
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
nukak-postgres
Advanced tools
flexible and efficient ORM, with declarative JSON syntax and smart type-safety
nukak is the smartest ORM for TypeScript, it is designed to be fast, safe, and easy to integrate into any application. It draws inspiration from TypeORM and Mongo driver.
nukak can run in Node.js, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms.
nukak has a consistent API for distinct databases, including PostgreSQL, MySQL, SQLite, and MongoDB.
TypeScript
so it auto-completes, validates, and infers the appropriate operators on any level of the queries, including the relations and their fields.100%
valid JSON
allowing the queries to be transported across platforms with ease.OOP
(Object Oriented Programming) and FP
(Functional Programming).transactions
for flexibility, and connection pooling
for scalability.ESM
is natively supported by Node.js 12 and later.
Install the core package:
npm install nukak --save
Install one of the specific adapters for your database:
Database | Driver | Nukak Adapter |
---|---|---|
PostgreSQL | pg | nukak-postgres |
SQLite | sqlite sqlite3 | nukak-sqlite |
MariaDB | mariadb | nukak-maria |
MongoDB | mongodb | nukak-mongo |
MySQL | mysql2 | nukak-mysql |
For example, for Postgres
:
npm install pg nukak-postgres --save
Additionally, your tsconfig.json
may need the following flags:
"target": "es2020",
"experimentalDecorators": true,
"emitDecoratorMetadata": true
Take any dump class (aka DTO) and annotate it with the decorators from nukak/entity
.
import { v4 as uuidv4 } from 'uuid';
import { Id, Field, Entity } from 'nukak/entity';
/**
* any class can be annotated with this decorator to make it works as
* an entity.
*/
@Entity()
export class User {
/**
* an entity should specify an ID Field, its name and type are automatically detected.
* the `onInsert` property can be used to specify a custom mechanism for
* auto-generating the primary-key's value when inserting.
*/
@Id({ onInsert: uuidv4 })
id?: string;
/**
* the properties of the class can be annotated with this decorator so they
* are interpreted as a column, its name and type are automatically detected.
*/
@Field()
name?: string;
@Field()
email?: string;
@Field()
password?: string;
}
A default querier-pool can be set in any of the bootstrap files of your app (e.g. in the server.ts
).
import { setQuerierPool } from 'nukak';
import { PgQuerierPool } from 'nukak-postgres';
export const querierPool = new PgQuerierPool(
{
host: 'localhost',
user: 'theUser',
password: 'thePassword',
database: 'theDatabase',
},
// optionally, a logger can be passed to log the generated SQL queries
{ logger: console.log }
);
// the default querier pool that `nukak` will use
setQuerierPool(querierPool);
import { getQuerier } from 'nukak';
import { User } from './shared/models/index.js';
async function findFirstUsers(limit = 100) {
const querier = await getQuerier();
const users = await querier.findMany(
User,
{
$sort: { createdAt: 1 },
$limit: limit,
},
['id', 'name', 'email']
);
await querier.release();
return users;
}
async function createUser(body: User) {
const querier = await getQuerier();
const id = await querier.insertOne(User, body);
await querier.release();
return id;
}
Learn more about nukak
at its website https://nukak.org
FAQs
flexible and efficient ORM, with declarative JSON syntax and smart type-safety
The npm package nukak-postgres receives a total of 3 weekly downloads. As such, nukak-postgres popularity was classified as not popular.
We found that nukak-postgres demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.