node-red / node-red/node-red-nodes
node-red-node-sqlite dependency `sqlite3` is DEPRECATED and has upstream high severity vuln
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.1k
- Forks
- 612
- Avg merge
- 13h 57m
- Merged PRs (30d)
- 3
Description
The sqlite3 package (npm, github) is marked on GH as DEPRECATED and has not been updated for over 2 years
NPM reports an issue with a child dependency tar:
tar <=7.5.3
Severity: high
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w
npm audit:
└─┬ node-red-node-sqlite@1.1.1
└─┬ sqlite3@5.1.7
├─┬ node-gyp@8.4.1
│ ├─┬ make-fetch-happen@9.1.0
│ │ └─┬ cacache@15.3.0
│ │ └── tar@6.2.1 deduped
│ └── tar@6.2.1 deduped
└── tar@6.2.1
It seems many packages are moving to better-sqlite3 (it has twice as many downloads as sqlite3 ands is updated frequently) - perhaps it is time to consider a move?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by locating the node-red-node-sqlite package manifest and reproducing the reported npm audit dependency tree. Compare the sqlite3 and better-sqlite3 options, then define completion as an approved dependency change with the vulnerability addressed and the node's existing behavior verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, sqlite
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100