Skip to content

Conversation

@mend-for-github-com
Copy link

This PR contains the following updates:

Package Type Update Change
mssql dependencies major 6.2.3 -> 8.0.0

By merging this PR, the issue #30 will be automatically resolved and closed:

Severity CVSS Score Vulnerability
Critical Critical 9.4 CVE-2022-39353
High High 7.8 CVE-2021-28458
High High 7.8 CVE-2021-43138
High High 7.5 CVE-2021-3749
High High 7.5 WS-2023-0439
High High 7.3 CVE-2023-26159
Medium Medium 6.5 CVE-2020-8244
Medium Medium 6.5 CVE-2022-0155
Medium Medium 6.5 CVE-2023-26136
Medium Medium 6.5 CVE-2023-45857
Medium Medium 6.5 CVE-2024-28849
Medium Medium 5.9 CVE-2020-28168
Medium Medium 5.6 CVE-2020-15366
Medium Medium 5.3 CVE-2023-0842
Medium Medium 4.3 CVE-2021-21366
Low Low 2.6 CVE-2022-0536

Release Notes

tediousjs/node-mssql (mssql)

v8.0.0

Compare Source

[new] Add table.rows.clear() method to allow for chunking updates (#​1094)
[new] Add valueHandler map to store callbacks that are used to process row values (#​1356)
[change] msnodesqlv8 driver detects os platform and attempts to pick correct connections string for it ((#​1318)[https://github.com/tediousjs/node-mssql/pull/1318](https://redirect.github.com/tediousjs/node-mssql/pull/1318)8])
[change] Updated to latest Tedious 14 ((#​1312)[https://github.com/tediousjs/node-mssql/pull/1312](https://redirect.github.com/tediousjs/node-mssql/pull/1312)2])
[change] Errors for bad bulk load parameters have slightly different error messages ((#​1318)[https://github.com/tediousjs/node-mssql/pull/1318](https://redirect.github.com/tediousjs/node-mssql/pull/1318)8])
[change] Options provided to the driver via the config.options object will not be overridden with other values if set explicitly ((#​1340)[https://github.com/tediousjs/node-mssql/pull/1340](https://redirect.github.com/tediousjs/node-mssql/pull/1340)0])
[change] Duplicate column names will now be presented as an array even if the values are empty ((#​1240)[https://github.com/tediousjs/node-mssql/pull/1240](https://redirect.github.com/tediousjs/node-mssql/pull/1240)0])
[change] Update tarn pool dependency ((#​1344)[https://github.com/tediousjs/node-mssql/pull/1344](https://redirect.github.com/tediousjs/node-mssql/pull/1344)4])
[removed] Remove connection string parser helpers ((#​1342)[https://github.com/tediousjs/node-mssql/pull/1342](https://redirect.github.com/tediousjs/node-mssql/pull/1342)2])
[removed] Remove deprecated pool properties ((#​1359)[https://github.com/tediousjs/node-mssql/pull/1359](https://redirect.github.com/tediousjs/node-mssql/pull/1359)9])

v7.3.5

Compare Source

[fix] quote identifiers in table constraint declaration (#​1397)

v7.3.4

Compare Source

[fix] msnodesqlv8.js file was missing from previous release

v7.3.3

Compare Source

Duplicate tag

v7.3.2

Compare Source

[fix] nodemsqlv8 driver tests working against Node 10 (#​1368)
[fix] quote identifiers in table primary keys (#​1394)

v7.3.1

Compare Source

[fix] Bump debug dependency (#​1361)

v7.3.0

Compare Source

[new] Transaction/PreparedStatements expose the config from their parent connection (#​1338)
[fix] Fix inherited request configs from the pool. Specifically stream and arrayRowMode now inherit accurately from the connection config (#​1338)

v7.2.1

Compare Source

[fix] Fix issue with bulk insert of dates ((#​1298)[https://github.com/tediousjs/node-mssql/pull/1298](https://redirect.github.com/tediousjs/node-mssql/pull/1298)8])

v7.2.0

Compare Source

[new] Update Geography field parsing to provide lat/lng props from Geography Point ((#​1282)[https://github.com/tediousjs/node-mssql/pull/1282](https://redirect.github.com/tediousjs/node-mssql/pull/1282)2])
[fix] Handle errors when adding rows to bulk operations ((#​1264)[https://github.com/tediousjs/node-mssql/pull/1264](https://redirect.github.com/tediousjs/node-mssql/pull/1264)4])
[fix] Input/Output parameter passing fix for msnodesqlv8 driver ((#​1275)[https://github.com/tediousjs/node-mssql/pull/1275](https://redirect.github.com/tediousjs/node-mssql/pull/1275)5])

v7.1.3

Compare Source

[fix] Request timeout settings now respect value parsed from connection strings ((#​1257)[https://github.com/tediousjs/node-mssql/pull/1257](https://redirect.github.com/tediousjs/node-mssql/pull/1257)7)

v7.1.2

Compare Source

v7.1.1

Compare Source

[fix] Errors from tedious connection creation now cause connection promise to reject ((#​1254)[https://github.com/tediousjs/node-mssql/pull/1254](https://redirect.github.com/tediousjs/node-mssql/pull/1254)4])
[fix] Encrypt and transaction binding settings now respect value parsed from connection strings ((#​1252)[https://github.com/tediousjs/node-mssql/pull/1252](https://redirect.github.com/tediousjs/node-mssql/pull/1252)2)

v7.1.0

Compare Source

[new] Add parseJSON support to query strings
[fix] Bump various dependencies for security fixes

v7.0.0

Compare Source

[new] Result sets with duplicate keys can now be handled using request.arrayRowMode (#​1130)
[new] Requests in stream mode now emit a rowsaffected event (#​1213)
[new] msnodesqlv8 driver now has detailed error support (#​1212)
[new] Connection validation checks before releasing connections from the pool. This can be turned of via validateConnection: false config option (#​1192)
[new] UseUTC is now supported on msnodesqlv8 connections (#​1222)
[change] Updated to latest Tedious 11
[change] Updated tarnjs to v3
[change] Updated to support latest msnodesqlv8 v2 (#​1157)
[change] Piped streams no longer have errors forwarded on to them (#​1028)
[change] tedious config option trustServerCertificate defaults to false if not supplied (#​1030)
[change] Request.pipe now pipes a true node stream for better support of backpressure (#​1078)
[change] drop support for NodeJS < 10 (#​1070)
[fix] Ensure line endings are unix style (LF)
[fix] Avoid using deprecated .inspect on Objects (#​1071)
[fix] Bump various dependencies for security fixes (#​1102)
[fix] Trailing rows from request streams using msnodesqlv8 driver fail to be emitted (#​1109)
[fix] Issue with geography v2 parsing resolve (#​1138)
[fix] Connection config objects are now deep cloned when stored against a connection pool (#​1217)
[removed] Support for connection uri format has been removed (eg: mssql://user:password@host/?params=values)

v6.4.1

Compare Source

[fix] Bump debug dependency (#​1361)

v6.4.0

Compare Source

[new] Transaction/PreparedStatements expose the config from their parent connection
[fix] Fix inherited request configs from the pool. Specifically stream and arrayRowMode now inherit accurately from the connection config (#​1338)

v6.3.2

Compare Source

[fix] Bump various dependencies for security fixes

v6.3.1

Compare Source

[fix] Ensure line endings are unix style (LF)

v6.3.0

Compare Source

[new] Result sets with duplicate keys can now be handled using request.arrayRowMode (#​1130)
[fix] Issue with geography v2 parsing resolve (#​1138)
[fix] Fixed issue where msnodesqlv8 could sometimes terminate queries before all errors has been emitted causing queries to hang (#​1145)


  • If you want to rebase/retry this PR, check this box

@mend-for-github-com mend-for-github-com bot added the security fix Security fix generated by Mend label May 14, 2025
@mend-for-github-com mend-for-github-com bot changed the title chore(deps): update dependency mssql to v8 chore(deps): update dependency mssql to v8 - autoclosed May 16, 2025
@mend-for-github-com mend-for-github-com bot deleted the whitesource-remediate/mssql-8.x branch May 16, 2025 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security fix Security fix generated by Mend

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant