The mysql package, a popular Node.js driver for MySQL databases, saw a stable release with version 2.11.0, building upon the foundation of the previous stable version, 2.10.2. Both versions maintain the core promise of a 100% MIT licensed, pure JavaScript driver, eliminating the need for compilation and simplifying integration into Node.js projects.
Key upgrades in 2.11.0 cater to developers seeking enhanced functionality and dependency management. A notable addition is the explicit dependency on the sqlstring package (version 2.0.1), likely indicating improvements or features related to SQL string handling and escaping. Dependency bignumber.js upgrades from 2.1.4 to 2.3.0. Both versions rely on the core readable-stream, with 2.11.0 specifying version 1.1.14 and 2.10.2 specifying '~1.1.13'. The change from tilde dependency to a more specific version implies a move to provide more stability and compatibility.
The development dependencies also reflect subtle changes. Eslint updates from 1.10.1 to 2.11.1. The after package appears as a new dev dependency in the newer upgrade, but is not present in older versions. The repository URL has changed to include git+, which is negligble though it is more formal. Date of the upgrade went from January 13, 2016 to June 06, 2016.
For developers, upgrading to 2.11.0 ensures they benefit from potential bug fixes, performance improvements arising from dependency updates, and any new features associated with sqlstring.
All the vulnerabilities related to the version 2.11.0 of the package
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.
Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.
Proof of Concept:
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
Update to version 2.14.0 or later.