Skip to content

Conversation

@Katanis
Copy link
Owner

@Katanis Katanis commented Jan 10, 2026

snyk-top-banner

Snyk has created this PR to upgrade typeorm from 0.2.24 to 0.3.28.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 760 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Prototype Pollution
SNYK-JS-HIGHLIGHTJS-1045326
290 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HIGHLIGHTJS-1048676
290 No Known Exploit
critical severity Function Call With Incorrect Argument Type
SNYK-JS-SHAJS-12089400
290 Proof of Concept
high severity Prototype Pollution
SNYK-JS-TYPEORM-590152
290 Mature
medium severity SQL Injection
SNYK-JS-TYPEORM-13746469
290 Proof of Concept
medium severity Prototype Pollution
SNYK-JS-XML2JS-5414874
290 Proof of Concept
Release notes
Package name: typeorm
  • 0.3.28 - 2025-12-03

    What's Changed

    New Contributors

    Full Changelog: 0.3.27...0.3.28

  • 0.3.28-dev.ec3ea10 - 2025-12-01
  • 0.3.28-dev.ea0f155 - 2025-11-24
  • 0.3.28-dev.e0e7de1 - 2025-09-26
  • 0.3.28-dev.e04ffd3 - 2025-11-12
  • 0.3.28-dev.dd55218 - 2025-11-25
  • 0.3.28-dev.dc74f53 - 2025-11-20
  • 0.3.28-dev.d7867eb - 2025-10-20
  • 0.3.28-dev.d4f7b44 - 2025-09-20
  • 0.3.28-dev.d0b5454 - 2025-11-28
  • 0.3.28-dev.cfb3d6c - 2025-11-27
  • 0.3.28-dev.cb1284c - 2025-11-24
  • 0.3.28-dev.cad0921 - 2025-11-20
  • 0.3.28-dev.c4f5d12 - 2025-11-30
  • 0.3.28-dev.c16ef63 - 2025-09-19
  • 0.3.28-dev.bed7913 - 2025-11-10
  • 0.3.28-dev.bec548a - 2025-11-20
  • 0.3.28-dev.ba3319d - 2025-11-11
  • 0.3.28-dev.b639d33 - 2025-11-09
  • 0.3.28-dev.ade198c - 2025-11-23
  • 0.3.28-dev.9ea8577 - 2025-09-19
  • 0.3.28-dev.925dee0 - 2025-09-29
  • 0.3.28-dev.8692da2 - 2025-10-20
  • 0.3.28-dev.83e3a8a - 2025-09-25
  • 0.3.28-dev.835647a - 2025-11-29
  • 0.3.28-dev.7c55d32 - 2025-10-12
  • 0.3.28-dev.797a8f5 - 2025-09-19
  • 0.3.28-dev.74522ff - 2025-10-03
  • 0.3.28-dev.6f486e5 - 2025-12-02
  • 0.3.28-dev.6eda138 - 2025-11-21
  • 0.3.28-dev.6ed24f8 - 2025-11-20
  • 0.3.28-dev.6da0911 - 2025-11-14
  • 0.3.28-dev.67f793f - 2025-11-30
  • 0.3.28-dev.6381c8d - 2025-11-09
  • 0.3.28-dev.61f9e0d - 2025-11-30
  • 0.3.28-dev.5fa8a0b - 2025-11-21
  • 0.3.28-dev.5d02f06 - 2025-11-11
  • 0.3.28-dev.5b01c39 - 2025-11-07
  • 0.3.28-dev.5a28729 - 2025-11-11
  • 0.3.28-dev.55cd8e2 - 2025-11-30
  • 0.3.28-dev.51fbcf4 - 2025-11-10
  • 0.3.28-dev.4f05718 - 2025-09-26
  • 0.3.28-dev.3ac6053 - 2025-11-09
  • 0.3.28-dev.38715bb - 2025-12-02
  • 0.3.28-dev.2446bd0 - 2025-10-01
  • 0.3.28-dev.1f19abb - 2025-10-03
  • 0.3.28-dev.181154a - 2025-10-05
  • 0.3.28-dev.02e7b71 - 2025-11-18
  • 0.3.28-dev.9383799 - 2025-11-24
  • 0.3.28-dev.5461927 - 2025-11-29
  • 0.3.28-dev.2681051 - 2025-11-12
  • 0.3.28-dev.2671579 - 2025-10-03
  • 0.3.27 - 2025-09-19

    Note: This release reverts a fix from 0.3.26 (#11114) because it introduced a regression in certain cases.

    Once a fix can be provided which does not have this regression, it will be released in a future patch.

    What's Changed

    • perf: Cache package.json location between getNearestPackageJson invocations by @ rutkowskib in #11580
    • feat: allow VirtualColumns to be initially non-selectable by @ alumni in #11586
    • build(deps): bump sha.js from 2.4.11 to 2.4.12 in /sample/playground by @ dependabot[bot] in #11617
    • Add @ signalwire/docusaurus-plugin-llms-txt to TypeORM documentation by @ Copilot in #11622
    • fix: Add package.json exports for react-native by @ macksal in #11623
    • fix(query-builder): don't use lazy count when offset exceeds total in getManyAndCount by @ jeremyteyssedre in #11634
    • chore: bump sha.js from 2.4.11 to 2.4.12 (fix security issue: CVE-2025-9288) by @ prateek-hegde in #11639
    • docs: fix docs for UpdateDateColumn by @ madhugb in #11572
    • build(deps): bump axios from 1.11.0 to 1.12.1 in /docs by @ dependabot[bot] in #11649
    • feat(migration): improve JSDoc types in generated migration templates by @ gwythyr in #11490
    • fix: update tests to reflect migration template changes by @ sgarner in #11653
    • feat(mysql): add support for MySQL 9 / MariaDB 12 by @ alumni in #11575
    • ci: add close stale issues GH action by @ gioboa in #11651
    • feat: add new undefined and null behavior flags by @ naorpeled in #11332
    • feat(postgres): support vector/halfvec data types by @ naorpeled in

Snyk has created this PR to upgrade typeorm from 0.2.24 to 0.3.28.

See this package in npm:
typeorm

See this project in Snyk:
https://app.snyk.io/org/katanis/project/ad4f782b-1e9e-4b6f-861c-3259f7400c4e?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants