safe-global / safe-client-gateway / 30002868743 / 1

88%

main: 88%

push

github

chore(deps): upgrade typeorm to 1.1.0 (#3290)

  - Upgrades typeorm from 0.3.28 to 1.1.0, the current stable release line.
  - Primary driver: an unpatched advisory affecting UpdateQueryBuilder/SoftDeleteQueryBuilder — the order argument passed to orderBy/addOrderBy on those builders is concatenated into generated SQL without validation, permitting blind SQL injection via the sort direction
  (SelectQueryBuilder.orderBy was already unaffected). Fixed upstream in 0.3.29/1.0.0.
    - Verified this was not currently exploitable in this codebase: this project only connects to Postgres (no MySQL/MariaDB driver, and the advisory is scoped to those), and the only orderBy/addOrderBy call in the codebase runs on a SelectQueryBuilder with a hardcoded literal, not user
  input. Upgrading anyway as defense-in-depth since it's a direct dependency of our ORM.
  - Went with 1.1.0 (latest) rather than the minimal 0.3.29 patch per request, picking up additional upstream fixes (aggregate-column resolution, an eager-loading bug that could overwrite manually-set relations, a migration query-runner leak, returning option for update/upsert).

2413 of 4428 branches covered (54.49%)

Branch coverage included in aggregate %.

7191 of 10623 relevant lines covered (67.69%)

373.54 hits per line