Commit a7d19c0
committed
deps: Force sqlite3 to use a recent node-gyp
In particular this leads to using a reasonably recent `tar` package,
fixing vulnerabilities in the old one it was using.
Upstream has already bumped this to node-gyp 7.x in their master
branch, but haven't posted a release to NPM:
TryGhost/node-sqlite3#1493
Empirically node-gyp 8.x, the latest, works fine. That's also
reported by someone on that issue thread:
TryGhost/node-sqlite3#1493 (comment)
May as well go for that, then. (There was no 8.x yet when the
version specified in sqlite3 was bumped to 7.x.)
Some other people on that thread report using a fork made by the
VS Code developers, which posted some releases in November. But
that fork seems pretty clearly intended for VS Code's own internal
use, with no promises for broader consumption:
microsoft/vscode-node-sqlite3#14 (comment)
so that doesn't seem like an improvement over upstream.1 parent 6a9564c commit a7d19c0
2 files changed
+405
-312
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
118 | 118 | | |
119 | 119 | | |
120 | 120 | | |
| 121 | + | |
| 122 | + | |
| 123 | + | |
121 | 124 | | |
122 | 125 | | |
0 commit comments