Skip to content

v2.2.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 19 May 20:01
· 52 commits to master since this release
v2.2.2
6b3d891
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Summary

Security-driven patch. Closes 5 dependabot advisories and bundles a runtime dep refresh + Phase 24 root-deps reclassification originally tabled for v2.3.0 (cadence pulled forward by the security fixes).

Security — 5 advisories closed

3 consumer-runtime HIGHs (MikroORM adapter SQL layer):

  • GHSA-cfw5-68c4-ffqp — MikroORM SQL injection via runtime-controlled identifiers and JSON-path keys (@mikro-orm/{sql,knex})
  • GHSA-pv5w-4p9q-p3v2 — Kysely JSON-path traversal injection (transitively via mikro-orm SQL package)

2 dev-tree HIGHs (closed via yarn resolution fast-uri@^3.1.2):

  • GHSA-q3j6-qgpj-74h6 — fast-uri path traversal via percent-encoded dot segments
  • GHSA-v39h-62p7-jpjc — fast-uri host confusion via percent-encoded authority delimiters

4 dev-tree MED/LOW also swept via yarn resolutions:

  • GHSA-69xw-7hcm-h432, GHSA-p77w-8qqv-26rm, GHSA-qp7p-654g-cw7p, GHSA-hm8q-7f3q-5f36 — hono x4 (via @prisma/dev sandbox)
  • GHSA-v2v4-37r5-5v8g — ip-address XSS in Address6 HTML methods (via socks-proxy-agent)

Runtime dep refresh

@nestjs/{common,core,platform-express} 11.1.13 → 11.1.21, @nestjs/typeorm 11.0.0 → 11.0.1, @mikro-orm/{core,mysql,postgresql,sqlite} 7.0.0 → 7.0.17, @mikro-orm/knex 6.0.0 → 6.6.14, typeorm 0.3.28 → 0.3.30, drizzle-orm 0.45.1 → 0.45.2, redis 5.11.0 → 5.12.1, qs 6.15.0 → 6.15.2 (also packages/request), class-validator 0.14.3 → 0.15.1. All within declared peer ranges; no consumer migration required.

Phase 24 — Root deps reclassification (also rides this ship)

  • @nestjs/testing, mysql2, pg reclassified from root dependencies to root devDependencies
  • mysql2: ^3.0.0 + pg: ^8.0.0 declared as optional peerDependencies on the 4 adapter packages

Test plan

  • yarn install — resolutions materialize cleanly
  • yarn build — composite project references walk green
  • yarn test:all — parity + 6 adapter cells: 88 suites / 1215 tests passed
  • yarn test:prisma:postgres — 13 suites / 149 tests passed (+1 todo)
  • yarn test:prisma:mysql — 13 suites / 149 tests passed (+1 todo)
  • Grand total: 114 suites / 1364 tests passed locally (2 pre-existing skips + 2 todos documented inline; not regressions)
  • CI release matrix green on this PR

See root CHANGELOG.md v2.2.2 section for full release notes.

Assets 2
Loading