posibility of a 5.0.3 release with less strict node-gyp version dependency

[paimon0715]

Hi, @kewde , there are two high severity vulnerabilities introduced by tar@2.2.2:

Issue Description

I noticed that a vulnerability is introduced in sqlite3@5.0.2:
Vulnerability CVE-2021-32804 and CVE-2021-32803 (high severity) affects package tar (versions:<3.2.2,>=4.0.0 <4.4.14,>=5.0.0 <5.0.6,>=6.0.0 <6.1.1): https://snyk.io/vuln/SNYK-JS-TAR-1536531 and https://snyk.io/vuln/SNYK-JS-TAR-1536528
The above vulnerable package is referenced by sqlite3@5.0.2 via:
sqlite3@5.0.2 ➔ node-gyp@3.8.0 ➔ tar@2.2.2

Since sqlite3@5.0.2 (214,273 downloads per week) is referenced by 8,775 downstream projects (e.g., websql 2.0.2 (latest version), @sap/cds-dk 4.4.1 (latest version), typeorm-model-generator 0.4.5 (latest version), ueberdb2 1.4.13 (latest version), indexeddbshim 8.0.0 (latest version)), the above vulnerabilities can be propagated into these downstream projects and expose security threats to them via the following package dependency paths:
(1)@grouparoo/core@0.5.2 ➔ sqlite3@5.0.2 ➔ node-gyp@3.8.0 ➔ tar@2.2.2
(2)@contrast/test-bench-utils@3.20.1-alpha.0 ➔ sqlite3@5.0.2 ➔ node-gyp@3.8.0 ➔ tar@2.2.2
......

If sqlite3@5.0.* removes the vulnerable package from the above version, then its fixed version can help downstream users decrease their pain.

Given the large number of downstream users, could you help update your package to remove the vulnerability from sqlite3@5.0.2 ?

Fixing suggestions

In sqlite3@5.0.3, maybe you can kindly try to perform the following upgrade :
node-gyp 3.x ➔ ^4.0.0;

Note:
node-gyp@4.0.0(>=4.0.0) directly depends on tar@4.4.19 which has fixed the vulnerability CVE-2021-32804 and CVE-2021-32803.

Thank you for your attention to this issue and welcome to share other ways to resolve the issue.

Best regards,
^_^

[Trinovantes]

There doesn't seem to be any breaking changes in node-gyp from 3.x to its latest version ^8 (at least for node-sqlite3 specifically). I resolved the security warnings by explicitly adding this to my package.json (using yarn)

"resolutions": {
  "node-gyp": "^8"
}

[tom-oxmt]

Hello. This vulnerability of the tar package is becoming troublesome. Could you please update your dependencies to a newer version of tar? Thanks

[unuseless]

Looking forward to a fix for the tar dependency.

[introspection3]

node-gyp the version is too low! this effects other packages,it like a cancer

[sharedrory]

Please update node-gyp version, security should not be taken lightly.

[teklakct]

@564064202 @sharedrory it is updated already but only on master/main branch. There is no new tagged version released yet.
You can specify a "fix" commit if you want. Simply add this to your dependencies in package.json

"sqlite3": "git@github.com:mapbox/node-sqlite3.git#3fb3715c4e699ca3bc19e47b136758c66f61e477",

[sharedrory]

@teklakct Thank you. I looked at the commit history and since the current release there have been some bug fixes and the (pre)node-gyp update. While your suggestion works, I think something like a vulnerability fix requires its own emergency release.

[teklakct]

Yes, it should but I cannot wait so we decide to specify commit instead

[sharedrory]

Oh sorry I wasn't clear. Yes people that want to have it fixed asap should use that method (or fork) but I meant its the developers/maintainers responsibility to keep the dependencies up-to-date.

[introspection3]

please publish to npm

[paridhi-agr]

Hi @kewde, @inukshuk , would request you to please release this fix in 5.0.2 revision. It is causing high severity vulnerabilities. Thanks!

[rufreakde]

Will the fix be published soon?

[rickbergfalk]

Haven't tried it yet, but it seems vscode folks published a fork with security fixes

https://www.npmjs.com/package/@vscode/sqlite3
https://github.com/microsoft/vscode-node-sqlite3

[davedoesdev]

@rickbergfalk thanks for the heads up, it works for me. I also learned about npm aliases which made it easier to switch:

    "sqlite3": "npm:@vscode/sqlite3@^5.0.7",

[josep11]

@rickbergfalk thanks for the heads up, it works for me. I also learned about npm aliases which made it easier to switch:

    "sqlite3": "npm:@vscode/sqlite3@^5.0.7",

Tried this one and works perfectly fine for me.
But just for you to beware it depends on Python >= 3.6.0. I noticed it on CircleCI builds.

[kirillgroshkov]

please publish master to npm! 🙏

[ThePeterMick]

Any updates when this pkg will be update?

Apparently the fix was in 3fb3715

[the1corndog]

Hello,

Is there a reason why this vulnerability fix hasn't been released yet? Seems the problem was resolved in the code base?

Thank you

[daniellockyer]

sqlite3 v5.0.3 has been shipped 🙂

[kberg]

Thanks @daniellockyer!