
Security News
The Code You Didn't Write Is Still Yours to Defend
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.
做了如下功能优化:
用nodejs实现 类似与flyway更新数据库逻辑 底层使用sequelize.js 执行数据库脚本,理论上sequlize支持的数据库都能使用
yarn add flyway-js
# 或者 npm i flyway-js -S
import FlywayJs from "flywaj-js";
//数据库连接
const db_url = process.env.DB_URL;
//SQL 或者 ts,js 路径
const sql_dir = process.cwd()+'/test/sql'
async function main() {
await new FlywayJs(db_url, sql_dir).run();
}
let options = {
//关闭文件hash校验,默认为false
allowHashNotMatch: true,
//指定数据库基准脚本文件名,默认为""
baseline: ""
}
//如果 force_init 为 true 则每次请求flyway_js 表。主要为啦适配单元测试.生产 需要是 false. 单元测试时 需要为 true
let force_init = true;
new FlywayJs(db_url, sql_dir, force_init, options).run();
export default function(db: Sequelize, t: sequelize.Transaction) {
//处理数据库逻辑,如果需要事务处理,可以将t传入到需要事务的地方。
}
指定数据库的基准脚本(Baselines an existing database, excluding all migrations up to and including baselineVersion.)
基本脚本: 已有数据库是通过执行一系列脚本得到的,其中最后一个被执行的脚本就是该数据库版本的基准脚本。
首次在已有系统使用本插件管理数据库版本时,需要跳过已经手工执行过的数据库脚本。 假设基准脚本为Vxx__t.sql,使用本插件时应该指定基准脚本,如下:
let options = {
allowHashNotMatch: false,
baseline: "Vxx__t.sql"
}
指定后,运行FlywayJs.run()时,按脚本名称排序后,处于Vxx__t.sql之前的脚本(包括基准脚本)只会被登记到flyway_js表,而不会执行脚本中的内容。
登记到flyway_js表中的脚本,执行FlywayJs.run()时都会检查Hash。
系统运行过程中,某些情况下,手工执行过数据库脚本,这时应该修改baseline指向最后一个手工执行的脚本。
let options = {
allowHashNotMatch: false,
baseline: "Vxx__最后一个已执行过的脚本.sql"
}
$ npm i mocha -g
$ export DB_URL="mysql://127.0.0.1:3306/itp-flyway?user=root&password=root123098"
npx mocha
FAQs
做了如下功能优化: - 支持SQL脚本中编写多组脚本 - 支持baseline指定基准脚本
The npm package flyway-js receives a total of 239 weekly downloads. As such, flyway-js popularity was classified as not popular.
We found that flyway-js demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
AI agents are pulling packages into environments no scanner is watching, creating exposure before security teams can see it.

Security News
GitHub Actions checkout now blocks risky pull_request_target checkouts by default to help prevent pwn request supply chain attacks.

Product
Socket now supports Custom Roles and Repository Access Permissions so organizations can control who can access specific repositories and actions.