Releases: sequelize/umzug
Releases · sequelize/umzug
Release list
v3.8.3
mostly just a security patch update
pnpm audit --prod output before 4272daa:
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high │ Validator is Vulnerable to Incomplete Filtering of One │
│ │ or More Instances of Special Elements │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ validator │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.22 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=13.15.22 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ . > @rushstack/ts-command-line@4.19.1 > │
│ │ @rushstack/terminal@0.10.0 > │
│ │ @rushstack/node-core-library@4.0.2 > z-schema@5.0.5 > │
│ │ validator@13.11.0 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ https://github.com/advisories/GHSA-vghf-hv5q-vc2g │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high │ Picomatch has a ReDoS vulnerability via extglob │
│ │ quantifiers │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ picomatch │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <4.0.4 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=4.0.4 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ . > tinyglobby@0.2.13 > fdir@6.4.4 > picomatch@4.0.2 │
│ │ │
│ │ . > tinyglobby@0.2.13 > picomatch@4.0.2 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ https://github.com/advisories/GHSA-c2c7-rcm5-vvqj │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate │ validator.js has a URL validation bypass vulnerability │
│ │ in its isURL function │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ validator │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <13.15.20 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=13.15.20 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ . > @rushstack/ts-command-line@4.19.1 > │
│ │ @rushstack/terminal@0.10.0 > │
│ │ @rushstack/node-core-library@4.0.2 > z-schema@5.0.5 > │
│ │ validator@13.11.0 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ https://github.com/advisories/GHSA-9965-vmph-33xx │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate │ Picomatch: Method Injection in POSIX Character Classes │
│ │ causes incorrect Glob Matching │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package │ picomatch │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.0.0 <4.0.4 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions │ >=4.0.4 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths │ . > tinyglobby@0.2.13 > fdir@6.4.4 > picomatch@4.0.2 │
│ │ │
│ │ . > tinyglobby@0.2.13 > picomatch@4.0.2 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info │ https://github.com/advisories/GHSA-3v7f-55p6-f55p │
└─────────────────────┴────────────────────────────────────────────────────────┘
4 vulnerabilities found
Severity: 2 moderate | 2 high
pnpm audit --prod output after 4272daa:
No known vulnerabilities found
What's Changed
- try fix ci by @mmkal in #702
- fix(deps): update dependency fast-glob to v3.3.3 by @renovate[bot] in #699
- chore: switch to tinyglobby by @benmccann in #705
- bump test timeout? by @mmkal in #711
- chore(deps): update dependency lodash to v4.18.1 [security] by @renovate[bot] in #721
- chore(deps): update dependency uuid to v14 [security] by @renovate[bot] in #719
New Contributors
- @benmccann made their first contribution in #705
Full Changelog: v3.8.2...v3.8.3
Contributors
benmccann, renovate, and mmkal
Assets 2
v3.8.2
v3.8.1
What's Changed
- fix: use
undefinedwhen charset and collate options are not supported by @EinfachHans in #673
New Contributors
- @EinfachHans made their first contribution in #673
Full Changelog: v3.8.0...v3.8.1
Contributors
EinfachHans
Assets 2
v3.8.0
What's Changed
- chore(deps): update dependency sequelize to v6.37.1 by @renovate in #643
- glob -> fast-glob by @mmkal in #660
Full Changelog: v3.7.0...v3.8.0
Contributors
renovate and mmkal
Assets 2
v3.7.0
v3.6.1
v3.6.0
What's Changed
- fix(deps): update dependency glob to v8.1.0 by @renovate in #639
- Fix DeprecationWarning for Sequelize V7 by @anroypaul in #644
- fix(deps): update dependency type-fest to v4 by @renovate in #647
- fix(deps): update dependency pony-cause to v2.1.10 by @renovate in #616
New Contributors
- @anroypaul made their first contribution in #644
Full Changelog: v3.5.1...v3.6.0
Contributors
renovate and pkvl
Assets 2
v3.5.1
What's Changed
- Snowflake does not explicitly support collation in the same way as some other databases by @lbazetto in #641
New Contributors
Full Changelog: v3.5.0...v3.5.1
Contributors
lbazetto