Update dependency mysql2 to v3 [SECURITY]#12481
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
EntelligenceAI PR SummaryUpgrades
Confidence Score: 3/5 - Review RecommendedLikely safe but review recommended — this PR correctly upgrades Key Findings:
Files requiring special attention
|
WalkthroughThis PR upgrades the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title mysql2 v3 Upgrade and Dependency Updates
participant BC as backend-common
participant BTU as backend-test-utils
participant mysql2 as mysql2 library
participant deps as Internal Dependencies
Note over BC, BTU: mysql2 upgraded from v2 to v3
BC->>mysql2: require mysql2 v3
BTU->>mysql2: require mysql2 v3
Note over mysql2, deps: v3 replaces internal dependencies
mysql2->>deps: uses aws-ssl-profiles (new in v3)
mysql2->>deps: uses iconv-lite v0.7 (was v0.6)
mysql2->>deps: uses long v5.3 (was v4)
mysql2->>deps: uses lru.min (replaces lru-cache)
mysql2->>deps: uses named-placeholders v1.1.6
mysql2->>deps: uses sql-escaper (replaces sqlstring)
mysql2->>deps: removes seq-queue (dropped in v3)
mysql2->>deps: removes denque v2.0 (now requires v2.1)
Note over BC, BTU: Other shared dependency upgrades
BC->>deps: cross-fetch v3.2 (was v3.1)
BC->>deps: node-fetch v2.7 (was v2.6)
BC->>deps: core-js v3.49 (was v3.31)
BC->>deps: dompurify v2.5 (was v2.4)
participant GPS as plugin-gitops-profiles
participant CPA as core-plugin-api
Note over GPS, CPA: Backstage packages pinned to older versions
GPS->>deps: pins core-components to 0.1.0
GPS->>deps: pins core-plugin-api to 0.1.0
GPS->>deps: pins config to 0.1.1
GPS->>deps: pins theme to 0.1.1
CPA->>deps: pins config to 0.1.1
CPA->>deps: pins version-bridge to 0.1.0
Note over GPS, deps: Pinned pkgs pull in older transitive deps
GPS->>deps: react-markdown v5 and remark-gfm v1
GPS->>deps: react-syntax-highlighter v15.6
GPS->>deps: material-table v1.69 with jspdf v2.1
🔗 Cross-Repository Impact AnalysisEnable automatic detection of breaking changes across your dependent repositories. → Set up now Learn more about Cross-Repository AnalysisWhat It Does
How to Enable
Benefits
|
🤖 Augment PR SummarySummary: Updates the repository’s MySQL driver dependency to the mysql2 v3 major line to address multiple upstream security advisories. Changes:
Technical Notes: The intent is to pull in mysql2 3.x releases that include fixes for multiple CVEs (including RCE/code-injection issues) while keeping usage via the existing Knex 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| "knex": "^2.0.0", | ||
| "msw": "^1.0.0", | ||
| "mysql2": "^2.2.5", | ||
| "mysql2": "^3.0.0", |
There was a problem hiding this comment.
mysql2 is bumped to ^3.0.0, but that semver range still includes known-vulnerable 3.x releases mentioned in the PR description; can you confirm the updated yarn.lock resolves to a patched version (e.g., >= 3.9.8) so the security fix is actually effective? Other locations where this applies: packages/backend-common/package.json:142.
Severity: medium
Other Locations
packages/backend-common/package.json:142
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/npm-mysql2-vulnerability
branch
from
bba6dd6 to
b4cfe00
Compare
This PR contains the following updates:
^2.2.5→^3.0.0mysql2 cache poisoning vulnerability
CVE-2024-21507 / GHSA-mqr2-w7wj-jjgr
More information
Details
Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the
keyFromFieldsfunction, resulting in cache poisoning. An attacker can inject a colon:character within a value of the attacker-crafted key.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
mysql2 vulnerable to Prototype Poisoning
CVE-2024-21509 / GHSA-49j4-86m8-q2jw
More information
Details
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through
parserFnintext_parser.jsandbinary_parser.js.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
mysql2 Remote Code Execution (RCE) via the readCodeFor function
CVE-2024-21508 / GHSA-fpw7-j2hg-69v5
More information
Details
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the
readCodeForfunction due to improper validation of thesupportBigNumbersandbigNumberStringsvalues.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
MySQL2 for Node Arbitrary Code Injection
CVE-2024-21511 / GHSA-4rch-2fh8-94vw
More information
Details
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
mysql2 vulnerable to Prototype Pollution
CVE-2024-21512 / GHSA-pmh2-wpjm-fj45
More information
Details
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
sidorares/node-mysql2 (mysql2)
v3.9.8Compare Source
Bug Fixes
jonServerPublicKeytoonServerPublicKey(#2699) (8b5f691)v3.9.7Compare Source
Bug Fixes
v3.9.6Compare Source
Bug Fixes
v3.9.5Compare Source
Bug Fixes
v3.9.4Compare Source
Bug Fixes
v3.9.3Compare Source
Bug Fixes
v3.9.2Compare Source
Bug Fixes
v3.9.1Compare Source
Bug Fixes
v3.9.0Compare Source
Features
executemethod (#2398) (baaa92a)v3.8.0Compare Source
Features
Bug Fixes
for await(#2389) (af47148)v3.7.1Compare Source
Bug Fixes
v3.7.0Compare Source
Features
v3.6.5Compare Source
Bug Fixes
v3.6.4Compare Source
Bug Fixes
ConnectionOptions(#2288) (5cd7639)v3.6.3Compare Source
Bug Fixes
v3.6.2Compare Source
Bug Fixes
v3.6.1Compare Source
Bug Fixes
v3.6.0Compare Source
Features
infileStreamFactoryoption (#2159) (5bed0f8)v3.5.2Compare Source
Bug Fixes
v3.5.1Compare Source
Bug Fixes
ResultSetHeader[]toqueryandexecute(f649486)v3.5.0Compare Source
Features
v3.4.5Compare Source
Bug Fixes
v3.4.4Compare Source
Bug Fixes
ProcedureCallPackettoexecuteoverloads (3566ef7)ProcedureCallPackettoqueryoverloads (352c3bc)ProcedureCallPacketto promise-basedexecuteoverloads (8292416)ProcedureCallPacketto promise-basedqueryoverloads (0f31a41)ProcedureCallPackettypings (09ad1d2)v3.4.3Compare Source
Bug Fixes
v3.4.2Compare Source
Bug Fixes
v3.4.1Compare Source
Bug Fixes
createPooluri overload (98623dd)PoolClustertypings (3902ca6)PoolClustertypings (7f38496)parserCacheinpromise.js(7f35cf5)promise.js(4ce2c70)Typesconstant (86655ec)Charsetsconstants (01f77a0)CharsetToEncodingconstants (609229a)parserCache(891a523)Typesconstant (04601dd)Charsetsconstants (51c4196)v3.4.0Compare Source
Features
v3.3.5Compare Source
Bug Fixes
createPoolpromiseasPromisePool(#2060) (ff3c36c)v3.3.4Compare Source
Bug Fixes
PromisePoolConnectionimport name (76db54a)releaseConnectiontypes and promise (4aac9d6)v3.3.3Compare Source
Bug Fixes
v3.3.2Compare Source
Bug Fixes
v3.3.1Compare Source
Bug Fixes
v3.3.0Compare Source
Features
v3.2.4Compare Source
Bug Fixes
v3.2.3Compare Source
Bug Fixes
v3.2.2Compare Source
Bug Fixes
ConnectionOptionsconflict betweenmysqlandmysql/promise(#1955) (eca8bda)v3.2.1Compare Source
Bug Fixes
v3.2.0Compare Source
Features
v3.1.2Compare Source
Bug Fixes
lru-cachereset method to clear (114f266)v3.1.1Compare Source
Bug Fixes
v3.1.0Compare Source
Features
Bug Fixes
v3.0.1Compare Source
Miscellaneous Chores
v3.0.0Compare Source
lru-cachedependency, allowing it do dedupe and be shared between mysql2 and named-placeholders - #1711, mysqljs/named-placeholders#19chaiandmochamoved to devDependencies #1774TCP_NODELAYflag enabled, avoiding long connect timeout in some scenarios #1751Miscellaneous Chores
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.