Skip to content

fix(db-postgres): bump drizzle-orm to 0.45.2 to resolve an SQL injection vulnerability and pg to 8.20.0 #16168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
r1tsuu merged 6 commits into from
Apr 9, 2026
Merged

fix(db-postgres): bump drizzle-orm to 0.45.2 to resolve an SQL injection vulnerability and pg to 8.20.0 #16168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a13ef5d
fix(db-postgres): patch SQL injection vulnerability by upgrading driz…
siimsams Apr 5, 2026
de27aed
Merge remote-tracking branch 'origin/main' into upgrade-drizzle-and-p…
siimsams Apr 7, 2026
8ef5efe
Merge remote-tracking branch 'origin/main' into upgrade-drizzle-and-p…
siimsams Apr 7, 2026
96408fb
Merge branch 'main' into upgrade-drizzle-and-pg-versions
siimsams Apr 8, 2026
2ad73e2
chore: update package lock
siimsams Apr 8, 2026
8303fbd
Merge branch 'main' of github.com:payloadcms/payload into upgrade-dri…
r1tsuu Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/db-d1-sqlite/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,14 +74,14 @@
"@payloadcms/drizzle": "workspace:*",
"console-table-printer": "2.12.1",
"drizzle-kit": "0.31.7",
"drizzle-orm": "0.44.7",
"drizzle-orm": "0.45.2",
"prompts": "2.4.2",
"to-snake-case": "1.0.0",
"uuid": "11.1.0"
},
"devDependencies": {
"@payloadcms/eslint-config": "workspace:*",
"@types/pg": "8.10.2",
"@types/pg": "8.20.0",
"@types/to-snake-case": "1.0.0",
"payload": "workspace:*"
},
Expand Down
6 changes: 3 additions & 3 deletions packages/db-postgres/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,11 +75,11 @@
},
"dependencies": {
"@payloadcms/drizzle": "workspace:*",
"@types/pg": "8.10.2",
"@types/pg": "8.20.0",
"console-table-printer": "2.12.1",
"drizzle-kit": "0.31.7",
"drizzle-orm": "0.44.7",
"pg": "8.16.3",
"drizzle-orm": "0.45.2",
"pg": "8.20.0",
"prompts": "2.4.2",
"to-snake-case": "1.0.0",
"uuid": "11.1.0"
Expand Down
15 changes: 4 additions & 11 deletions packages/db-postgres/src/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,17 @@
import type { DrizzleAdapter } from '@payloadcms/drizzle'
import type {
BasePostgresAdapter,
GenericEnum,
MigrateDownArgs,
MigrateUpArgs,
PostgresSchemaHook,
} from '@payloadcms/drizzle/postgres'
import type { DrizzleAdapter } from '@payloadcms/drizzle/types'
import type { DrizzleConfig, ExtractTablesWithRelations } from 'drizzle-orm'
import type { DrizzleConfig } from 'drizzle-orm'
import type { NodePgDatabase } from 'drizzle-orm/node-postgres'
import type {
PgDatabase,
PgQueryResultHKT,
PgSchema,
PgTableFn,
PgTransactionConfig,
PgWithReplicas,
} from 'drizzle-orm/pg-core'
import type { PgSchema, PgTableFn, PgTransactionConfig, PgWithReplicas } from 'drizzle-orm/pg-core'
import type { Pool, PoolConfig } from 'pg'

type PgDependency = typeof import('pg')
type PgDependency = typeof import('pg').default

export type Args = {
/**
Expand Down
4 changes: 2 additions & 2 deletions packages/db-sqlite/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,14 +76,14 @@
"@payloadcms/drizzle": "workspace:*",
"console-table-printer": "2.12.1",
"drizzle-kit": "0.31.7",
"drizzle-orm": "0.44.7",
"drizzle-orm": "0.45.2",
"prompts": "2.4.2",
"to-snake-case": "1.0.0",
"uuid": "11.1.0"
},
"devDependencies": {
"@payloadcms/eslint-config": "workspace:*",
"@types/pg": "8.10.2",
"@types/pg": "8.20.0",
"@types/to-snake-case": "1.0.0",
"payload": "workspace:*"
},
Expand Down
8 changes: 4 additions & 4 deletions packages/db-vercel-postgres/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,19 +75,19 @@
},
"dependencies": {
"@payloadcms/drizzle": "workspace:*",
"@vercel/postgres": "^0.9.0",
"@vercel/postgres": "^0.10.0",
"console-table-printer": "2.12.1",
"drizzle-kit": "0.31.7",
"drizzle-orm": "0.44.7",
"pg": "8.16.3",
"drizzle-orm": "0.45.2",
"pg": "8.20.0",
"prompts": "2.4.2",
"to-snake-case": "1.0.0",
"uuid": "11.1.0"
},
"devDependencies": {
"@hyrious/esbuild-plugin-commonjs": "0.2.6",
"@payloadcms/eslint-config": "workspace:*",
"@types/pg": "8.10.2",
"@types/pg": "8.20.0",
"@types/to-snake-case": "1.0.0",
"esbuild": "0.27.1",
"payload": "workspace:*"
Expand Down
4 changes: 2 additions & 2 deletions packages/db-vercel-postgres/src/connect.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ export const connect: Connect = async function connect(
// Passed the poolOptions if provided,
// else have vercel/postgres detect the connection string from the environment
this.drizzle = drizzle({
client,
client: client as pg.Pool,
logger,
schema: this.schema,
})
Expand All @@ -55,7 +55,7 @@ export const connect: Connect = async function connect(
connectionString,
}
const pool = new VercelPool(options)
return drizzle({ client: pool, logger, schema: this.schema })
return drizzle({ client: pool as unknown as pg.Pool, logger, schema: this.schema })
Comment thread
siimsams marked this conversation as resolved.
})
const myReplicas = withReplicas(this.drizzle, readReplicas as any)
this.drizzle = myReplicas
Expand Down
4 changes: 2 additions & 2 deletions packages/drizzle/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,15 +59,15 @@
"dependencies": {
"console-table-printer": "2.12.1",
"dequal": "2.0.3",
"drizzle-orm": "0.44.7",
"drizzle-orm": "0.45.2",
"prompts": "2.4.2",
"to-snake-case": "1.0.0",
"uuid": "11.1.0"
},
"devDependencies": {
"@libsql/client": "0.14.0",
"@payloadcms/eslint-config": "workspace:*",
"@types/pg": "8.10.2",
"@types/pg": "8.20.0",
"@types/to-snake-case": "1.0.0",
"payload": "workspace:*"
},
Expand Down
Loading
Loading