
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
Export database schema from relational or document databases. Import it to https://azimutt.app
Azimutt CLI ease your work with databases 😎
It works with: PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, MongoDB, Couchbase, Snowflake, BigQuery (can be extended on demand).
It's a toolbox to interact with those databases but also AML, here are the main features:
To use it, you need npm, you can install it (npm install -g azimutt) or launch it directly (npx azimutt@latest <command> <args>).
This one is just a shortcut to start the gateway (like the gateway command) and open Azimutt with your url to explore your database, easy-peasy!
npx azimutt@latest explore <db_url>
Options:
--instance <instance>: select the Azimutt instance to open (by default it will be https://azimutt.app)Connect to your database, extract the schema, statistics and queries to run some analyses and recommend improvement actions.
npx azimutt@latest analyze <db_url>
You can see this as a database linter. The first time it will write a config file (by default in ~/.azimutt/analyze/$db_name/conf.json) you can adjust later.
Options:
--folder <folder>: use a specific folder for configuration and report files--only <rule_ids>: limit the used rules--size <number>: how many violations are shown for each rules--ignore-violations-from <folder>: ignores all the violations already reported in this given folder--email <email>: your email, unlocks writing the report as JSON--key <key>: unlocks trend rules, as us for a keyLaunch the gateway server, it acts as a bridge between Azimutt frontend and your database (convert HTTP queries to SQL ones ^^).
npx azimutt@latest gateway
Export your database schema as JSON, can be imported into Azimutt.
It's convenient to check what you upload to Azimutt (even if everything stay on your browser until you save and choose).
npx azimutt@latest export <db_url>
Sample urls:
postgresql://postgres:postgres@localhost:5432/azimutt_devmysql://user:password@my.host.com:3306/my_dbmariadb://user:password@my.host.com:3306/my_dbServer=host.com,1433;Database=db;User Id=user;Password=passoracle:thin:system/oracle@localhost:1521/FREE"mongodb+srv://user:password@cluster3.md7h4xp.mongodb.net"couchbases://cb.gfn6dh493pmfh613v.cloud.couchbase.comsnowflake://user:password@account.snowflakecomputing.com?db=my_dbbigquery://bigquery.googleapis.com/my-project?key=key.jsonOptions:
--database: restrict extraction to this database or database pattern (uses LIKE pattern with %)--catalog: restrict extraction to this catalog or catalog pattern (uses LIKE pattern with %)--bucket: restrict extraction to this bucket or bucket pattern (uses LIKE pattern with %)--schema: restrict extraction to this schema or schema pattern (uses LIKE pattern with %)--entity: restrict extraction to this entity or entity pattern (uses LIKE pattern with %)--sample-size: defines how many items are used to infer a schema (for document databases or json fields)--mixed-json: split collections given the specified json field (if you have several kind of documents in the same collection)--infer-json-attributes: if JSON fields should be fetched to infer their schema--infer-polymorphic-relations: if kind field on polymorphic relations should be fetched to know all relations--infer-relations: build relations based on column names, for example a user_id will have a relation if a table users has an id column--ignore-errors: do not stop export on errors, just log them--log-queries: log queries when executing them--format: default to json but for relational database it could also be sql--output: database name will be inferred from url and prefixed by the timestampConvert a dialect to another, supporting AML, SQL (PostgreSQL for now), JSON, Markdown, Mermaid...
npx azimutt@latest convert <file_path> --from <dialect> --to <dialect>
Input dialects: aml, amlv1, json
Output dialects: aml, amlv1, postgres, mermaid, markdown, json
Options:
--out <file_path>: to choose the file to write (will be constructed otherwise)(Work In Progress)
Make a schema diff between two databases.
npx azimutt@latest <db_url_reference> <db_url_validation>
It will produce a JSON diff, that could be converted to SQL.
Start with pnpm install to install dependencies and set up the CLI, then you have:
pnpm run exec launch the CLI (use -- args for CLI args, ex: npm run exec -- export postgresql://postgres:postgres@localhost:5432/azimutt_dev), or npm run build && npm run execpnpm run start to launch it with live reload (same, use -- args to pass arguments to the CLI)pnpm run test to launch testsIssues:
TypeError: Cannot read properties of undefined (reading 'sourceFile') when running tests :/package.json and src/version.ts versionpnpm -w run update + manual)pnpm run dry-publish and check azimutt-x.y.z.tgz contentpnpm publish --no-git-checksView it on npm.
If any issue, unpublish the package with: npm unpublish azimutt@0.1.33
If you need to develop on multiple libs at the same time (ex: want to update a connector and try it through the CLI), depend on local libs but publish & revert before commit.
pnpm add <lib>, ex: pnpm add "@azimutt/modelspnpm run buildFAQs
Export database schema from relational or document databases. Import it to https://azimutt.app
The npm package azimutt receives a total of 29 weekly downloads. As such, azimutt popularity was classified as not popular.
We found that azimutt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.