The npm package mysql saw a minor version bump from 2.2.0 to 2.3.0, introducing subtle but potentially impactful changes for Node.js developers interacting with MySQL databases. Both versions maintain the core promise of providing a pure JavaScript, compilation-free, and MIT-licensed driver. A key difference lies in the updated dependency on bignumber.js, moving from version 1.3.0 to 1.4.0. This suggests improvements or bug fixes related to handling large numbers, crucial when dealing with potentially large numerical datasets retrieved from the database.
While the readable-stream and require-all dependencies remain consistent, the development dependencies display a minor change: urun moved from 0.0.7 to 0.0.8, hinting at internal tooling updates for testing or development workflows. The core functionality described in the package description remains unchanged between versions.
Developers should consider the upgrade to 2.3.0, particularly if their application deals with large numerical values where improvements to bignumber.js could impact precision or performance. Reviewing the changelog or release notes associated with bignumber.js 1.4.0 is recommended to understand the specific changes incorporated. Although a minor release, consistent dependency upgrades suggest ongoing maintenance and refinement of the mysql package, a positive sign for long-term stability and support. The package provides a convenient and reliable way to use MySQL databases in Javascript-based applications.
All the vulnerabilities related to the version 2.3.0 of the package
mysql Node.JS Module Vulnerable to Remote Memory Exposure
Versions of mysql before 2.14.0 are vulnerable to remove memory exposure.
Affected versions of mysql package allocate and send an uninitialized memory over the network when a number is provided as a password.
Only mysql running on Node.js versions below 6.0.0 are affected due to a throw added in newer node.js versions.
Proof of Concept:
require('mysql').createConnection({
host: 'localhost',
user: 'user',
password : USERPROVIDEDINPUT, // number
database : 'my_db'
}).connect();
Update to version 2.14.0 or later.