typeorm / typeorm / 17595988101

81%

push

github

chore: bump sha.js from 2.4.11 to 2.4.12 (fix security issue: CVE-2025-9288) (#11639)

* chore: bump sha.js from 2.4.11 to 2.4.12 (fix security issue: CVE-2025-9288)

* test: add unit tests for hash() to ensure sha.js upgrade compatibility

- Verify SHA1 output for known inputs
- Test truncation with options.length
- Handle empty string input
- Confirm deterministic behavior for identical inputs

* removed .only from test/unit/util/string-utils.ts to run all the unit tests

* fix(hash): ensure negative or zero options.length returns full hash

- Updated hash() to only truncate when options.length > 0
- Prevents accidental truncation when options.length is negative
- Maintains expected behavior for full-length hash

* added strict +ve number input validation for hash()

* simplified the logic to check number len before applying slice() in StringUtils.ts->hash()

---------

Co-authored-by: Prateek Hegde <prateek.hegde@deliverysolutions.co>
Co-authored-by: Prateek Hegde <prateek@Prateeks-MacBook-Pro.local>

9333 of 12911 branches covered (72.29%)

Branch coverage included in aggregate %.

1 of 1 new or added line in 1 file covered. (100.0%)

19028 of 24231 relevant lines covered (78.53%)

122162.94 hits per line