[Snyk] Security upgrade typeorm from 0.3.20 to 0.3.26#170
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-TYPEORM-13746469
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #170 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 20 20
Lines 148 148
Branches 21 21
=========================================
Hits 148 148
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades TypeORM from version 0.3.20 to 0.3.26 to fix a SQL injection security vulnerability (SNYK-JS-TYPEORM-13746469) with a priority score of 648. The update includes changes to TypeORM's dependencies, most notably replacing cli-highlight with sql-highlight and chalk with ansis for better performance and maintainability.
- Updates TypeORM from 0.3.20 to 0.3.26 to address security vulnerability
- Removes deprecated dependencies (cli-highlight, chalk, mz, any-promise, etc.)
- Adds new dependencies (sql-highlight, ansis, package-json-from-dist)
- Updates various transitive dependencies to their latest compatible versions
Reviewed Changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| package.json | Updates typeorm dependency version from 0.3.20 to 0.3.26 |
| package-lock.json | Updates typeorm and all transitive dependencies including removal of deprecated packages and addition of new dependencies |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.
Snyk changed the following file(s):
package.jsonpackage-lock.jsonVulnerabilities that will be fixed with an upgrade:
SNYK-JS-TYPEORM-13746469
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 SQL Injection