Skip to content

[Snyk] Upgrade typeorm from 0.2.24 to 0.3.24 #224

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

[Snyk] Upgrade typeorm from 0.2.24 to 0.3.24 #224

wants to merge 1 commit into from

Conversation

DefenderK
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade typeorm from 0.2.24 to 0.3.24.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 645 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Prototype Pollution
SNYK-JS-TYPEORM-590152		 504 Mature
medium severity Prototype Pollution
SNYK-JS-HIGHLIGHTJS-1045326		 504 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HIGHLIGHTJS-1048676		 504 No Known Exploit
medium severity Prototype Pollution
SNYK-JS-XML2JS-5414874		 504 Proof of Concept
Release notes
Package name: typeorm
  • 0.3.24 - 2025-05-14

    What's Changed

    New Contributors

    Full Changelog: 0.3.23...0.3.24

  • 0.3.24-dev.e9eaf79 - 2025-05-13
  • 0.3.24-dev.d325d9e - 2025-05-14
  • 0.3.24-dev.c464ff8 - 2025-05-09
  • 0.3.24-dev.b8dbca5 - 2025-05-14
  • 0.3.24-dev.a6b61f7 - 2025-05-13
  • 0.3.24-dev.a213bbd - 2025-05-09
  • 0.3.24-dev.9f889b3 - 2025-05-13
  • 0.3.24-dev.80e9b30 - 2025-05-07
  • 0.3.24-dev.6d1c4f0 - 2025-05-12
  • 0.3.24-dev.39a6562 - 2025-05-12
  • 0.3.24-dev.15de733 - 2025-05-11
  • 0.3.24-dev.144634d - 2025-05-13
  • 0.3.24-dev.1198dc2 - 2025-05-12
  • 0.3.24-dev.2168441 - 2025-05-11
  • 0.3.23 - 2025-05-07

    ⚠️ Note on a breaking change

    This release includes a technically breaking change (from this PR) in the behaviour of the delete and update methods of the EntityManager and Repository APIs, when an empty object is supplied as the criteria:

    await repository.delete({})
await repository.update({}, { foo: 'bar' })
    • Old behaviour was to delete or update all rows in the table
    • New behaviour is to throw an error: Empty criteria(s) are not allowed for the delete/update method.

    Why?

    This behaviour was not documented and is considered dangerous as it can allow a badly-formed object (e.g. with an undefined id) to inadvertently delete or update the whole table.

    When the intention actually was to delete or update all rows, such queries can be rewritten using the QueryBuilder API:

    await repository.createQueryBuilder().delete().execute()
// executes: DELETE FROM table_name
await repository.createQueryBuilder().update().set({ foo: 'bar' }).execute()
// executes: UPDATE table_name SET foo = 'bar'

    An alternative method for deleting all rows is to use:

    await repository.clear()
// executes: TRUNCATE TABLE table_name

    What's Changed

    New Contributors

    Full Changelog: 0.3.22...0.3.23

  • 0.3.23-dev.fe71a0c - 2025-04-15
  • 0.3.23-dev.fadad1a - 2025-05-01
  • 0.3.23-dev.cebd63b - 2025-04-03
  • 0.3.23-dev.c15cb07 - 2025-04-05
  • 0.3.23-dev.b9ddd14 - 2025-04-25
  • 0.3.23-dev.b9842e3 - 2025-04-30
  • 0.3.23-dev.b94dfb3 - 2025-05-06
  • 0.3.23-dev.a61654e - 2025-04-29
  • 0.3.23-dev.9464e65 - 2025-04-30
  • 0.3.23-dev.7c5ea99 - 2025-04-04
  • 0.3.23-dev.6ebae3b - 2025-04-03
  • 0.3.23-dev.6c5668b - 2025-04-03
  • 0.3.23-dev.673f065 - 2025-04-15
  • 0.3.23-dev.61a6f97 - 2025-04-25
  • 0.3.23-dev.56f1898 - 2025-04-15
  • 0.3.23-dev.4c8fc3a - 2025-04-16
  • 0.3.23-dev.45577df - 2025-04-14
  • 0.3.23-dev.3ffeea5 - 2025-05-05
  • 0.3.23-dev.274bdf2 - 2025-05-02
  • 0.3.23-dev.24a0369 - 2025-04-17
  • 0.3.23-dev.184f463 - 2025-04-15
  • 0.3.23-dev.055eafd - 2025-04-03
  • 0.3.23-dev.04f3d3f - 2025-04-04
  • 0.3.22 - 2025-04-03

    What's Changed

@snyk-bot
fix: upgrade typeorm from 0.2.24 to 0.3.24
9fca69d 
Snyk has created this PR to upgrade typeorm from 0.2.24 to 0.3.24.

See this package in npm:
typeorm

See this project in Snyk:
https://app.snyk.io/org/dylank-fresh-default/project/c1a4abe2-1048-4759-972d-b3f477bee287?utm_source=github&utm_medium=referral&page=upgrade-pr
@DefenderK
Copy link
Owner Author

DefenderK commented Jun 14, 2025 •
edited
Loading

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

✅ code/snyk check is complete. No issues have been found. (View Details)

@DefenderK DefenderK closed this Jun 19, 2025
@DefenderK DefenderK deleted the snyk-upgrade-15ae9e4376c3ef446803666b0b9b4200 branch June 19, 2025 16:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@DefenderK @snyk-bot