[Snyk] Upgrade mariadb from 3.0.0 to 3.2.2

[igor-enso]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade mariadb from 3.0.0 to 3.2.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 8 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2023-10-16.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: mariadb

• 3.2.2 - 2023-10-16
  

  3.2.2 (Oct 2023)

  Full Changelog

  Issues Fixed

  • CONJS-270 Always send connection attributes, even when connectAttributes is not set
  • CONJS-269 avoid useless "set names utf8mb4" on connection creation if not needed
  • CONJS-268 importFile method doesn't always throw error when imported commands fails #253
  • CONJS-267 Ensure that option collation with id > 255 are respected
• 3.2.1 - 2023-09-14
  

  3.2.1 (Sep 2023)

  Full Changelog

  Notable changes

  • CONJS-262 Binary result-set parsing performance improvement, avoiding to chromium slow issue https://bugs.chromium.org/p/v8/issues/detail?id=7161
  • CONJS-265 permit configuration of console warning message to be exported
  • CONJS-266 Option infileStreamFactory addition for compatibility

  Issues Fixed

  • CONJS-261 TypeScript missing logParam connection option
  • CONJS-263 ensure respecting server collation
• 3.2.0 - 2023-06-19
  

  3.2.0 (Jun 2023)

  Full Changelog

  Notable changes

  • CONJS-250 'undefined' parameters are now permitted, for compatibility with mysql/mysql2 behavior
  • CONJS-257 permit to import sql file directly

  new APIs:

  importFile(options) → Promise
  connection.importFile({file:'...', 'database': '...'}) → Promise
  pool.importFile({file:'...', 'database': '...'}) → Promise

  example:

      await conn.importFile({
          file: '/tmp/someFile.sql', 
          database: 'myDb'
      });

  Issues Fixed

  • CONSJ-252 missing deprecated option supportBigNumbers and bigNumberStrings in Typescript
  • CONJS-254 ensuring option connectTimeout is respected : timeout is removed when socket is successfully established, in place of returning connection object. Wasn't set when using pipe/unix socket
  • CONJS-255 In some case, pipelining was use even option explicitly disable it
  • CONJS-256 method changeUser can lead to error when using multi-authentication and pipelining
  • CONJS-258 All eventEmitters methods are not available on connections
• 3.1.2 - 2023-05-03
  

  3.1.2 (May 2023)

  Full Changelog

  Notable changes

  • CONJS-249 add connection.listeners function to permit TypeORM compatibility

  Issues Fixed

  • CONJS-247 Improve error message when having set named parameter option and executing standard question mark command
  • CONJS-248 Ensuring not using importing file after pool.end()
• 3.1.1 - 2023-03-17
  

  3.1.1 (Mar 2023)

  Full Changelog

  Issues Fixed

  • CONJS-246 pool not listening to 'error' event might exit application on error
  • CONJS-240 Repeating calling the same procedure gets a release prepare error.
  • CONJS-244 correction for node.js 12 compatibility
  • CONJS-245 batch failing when using bulk and metaAsArray
• 3.1.0 - 2023-02-15
  

  3.1.0 (Feb 2023)

  Full Changelog

  Notable changes

  Timezone handling (CONJS-237)

  Connector now set session timezone, solving issue with time function,
  removing needs of client side conversion.

  This requires that when using timezone options, to having server TZ data filled in case client timezone differ from server.

  Performance

  • CONJS-230 better metadata parsing performance
  • CONJS-229 performance improvement when parsing lots of parameter
  • CONJS-238 faster execution for known length packet

  Other changes

  • CONJS-225 Make result set's meta property non-enumerable
  • CONJS-235 Allow to pass TypeScript generic types without need of "as"

  Issues Fixed

  • CONJS-231 executing batch and when parameter can be too long to fit in one mysql packet, parameter can have 4 byte missing
  • CONJS-236 datatype TIME wrong binary decoding when not having microseconds
  • CONJS-239 When using connection with callback, pre-commands (like initSql) might not always be executed first
  • CONJS-232 in case of a long query running, connection.destroy() will close connection, but leaving server still running query for some time
  • CONJS-240 adding a Prepare result wrapper to avoid multiple close issue with cache
  • CONJS-241 metaAsArray missing option in typescript description
• 3.0.2 - 2022-10-27
  

  3.0.2 (Oct 2022)

  Full Changelog

  Notable changes

  • CONJS-222 permit streaming prepare statement result
    example :

  const prepare = await shareConn.prepare('SELECT * FROM mysql.user where host = ?');
  const stream = prepare.executeStream(['localhost']);    
  try {
    for await (const row of stream) {
      console.log(row);
    }
  } catch (e) {
    queryStream.close();
  }
  prepare.close();

  Issues Fixed

  • CONJS-223 Metadata column name gets sporadic corrupted
  • CONJS-211 Session timezone unset on connection re-use with connection pool
  • CONJS-212 when throwing an error when using option leakDetectionTimeout, might result in throwing wrong error with Cannot read properties of null (reading 'leaked')
  • CONJS-217 caching_sha2_password never succeed using FAST AUTHENTICATION. With correction, one less exchanges is done when connecting to a MySQL server
  • CONJS-219 prepare cache was not limited to prepareCacheLength but can increase up to 2x the prepareCacheLength value, leading to possible ER_MAX_PREPARED_STMT_COUNT_REACHED
  • CONJS-228 improving prepare cache performance
  • CONJS-226 missing typescript metaAsArray option and documentation
  • CONJS-213 update error code with recent MariaDB server
  • CONJS-215 Executing after prepare close throw an undescriptive error
  • CONJS-221 option debugLen and logParam are not documented
  • CONJS-227 Allow setting idleTimeout to 0
  • CONJS-214 missing pool.closed typescript definition
  • CONJS-216 remove please-upgrade-node dependency
  • CONJS-224 missing typescript checkNumberRange option definition
• 3.0.1 - 2022-07-26
  

  3.0.1 (Jul 2022)

  Full Changelog

  Notable changes

  • Error description improvement
    • Pool might return a common error ‘retrieve connection from pool timeout after XXXms’ in place of real error.[CONJS-200]
    • [CONJS-209] Trace option now works when using pool/cluster. It is recommended to activate the trace option in development Since driver is asynchronous, enabling this option to save initial stack when calling any driver methods. This allows having the caller method and line in the error stack, permitting error easy debugging. The problem is this error stack is created using Error.captureStackTrace that is very very slow. To give an idea, this slows down by 10% a query like 'select * from mysql.user LIMIT 1', so not recommended in production.

      const pool = mariadb.createPool({
      host: 'mydb.com',
      user: 'myUser',
      connectionLimit: 5,
      trace: true
      });
      await pool.query('wrong query');
      /* will throw an error like :
        SqlError: (conn=15868, no: 1064, SQLState: 42000) You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'wrong query' at line 1
          sql: wrong query - parameters:[]
            at Object.module.exports.createError (errors.js:57:10)
            at ...
          From event:
            at Function._PARAM (\integration\test-pool.js:60:18)
            at …
          text: "You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'wrong query' at line 1",
          sql: 'wrong query - parameters:[]',
          fatal: false,
          errno: 1064,
          sqlState: '42000',
          code: 'ER_PARSE_ERROR'
      */

    • Pool error description is improved indicating pool information, like [CONJS-208]:

      SqlError: (conn=-1, no: 45028, SQLState: HY000) retrieve connection from pool timeout after 200ms
        (pool connections: active=1 idle=0 limit=1)
        at Object.module.exports.createError
        …

  • node.js 18 supported [CONJS-197]
  • New option checkNumberRange. When used in conjunction of decimalAsNumber, insertIdAsNumber or bigIntAsNumber, if conversion to number is not exact, connector will throw an error [CONJS-198]. This permits easier compatibility with mysql/mysql2 and 2.x version driver version.
  • Performance enhancement for multi-rows resultset. Internal benchmarks show improved performance by 10% for a result-set of 1000 rows.[CONJS-210]

  Issues Fixed

  • Wrong error returned "Cannot read properties of undefined… … (reading 'charset')" when error during handshake [CONJS-193]
  • [CONJS-194] Charset change using parameterized query fails with "Uncaught TypeError: opts.emit is not a function"
  • [CONJS-195] Error "cannot mix BigInt and other types" when parsing negative bigint
  • [CONJS-196] connection.close() is now really an alias or connection.release()
  • [CONJS-199] wrong return type for batch() on typescript
  • [CONJS-201] typecast geometry parsing error
  • [CONJS-202] support pre 4.1 error format for 'too many connection' error
  • [CONJS-203] encoding error for connection attributes when using changeUser with connection attributes
  • [CONJS-206] possible race condition on connection destroy when no other connection can be created
  • [CONJS-204] handle password array when using authentication plugin “pam_use_cleartext_plugin”
  • [CONJS-205] query hanging when using batch with option timeout in place of error thrown
• 3.0.0 - 2022-03-01

from mariadb GitHub release notes

Commit messages

Package name: mariadb

• e8b4b56 [misc] restrict capabilities to server capabilities
• f2fff31 Merge tag '3.2.2' into develop
• 9aa48ab Merge branch 'release/3.2.2'
• 7f013c5 bump 3.2.2
• 9f57524 [misc] coverage improvement
• f1d1943 [misc] coverage improvement
• 36e118f [misc] ensure returning SqlError when Local infile error.
• 88704f5 [misc] metadata performance improvement
• 64e3f0a [misc] test coverage improvement
• 81318e9 [CONJS-270] Always send connection attributes, even when connectAttributes is not set
• 9b1ba5d [misc] ensure using IP in place of DNS when KILLING thread
• 8aa0397 [misc] testing addition for old server without EOF deprecation
• 468148e [misc] test coverage improvement
• ceb69c2 [misc] pool file error when not having file correction
• 95e18ab [misc] updating test bionic node version node.js v16
• 60a3569 [CONJS-269] correcting missing warning count parsing
• 7935411 [misc] test improvement
• 2f3b4a2 [misc] remove default node.js version
• 18aea07 [CONJS-269] avoid useless "set names utf8mb4" on connection creation if not needed
• 9275245 [misc] ensure correctness of escapeId #252
• 9e074f0 [misc] test improvement
• 704ede6 [CONJS-268] importFile method doesn't always throw error when imported commands fails #253
• 499dcc2 [CONJS-267] Ensure that option collation with id > 255 are respected
• a409b71 [misc] benchmark improvement to use same server charset.

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs