Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[www] Upgrade knex to 2.3.0 #203

Merged
merged 1 commit into from Dec 23, 2022
Merged

[www] Upgrade knex to 2.3.0 #203

merged 1 commit into from Dec 23, 2022

Conversation

wschurman
Copy link
Member

Why

Trying to upgrade this where we use it, but it is resulting in conflicting typescript types I believe. https://github.com/expo/universe/pull/11100

https://nvd.nist.gov/vuln/detail/CVE-2016-20018 says Knex has a SQL injection that can cause the WHERE clause to be ignored. It's unclear how this is triggered, and due to the usage pattern within entity it is doubtful that it affects us, but still good to stay upgraded.

How

Upgrade to Knex 2.3.0. This is a major semver upgrade. However, the breaking change in 2.3.0 was adding back support for sqlite3. That does not affect us. I read through the changelog and saw no other changes that would affect us, though there is better support for JSONB and Postgres now: knex/knex#5201

Test Plan

Run all tests.

@wschurman wschurman requested a review from ide December 23, 2022 15:48
@codecov
Copy link

codecov bot commented Dec 23, 2022

Codecov Report

Merging #203 (c1d514f) into main (b11bd24) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #203   +/-   ##
=======================================
  Coverage   96.17%   96.17%           
=======================================
  Files          81       81           
  Lines        2065     2065           
  Branches      245      269   +24     
=======================================
  Hits         1986     1986           
  Misses         79       79           
Flag Coverage Δ
integration 96.17% <ø> (ø)
unittest 96.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

Copy link
Member

@ide ide left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@wschurman wschurman merged commit b5f734b into main Dec 23, 2022
@wschurman wschurman deleted the @wschurman/upgrade-knex branch December 23, 2022 20:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants