pg - npm Package Compare versions

Comparing version 7.17.1 to 7.18.0

lib/compat/warn-deprecation.js

@@ -8,3 +8,3 @@ 'use strict'
 // Node 4 doesn’t support process.emitWarning(message, 'DeprecationWarning', code).
-const emitDeprecationWarning = (message, code) => {
+const warnDeprecation = (message, code) => {
   let dummy = dummyFunctions.get(code)
@@ -20,2 +20,2 @@
 
-module.exports = emitDeprecationWarning
+module.exports = warnDeprecation

lib/connection-fast.js

@@ -18,2 +18,4 @@ 'use strict'
 
+var warnDeprecation = require('./compat/warn-deprecation')
+
 var TEXT_MODE = 0
@@ -109,2 +111,5 @@
     }
+    if (typeof self.ssl.rejectUnauthorized !== 'boolean') {
+      warnDeprecation('Implicit disabling of certificate verification is deprecated and will be removed in pg 8. Specify `rejectUnauthorized: true` to require a valid CA or `rejectUnauthorized: false` to explicitly opt out of MITM protection.', 'PG-SSL-VERIFY')
+    }
     if (net.isIP(host) === 0) {
@@ -111,0 +116,0 @@ options.servername = host

lib/connection.js

@@ -17,2 +17,4 @@ 'use strict'
 
+var warnDeprecation = require('./compat/warn-deprecation')
+
 var TEXT_MODE = 0
@@ -87,7 +89,9 @@ var BINARY_MODE = 1
     switch (responseCode) {
+      case 'S': // Server supports SSL connections, continue with a secure connection
+        break
       case 'N': // Server does not support SSL connections
+        self.stream.end()
         return self.emit('error', new Error('The server does not support SSL connections'))
-      case 'S': // Server supports SSL connections, continue with a secure connection
-        break
       default: // Any other response byte, including 'E' (ErrorResponse) indicating a server error
+        self.stream.end()
         return self.emit('error', new Error('There was an error establishing an SSL connection'))
@@ -108,2 +112,5 @@ }
     }
+    if (typeof self.ssl.rejectUnauthorized !== 'boolean') {
+      warnDeprecation('Implicit disabling of certificate verification is deprecated and will be removed in pg 8. Specify `rejectUnauthorized: true` to require a valid CA or `rejectUnauthorized: false` to explicitly opt out of MITM protection.', 'PG-SSL-VERIFY')
+    }
     if (net.isIP(host) === 0) {
@@ -113,5 +120,14 @@ options.servername = host
     self.stream = tls.connect(options)
-    self.attachListeners(self.stream)
     self.stream.on('error', reportStreamError)
 
+    // send SSLRequest packet
+    const buff = Buffer.alloc(8)
+    buff.writeUInt32BE(8)
+    buff.writeUInt32BE(80877103, 4)
+    if (self.stream.writable) {
+      self.stream.write(buff)
+    }
+
+    self.attachListeners(self.stream)
+
     self.emit('sslconnect')
@@ -347,2 +363,6 @@ })
   this._ending = true
+  if (!this.stream.writable) {
+    this.stream.end()
+    return
+  }
   return this.stream.write(END_BUFFER, () => {
@@ -349,0 +369,0 @@ this.stream.end()

lib/native/client.js

@@ -92,3 +92,6 @@ 'use strict'
     self.native.connect(conString, function (err) {
-      if (err) return cb(err)
+      if (err) {
+        self.native.end()
+        return cb(err)
+      }
 
@@ -95,0 +98,0 @@ // set internal states to connected

package.json

 {
   "name": "pg",
-  "version": "7.17.1",
+  "version": "7.18.0",
   "description": "PostgreSQL client - pure javascript & libpq with the same API",
@@ -14,3 +14,3 @@ "keywords": [
   ],
-  "homepage": "http://github.com/brianc/node-postgres",
+  "homepage": "https://github.com/brianc/node-postgres",
   "repository": {
@@ -27,3 +27,3 @@ "type": "git",
     "pg-packet-stream": "^1.1.0",
-    "pg-pool": "^2.0.9",
+    "pg-pool": "^2.0.10",
     "pg-types": "^2.1.0",
@@ -58,3 +58,3 @@ "pgpass": "1.x",
   },
-  "gitHead": "5cf8f5f8d7f59d8374180589db1bfa4b06751539"
+  "gitHead": "d9fcda8cf7a3519bde4799039aef94daec3fbef6"
 }

README.md

@@ -72,3 +72,3 @@ # node-postgres
 
-Copyright (c) 2010-2019 Brian Carlson ([e-mail])
+Copyright (c) 2010-2020 Brian Carlson ([e-mail])
 
@@ -75,0 +75,0 @@ Permission is hereby granted, free of charge, to any person obtaining a copy

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

92900

increased by1.22%

Lines of code

2689

increased by0.9%

Dependency changes

• Updatedpg-pool@^2.0.10