Skip to content

Commit a7d19c0

Browse files
committed
deps: Force sqlite3 to use a recent node-gyp
In particular this leads to using a reasonably recent `tar` package, fixing vulnerabilities in the old one it was using. Upstream has already bumped this to node-gyp 7.x in their master branch, but haven't posted a release to NPM: TryGhost/node-sqlite3#1493 Empirically node-gyp 8.x, the latest, works fine. That's also reported by someone on that issue thread: TryGhost/node-sqlite3#1493 (comment) May as well go for that, then. (There was no 8.x yet when the version specified in sqlite3 was bumped to 7.x.) Some other people on that thread report using a fork made by the VS Code developers, which posted some releases in November. But that fork seems pretty clearly intended for VS Code's own internal use, with no promises for broader consumption: microsoft/vscode-node-sqlite3#14 (comment) so that doesn't seem like an improvement over upstream.
1 parent 6a9564c commit a7d19c0

File tree

2 files changed

+405
-312
lines changed

2 files changed

+405
-312
lines changed

package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,5 +118,8 @@
118118
"sqlite3": "^5.0.2",
119119
"typescript": "~3.8.3",
120120
"yarn-deduplicate": "^3.0.0"
121+
},
122+
"resolutions": {
123+
"sqlite3/**/node-gyp": "^8"
121124
}
122125
}

0 commit comments

Comments
 (0)