {output1: 123, output2: 'world-hello!'}

await db.proc('test_proc', [null, 'world'], a => a.output2);
//=> 'world-hello!'

v10.3.2

Compare Source

  • Migrated tests to PostgreSQL v11
  • Documentation updates
  • DEV dependencies updated

No code changes.

After some tests, and looking at what's going on with the driver, decided again upgrading, for now, until it becomes something better. Sometime in January 2020, perhaps.

v10.3.1

Compare Source

  • Removed now obsolete min connection option from the TypeScript. The connection pool no longer supports it.

v10.3.0

Compare Source

  • Driver updated to v7.14.0
  • DEV dependencies updated

v10.2.1

Compare Source

pg-native crawled into 10.2.0 package, yet again, after my local tests, thanks to the npm's damn auto-save feature, and it got published unknowingly 😠

This update just throws pg-native away from the package, as it doesn't belong there.

v10.2.0

Compare Source

  • Implemented #​675 feature, to support killing manual connections
  • Documentation updates

UPDATE

The package got crippled here, with pg-native dependency injected by mistake. Removed in 10.2.1.

v10.1.0

Compare Source

Implemented #​673 - adding serverVersion everywhere.


Now you have the server version inside any task or transaction context (see TaskContext):

db.task(t => {
    console.log('Server Version:', t.ctx.serverVersion);
});

And the low-level Client type has been extended as well:

db.connect().then(c => {
    console.log('Server Version:', c.client.serverVersion);
    c.done();
})

NOTE: This feature is not available with Native Bindings

v10.0.1

Compare Source

Documentation updates only.

v10.0.0

Compare Source

Below are breaking changes:

  • Implemented #​670. Method proc signature has changed, and it now produces the new CALL procName() syntax, for native stored procedures, which requires PostgreSQL v11 or later.
  • Fixed #​671. Methods proc and func now will add double quotes around the name, if it not same-case or contains extended symbols (using alias).

v9.3.6

Compare Source

  • A few minor improvements and code refactoring.
  • Updating DEV dependencies
  • Adding tests

v9.3.5

Compare Source

Quick patch for #​667, to let TypeScript also infer the client type for events within the initialization options.

Example

import * as pgPromise from 'pg-promise';

const pgp: pgPromise.IMain<{}, MyClient> = pgPromise({
    connect(client) {
        // client type is inferred correctly here, as type MyClient
    }
});

v9.3.4

Compare Source

  • Implemented #​667
  • DEV dependencies updated

No code changes.

v9.3.3

Compare Source

Finalizing #​657, added many tests, and changed internal BigInt replacement pattern to "123#bigint", which should not break anything by accident.

v9.3.2

Compare Source

Patches #​657 to properly format BigInt when used with JSON Filter and as.json function.

v9.3.1

Compare Source

Improving on #​657, with support for JSON serialization for BigInt, i.e. now JSON Filter will work for BigInt, as well as method as.json, and all inner serializations within the library.

v9.3.0

Compare Source

  • Implemented #​657, to support native BigInt type.
  • DEV dependencies updated
  • Documentation updates

BigInt Native Support

Now you can enable native BigInt support when running under Node.js v10.4.0 or later.

The following will make types BIGINT and BIGSERIAL arrive as BigInt type:

pgp.pg.types.setTypeParser(20, BigInt); // Type Id 20 = BIGINT | BIGSERIAL

And if you make use of arrays of BigInt, you can convert them with this:

// 1016 = Type Id for arrays of BigInt values
const parseBigIntArray = pgp.pg.types.getTypeParser(1016);
pgp.pg.types.setTypeParser(1016, a => parseBigIntArray(a).map(BigInt));

And the query-formatting engine now lets you use type BigInt for query values directly:

// 123n = BigInt('123')
await db.oneOrNone('SELECT * FROM table WHERE id = $1', [123n]);

// Example of the type changing into BigInt as it goes through the converter:
await db.one('SELECT $1::bigint as value', [123]); //=> {value: 123n}

v9.2.1

Compare Source

A quick follow-up on v9.2.0 release:

  • Updating TypeScript declarations for the modified API
  • Adding tests

v9.2.0

Compare Source

Major refactoring within the query-formatting engine + the helpers namespace, to support more generic way of propagating formatting options through all layers of the library.

Method as.format now supports option capSQL, which currently will only affect arrays, to be formatted using ARRAY instead of array. And helpers namespace is affected by this automatically, while the global capSQL option is used in the absence of the one set locally.

Method as.array now supports the same option capSQL.

v9.1.4

Compare Source

Documentation updates only.

v9.1.3

Compare Source

v9.1.2

Compare Source

Dependency updates.

v9.1.1

Compare Source

If you are using TypeScript, and importing types for extensions batch, sequence or page, you may need to update those, as types were replaced with interfaces, to make them extendable.

Also, all errors that can be generated by the above methods are no longer ES5 errors, they are now proper ES6 error classes.

v9.1.0

Compare Source

Implementation of #​642 has been merged into the main branch, for the official release.

Dropped connections are now processed differently, without returning them into the pool. It is a major internal change, but other than that, nothing changed within the client's protocol.

From the previous updates, TypeScript issues related to the strict mode have been resolved also.

This update is a must-have, especially if you are writing in TypeScript's strict mode.

v9.0.3

Compare Source

Major TypeScript updates, no code changes.
  • Implemented #​645
  • Updated TypeScript for the driver, to keep up with the latest

In reality, there was substantial refactoring within TypeScript declarations, to support strict mode, for the driver, plus other issues that came up within tests. And pg-promise-demo has been updated to take advantage of the strict mode compatibility.

And to make sure it stays that way, TypeScript tests in the project are now in strict mode, as per tsconfig.json.

Thanks @​72636c for pointing out the strict mode issue, and the initial PR.

v9.0.2

Compare Source

  • Implemented #​643, which is a TypeScript update only, to support dynamic passwords.

v9.0.1

Compare Source

  • Updated driver dependency to 7.12.1, which fixes the builtins issue.
  • Added builtins property within TypeScript, i.e. pgp.pg.types.builtins
  • Documentation updates

v9.0.0

Compare Source

Official v9 Release

Node.js and TypeScript Requirements
  • Node.js v7.6 is now the new minimum version supported, as the one that started official ES2017 support.
  • TypeScript v3.x is now required, while v2 is no longer supported.
TypeScript

Many declarations have been renamed and refactored to comply with the latest TypeScript recommendations. So if you are using TypeScript, you may need to update a few types. Follow the official start page for the TypeScript. And pg-promise-demo has been updated for v9.

ES6/ES7

Significant portion of the code has been rewritten from ES5 syntax to ES6, and ES7, which is why Node.js requirements were upgraded.

Removed Features
  • The library no longer supports ES6 generators. Now you should use ES7 async/await only.
  • Rarely, if ever, used functions objectToCode and buildSqlModule were removed from the utils namespace.
Removed Mixed Parameters

Such types as TableName, TransactionMode, PreparedStatement and ParameterizedQuery no longer support mixed parameterization, they now only support an object-parameter, with correct options, to avoid ambiguity.

Dependency Updates
  • Updated the pg driver to the latest 7.12.0, plus internal assert-options module.
  • A few DEV dependency updates also.

v8.7.5

Compare Source

  • Improving ROLLBACK logic for failed connections, following this PR.
  • Documentation updates.

v8.7.4

Compare Source

  • Fixed #​565, for event receive to work with method stream again.
  • DEV dependencies update
  • Documentation updates

v8.7.3

Compare Source

v8.7.2

Compare Source

  • Fixing #​607, now all errors are ES6 classes, and when reported as unhanded, also contain complete details.
  • Upgraded pg-minify to v1.2.0, with the same ES6 rewrite for errors, plus nested SQL comments support.
  • Refactoring connectivity tests

v8.7.1

Compare Source

  • Driver has been upgraded to v7.11.0, with support for finer-grained connectivity parameters (see PR-1847)
  • Updated connection parameters + defaults to match what's in the latest driver
  • Fixed some flaky connectivity tests

v8.7.0

Compare Source

v8.6.5

Compare Source

Updated dependencies + documentation.

v8.6.4

Compare Source

Updating dependencies, including the driver version to 7.9.0

v8.6.3

Compare Source

v8.6.2

Compare Source

Patching 8.6.1 update with this PR.

v8.6.1

Compare Source

Minor breaking change: Finalizing assert-options integration, into type QueryFile that was missed in v8.6.0.

v8.6.0

Compare Source

  • Minor Breaking Change: Integrating use of assert-options throughout the entire library, to help identifying errors related to invalid use of optional parameters anywhere in the API.
  • Breaking Change: Renaming option default to def for method as.format, to avoid conflicts with the JavaScript reserved word.
  • Dependency updates

v8.5.6

Compare Source

  • Driver pg updated to 7.8.1
  • DEV dependencies updated
  • Removing bad tests

v8.5.5

Compare Source

  • Dependency updates
  • Documentation updates
  • Fixing tests for MacOS

v8.5.4

Compare Source

v8.5.3

Compare Source

v8.5.2

Compare Source

v8.5.1

Compare Source

v8.5.0

Compare Source

v8.4.6

Compare Source

v8.4.5

Compare Source

v8.4.4

Compare Source

v8.4.3

Compare Source

v8.4.2

Compare Source

v8.4.1

Compare Source

v8.4.0

Compare Source

v8.3.3

Compare Source

v8.3.2

Compare Source

v8.3.1

Compare Source

v8.3.0

Compare Source

v8.2.3

Compare Source

v8.2.2

Compare Source

v8.2.1

Compare Source

v8.2.0

Compare Source

v8.1.1

Compare Source

v8.1.0

Compare Source

v8.0.0

Compare Source

v7.5.4

Compare Source

v7.5.3

Compare Source

v7.5.2

Compare Source

v7.5.1

Compare Source

v7.5.0

Compare Source

v7.4.1

Compare Source

v7.4.0

Compare Source

v7.3.3

Compare Source

v7.3.2

Compare Source

v7.3.1

Compare Source

v7.3.0

Compare Source

v7.2.1

Compare Source

v7.2.0

Compare Source

v7.1.0

Compare Source

v7.0.3

Compare Source

v7.0.2

Compare Source

v7.0.1

Compare Source

v7.0.0

Compare Source

v6.10.3

Compare Source

v6.10.2

Compare Source

v6.10.1

Compare Source

v6.10.0

Compare Source

v6.9.0

Compare Source

v6.8.0

Compare Source

v6.7.1

Compare Source

v6.7.0

Compare Source

v6.5.4

Compare Source

v6.5.3

Compare Source

v6.5.2

Compare Source

v6.5.1

Compare Source

v6.5.0

Compare Source

v6.4.0

Compare Source

v6.3.8

Compare Source

v6.3.7

Compare Source

v6.3.6

Compare Source

v6.3.5

Compare Source

v6.3.4

Compare Source

v6.3.3

Compare Source

v6.3.2

Compare Source

v6.3.1

Compare Source

v6.3.0

Compare Source

v6.2.3

Compare Source

v6.2.2

Compare Source

v6.2.1

Compare Source

v6.2.0

Compare Source

v6.1.2

Compare Source

v6.1.1

Compare Source

v6.1.0

Compare Source

v6.0.26

Compare Source

v6.0.25

Compare Source

v6.0.24

Compare Source

v6.0.23

Compare Source

v6.0.22

Compare Source

v6.0.20

Compare Source

v6.0.19

Compare Source

v6.0.18

Compare Source

v6.0.17

Compare Source

v6.0.16

Compare Source

v6.0.15

Compare Source

v6.0.14

Compare Source

v6.0.12

Compare Source

v6.0.11

Compare Source

v6.0.10

Compare Source

v6.0.9

Compare Source

v6.0.8

Compare Source

v6.0.7

Compare Source

v6.0.5

[Compare Source](https://redirect.

@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot added the security fix Security fix generated by WhiteSource label Dec 11, 2023
@mend-for-jackfan.us.kg mend-for-jackfan.us.kg bot force-pushed the whitesource-remediate/pg-promise-10.x branch from a992698 to 6e4bf90 Compare February 24, 2024 04:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security fix Security fix generated by WhiteSource
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants