node-red / node-red/node-red-nodes

node-red-node-sqlite dependency `sqlite3` is DEPRECATED and has upstream high severity vuln

Open
#1,121 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

dependencies
Dominant language
JavaScript
Stars
1.1k
Forks
612
Avg merge
13h 57m
Merged PRs (30d)
3

Description

The sqlite3 package (npm, github) is marked on GH as DEPRECATED and has not been updated for over 2 years

NPM reports an issue with a child dependency tar:

tar  <=7.5.3
Severity: high
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - https://github.com/advisories/GHSA-8qq5-rm4j-mr97
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - https://github.com/advisories/GHSA-r6q2-hw4h-h46w

npm audit:

└─┬ node-red-node-sqlite@1.1.1
  └─┬ sqlite3@5.1.7
    ├─┬ node-gyp@8.4.1
    │ ├─┬ make-fetch-happen@9.1.0
    │ │ └─┬ cacache@15.3.0
    │ │   └── tar@6.2.1 deduped
    │ └── tar@6.2.1 deduped
    └── tar@6.2.1

It seems many packages are moving to better-sqlite3 (it has twice as many downloads as sqlite3 ands is updated frequently) - perhaps it is time to consider a move?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file, test, or entry point is named. Start by locating the node-red-node-sqlite package manifest and reproducing the reported npm audit dependency tree. Compare the sqlite3 and better-sqlite3 options, then define completion as an approved dependency change with the vulnerability addressed and the node's existing behavior verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, sqlite
Domain
databases, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.