release: v2.2.2 — security patch (5 dependabot advisories) + dep refresh - #23
Merged
Conversation
Move three test/fixture-only entries from root dependencies to root devDependencies. They are imported only by packages/*/test/** and ORM DataSource.type configs in test fixtures; no packages/*/src/ references them. Stops them being pulled into consumer trees as transitive runtime requirements. Version ranges preserved verbatim. Yarn 4 content-addressable lockfile leaves yarn.lock byte-identical (same resolution key for the moved entries — only package.json changes). Mirrors prior swagger move pattern.
Add `mysql2: ^3.0.0` and `pg: ^8.0.0` to peerDependencies plus
`peerDependenciesMeta.{mysql2,pg}.optional: true` on each of:
- @nestjs-crud/typeorm
- @nestjs-crud/mikro-orm
- @nestjs-crud/drizzle
- @nestjs-crud/prisma
Mirrors the @nestjs/typeorm ecosystem norm and the existing v2.2.0
redis/ioredis optional-peer pattern. Consumers install only the
driver they use; no install-time WARN unmet peer noise for
irrelevant drivers.
Yarn 4 records workspace peer-dep declarations in yarn.lock metadata,
so the lockfile gains 24 lines of additive metadata mirroring the
manifest changes (no version resolutions changed, no new packages).
@nestjs/testing intentionally NOT added — test-internal only, never
imported by packages/*/src/.
… reclassification Root CHANGELOG: add Unreleased section covering the @nestjs/testing, mysql2, pg root-deps reclassification (now devDependencies) plus the per-adapter mysql2/pg optional peerDependency additions across all four adapter packages. Refresh the Unreleased link reference (previously stale at v2.1.0...HEAD) and add the missing 2.2.1 / 2.2.0 link refs. Per-package CHANGELOGs (typeorm, mikro-orm, drizzle, prisma): add Unreleased section noting the mysql2/pg optional peerDependency declarations on the respective package, matching the wording shape used for the redis/ioredis optional-peer entries in v2.2.0.
The four-adapter declaration of `mysql2` / `pg` as `optionalPeerDependencies` landed in Phase 24 but the consumer-facing skill still claimed only the adapter ORM was the relevant peer. Without this update a consumer following the install section gets `npm install @nestjs-crud/typeorm` + `npm install typeorm` and then hits `Cannot find module 'pg'` at runtime with no path back to the cause from the SKILL. Adds a one-line install hint for `pg` / `mysql2` and broadens the Common Issues row to surface the driver-not-found error shape alongside the existing ORM-not-found shape.
Mirrors the same propagation that landed in the consumer skill: the four-adapter declaration of `mysql2` / `pg` as `optionalPeerDependencies` on the adapter packages was not reflected in the per-adapter wiki install blocks. A consumer following ServiceTypeorm.md / ServiceDrizzle.md / ServiceMikroOrm.md would `npm i` only the ORM deps and then hit `Cannot find module 'pg'` at runtime. Adds a driver install line + one-line note per adapter wiki page. ServicePrisma.md already documents drivers (Prisma 7 driver-adapter shape) and is unchanged.
VirtualColumn/Formula fields are not in TypeORM metadata.columns, so the strict-field-allowlist rejects them by default. Inline the existing wiki workaround (override `protected entityColumnsHash` in the subclass) so readers do not conclude the feature is unsupported.
The previous wording suggested @crud({ query: { exclude } }) / allow could allowlist VirtualColumn/Formula fields. They cannot — those options filter the entity-column set down for SELECT projection (see getAllowedColumns in packages/core/src/util/get-allowed-columns.ts); they do not add new keys to the entityColumnsHash that the SQLi guard reads. Only overriding protected entityColumnsHash in a CrudService subclass actually works; spell that out so readers do not chase the dead end.
Drop the per-skill `-s` examples and the "all three" comment; the single `npx skills add kodjunkie/nestjs-crud` line covers the common case and matches what consumers actually copy-paste.
Runtime bumps: - @mikro-orm/core 7.0.0 → 7.0.17 (closes GHSA-cfw5-68c4-ffqp + GHSA-pv5w-4p9q-p3v2) - @mikro-orm/knex 6.0.0 → 6.6.14 (closes GHSA-cfw5-68c4-ffqp) - @mikro-orm/{mysql,postgresql,sqlite} 7.0.0 → 7.0.17 - @nestjs/{common,core,platform-express} 11.1.13 → 11.1.21 - @nestjs/typeorm 11.0.0 → 11.0.1 - class-validator 0.14.3 → 0.15.1 - drizzle-orm 0.45.1 → 0.45.2 - qs 6.15.0 → 6.15.2 (root + packages/request) - redis 5.11.0 → 5.12.1 - typeorm 0.3.28 → 0.3.30 Dev-tree refresh: jest 30.2→30.4, lerna 9.0.4→9.0.7, mysql2 3.17→3.22, pg 8.18→8.21, prisma 7.0→7.8, ts-jest 29.4.6→29.4.10, prettier 3.8.1→3.8.3, ESLint/TS-ESLint, @types/node 22.19.10→22.19.19, @types/qs, globals, better-sqlite3, nodemon, @nestjs/{swagger,testing}, typescript-eslint. Yarn resolutions added to close residual dev-tree advisories: - fast-uri ^3.1.2 (closes GHSA-q3j6-qgpj-74h6 + GHSA-v39h-62p7-jpjc — path traversal + host confusion via ajv ← commitlint/prisma-sandbox/eslint chains) - hono ^4.12.18 (closes GHSA-69xw-7hcm-h432, GHSA-p77w-8qqv-26rm, GHSA-qp7p-654g-cw7p, GHSA-hm8q-7f3q-5f36 — JSX HTML injection, Vary cache leakage, CSS injection, JWT validation via @prisma/dev sandbox) - ip-address ^10.1.1 (closes GHSA-v2v4-37r5-5v8g — XSS in Address6 HTML methods via socks-proxy-agent) Verified: 114 suites / 1364 tests passed across all 9 cells (parity + typeorm/drizzle/mikro-orm/prisma × postgres/mysql). 2 intentional skips (typeorm cache fixture deferred) + 2 intentional todos (prisma to-many filtered include deferred) — both pre-existing markers, not regressions.
Security-driven patch. Closes 5 dependabot advisories: - HIGH GHSA-cfw5-68c4-ffqp (MikroORM SQL injection) - HIGH GHSA-pv5w-4p9q-p3v2 (Kysely JSON-path traversal) - HIGH GHSA-q3j6-qgpj-74h6 + GHSA-v39h-62p7-jpjc (fast-uri) Sweeps 4 dev-tree MED/LOW alerts via yarn resolutions (hono x4 + ip-address). Bundles Phase 24 root-deps reclassification originally tabled for v2.3.0. Verified across 114 jest suites / 1364 tests on TypeORM/Drizzle/MikroORM/Prisma x Postgres/MySQL. No regressions from class-validator 0.14 -> 0.15, mysql2 3.17 -> 3.22, pg 8.18 -> 8.21, prisma 7.0 -> 7.8, typeorm 0.3.28 -> 0.3.30, @mikro-orm/core 7.0.0 -> 7.0.17.
|
Packages with version v2.2.2 have been released |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security-driven patch. Closes 5 dependabot advisories and bundles a runtime dep refresh + Phase 24 root-deps reclassification originally tabled for v2.3.0 (cadence pulled forward by the security fixes).
Security — 5 advisories closed
3 consumer-runtime HIGHs (MikroORM adapter SQL layer):
GHSA-cfw5-68c4-ffqp— MikroORM SQL injection via runtime-controlled identifiers and JSON-path keys (@mikro-orm/{sql,knex})GHSA-pv5w-4p9q-p3v2— Kysely JSON-path traversal injection (transitively via mikro-orm SQL package)2 dev-tree HIGHs (closed via yarn resolution
fast-uri@^3.1.2):GHSA-q3j6-qgpj-74h6— fast-uri path traversal via percent-encoded dot segmentsGHSA-v39h-62p7-jpjc— fast-uri host confusion via percent-encoded authority delimiters4 dev-tree MED/LOW also swept via yarn resolutions:
GHSA-69xw-7hcm-h432,GHSA-p77w-8qqv-26rm,GHSA-qp7p-654g-cw7p,GHSA-hm8q-7f3q-5f36— hono x4 (via@prisma/devsandbox)GHSA-v2v4-37r5-5v8g— ip-address XSS in Address6 HTML methods (via socks-proxy-agent)Runtime dep refresh
@nestjs/{common,core,platform-express}11.1.13 → 11.1.21,@nestjs/typeorm11.0.0 → 11.0.1,@mikro-orm/{core,mysql,postgresql,sqlite}7.0.0 → 7.0.17,@mikro-orm/knex6.0.0 → 6.6.14,typeorm0.3.28 → 0.3.30,drizzle-orm0.45.1 → 0.45.2,redis5.11.0 → 5.12.1,qs6.15.0 → 6.15.2 (alsopackages/request),class-validator0.14.3 → 0.15.1. All within declared peer ranges; no consumer migration required.Phase 24 — Root deps reclassification (also rides this ship)
@nestjs/testing,mysql2,pgreclassified from rootdependenciesto rootdevDependenciesmysql2: ^3.0.0+pg: ^8.0.0declared as optionalpeerDependencieson the 4 adapter packagesTest plan
yarn install— resolutions materialize cleanlyyarn build— composite project references walk greenyarn test:all— parity + 6 adapter cells: 88 suites / 1215 tests passedyarn test:prisma:postgres— 13 suites / 149 tests passed (+1 todo)yarn test:prisma:mysql— 13 suites / 149 tests passed (+1 todo)See root
CHANGELOG.mdv2.2.2 section for full release notes.