Skip to content

Bump yauzl from 2.10.0 to 3.2.0 - #1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/yauzl-3.2.0
Open

Bump yauzl from 2.10.0 to 3.2.0#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/yauzl-3.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 25, 2025

Copy link
Copy Markdown

Bumps yauzl from 2.10.0 to 3.2.0.

Commits
  • 6eb8242 version 3.2.0
  • 421c51f support reading extended timestamp information (#160)
  • b15f865 version 3.1.3
  • 3a6fe06 Fix crash when using fromBuffer() to read corrupt zip files that specify ou...
  • 49840a2 release notess. closes #156
  • 1d9ccb6 fix buffer out of bounds crashing instead of emitting a clean error
  • 7318aa6 test suite runs error tests through all open functions
  • 363a345 link to hexdump-zip
  • 6fbfef9 better issue number reference
  • e0da075 version 3.1.2
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 25, 2025
Bumps [yauzl](https://github.com/thejoshwolfe/yauzl) from 2.10.0 to 3.2.0.
- [Commits](thejoshwolfe/yauzl@2.10.0...3.2.0)

---
updated-dependencies:
- dependency-name: yauzl
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/yauzl-3.2.0 branch from f8dcaa4 to acdcb85 Compare September 30, 2025 06:42
DaanSelen pushed a commit that referenced this pull request Jul 9, 2026
…anst#7798)

The cleanup pass on PostgreSQL is supposed to garbage-collect rows whose
`extra` references a mesh ID that no longer exists in the current `meshlist`
(matching the MongoDB branch a few lines down). As written:

    DELETE FROM Main WHERE ((extra != NULL)
                       AND (extra LIKE ('mesh/%'))
                       AND (extra != ANY ($1)))

Two interlocking bugs:

1. `extra != NULL` is invalid SQL. In three-valued logic, `<expr> != NULL`
   evaluates to NULL, which the WHERE clause treats as falsy. The AND chain
   is therefore always NULL/falsy and zero rows are ever deleted. PostgreSQL's
   `transform_null_equals` setting only affects `=`, not `<>`/`!=`, and is
   off by default. Result today: cleanup silently no-ops on Postgres and
   orphan mesh-extra rows accumulate forever.

2. `<> ANY (array)` is *not* "not in the list" semantics. It returns TRUE
   when at least one array element is not equal to the value -- which is
   true for almost every input as soon as `meshlist` has 2+ distinct
   elements. Naively fixing only bug #1 (e.g., to `extra IS NOT NULL`)
   would mass-delete every row matching `extra LIKE 'mesh/%'`, including
   rows whose mesh is in the current list. The correct form is
   `<> ALL (array)`.

This patch replaces both with the minimal correct query:

    DELETE FROM main WHERE extra LIKE 'mesh/%' AND extra <> ALL ($1)

The redundant `extra != NULL` predicate is dropped because `extra LIKE
'mesh/%'` already filters out NULLs. The `<> ALL` form matches the intent
of the parallel MongoDB query (`{ meshid: { $exists: true, $nin: meshlist } }`).

`Main` -> `main` is cosmetic (PostgreSQL folds unquoted identifiers to
lowercase), included only to match the actual `CREATE TABLE main` schema
at db.js:1407 and other queries throughout the file.

Note: the MariaDB/MySQL branch on the next line is also broken (mismatched
parens; query throws on every call). That is a separate fix.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants