Skip to content

chore: updating esbuild version in drizzle-kit #4046

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 15, 2025

Conversation

paulmarsicloud
Copy link
Contributor

Bump on esbuild to resolve #4045

@Jac0xb
Copy link

Jac0xb commented Mar 25, 2025

There is also GHSA-67mh-4wv8-2f99

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ esbuild enables any website to send any requests to    │
│                     │ the development server and read the response           │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ esbuild                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <=0.24.2                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=0.25.0                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ ..............  > [email protected] >                 │
│                     │ @esbuild-kit/[email protected] >                        │
│                     │ @esbuild-kit/[email protected] > [email protected]        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-67mh-4wv8-2f99      │
└─────────────────────┴────────────────────────────────────────────────────────┘

@renebrandel
Copy link

Just saw this PR also addresses the same vulnerability as discussed in #4250. Would love the maintainers' attention on this.

@AndriiSherman
Copy link
Member

I resolved all the conflicts and updated esbuild to 0.25.2 version

@AndriiSherman AndriiSherman merged commit f1c2dd6 into drizzle-team:0.41 Apr 15, 2025
32 checks passed
AndriiSherman added a commit that referenced this pull request Apr 15, 2025
* fix: incorrect types for inArray (#1774)

Co-authored-by: Andrii Sherman <[email protected]>

* Pass row type parameter to @planetscale/database's execute  (#1852)

* Update session.ts

No need to cast, you can just pass a type parameter

* Update package.json

---------

Co-authored-by: AndriiSherman <[email protected]>

* Don't enforce type restrictions on mysqlEnum and pgEnum to be non-empty arrays (#2429)

* Removed type restriction on non-empty arrays for mysqEnum

* Removed type restriction on non-empty arrays for pgEnum

* check values argument is not an empty array for pgEnum

* fix: typings

* Add type tests

---------

Co-authored-by: AndriiSherman <[email protected]>

* Export mapColumnToSchema function (#2495)


Co-authored-by: Andrii Sherman <[email protected]>

* [Pg-kit] Fix malformed array literal error on indexes (#2884)

* Fix malformed array literal error on indexes

The main issue is the expression text to array conversion happening in the edited line.
Commas in an expression become delimiters and split the expression up prematurely.
Some special characters like double quotes can cause the malformed array literal errors.

The postgres function pg_get_indexdef does what the snippet above is trying to do, but safely.

* Add index introspect test

* Update pg.test.ts

Remove .only in basic index test

---------

Co-authored-by: Andrii Sherman <[email protected]>

* add infer enum type (#2552)

* Update how enums work in pg and mysql

* Remove duplicated exports, add related test (#4413)

* Remove duplicated exports, add related test

Fixes #4079

* Fix test

* chore: updating esbuild version in drizzle-kit (#4046)

* chore: updating esbuild version in drizzle-kit

* Fix build errors

---------

Co-authored-by: AndriiSherman <[email protected]>

* Drizzle-kit: fix recreate enums + altering data type to enums, from enums in pg (#4330)

Co-authored-by: AndriiSherman <[email protected]>

* Skip test and try latest gel

* Add release notes

---------

Co-authored-by: James <[email protected]>
Co-authored-by: Ayrton <[email protected]>
Co-authored-by: April Mintac Pineda <[email protected]>
Co-authored-by: Matthew Ary <[email protected]>
Co-authored-by: Kratious <[email protected]>
Co-authored-by: Toti Muñoz <[email protected]>
Co-authored-by: Dan Kochetov <[email protected]>
Co-authored-by: Paul Marsicovetere <[email protected]>
Co-authored-by: Aleksandr Sherman <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

goog-vulnz flags CVE-2024-24790 in esbuild 0.19.7
4 participants