Security fix:
getSub()
now returnsnull
when it encounters a non-"own" property (including__proto__
) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Compatibility changes:
redis
: Thesocket
andclient_options
settings, deprecated since v1.3.1, have been removed.redis
: The client configuration object has changed with the new version of theredis
client library. See theredis
client library documentation for details.
Bug fixes:
redis
: SeveralfindKeys()
fixes.
Updated database dependencies:
redis
: Updatedredis
from 3.1.2 to 4.1.0.
Security fix:
getSub()
now returnsnull
when it encounters a non-"own" property (including__proto__
) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Bug fixes:
- Fixed
findKeys()
calls containing special regular expression characters (applicable to the database drivers that use the glob-to-regex helper function).
Compatibility changes:
- Minimum supported Node.js version is now 14.15.0.
elasticsearch
: New index name and mapping (schema). To automatically copy existing data to the new index when the ueberdb client is initialized, set themigrate_to_newer_schema
option totrue
.- As mentioned in the v2.2.0 changes, passing callbacks to the database methods is deprecated. Use the returned Promises instead.
postgrespool
: As mentioned in the v1.4.15 changes,postgrespool
is deprecated. Usepostgres
instead.redis
: As mentioned in the v1.3.1 changes, thesocket
andclient_options
settings are deprecated. Pass the client options object directly.
Bug fixes:
elasticsearch
: Rewrote driver to fix numerous bugs and modernize the code.
Updated database dependencies:
couch
: Updatednano
to 10.0.0.dirty_git
: Updatedsimple-git
to 3.7.1.elasticsearch
: Switched the client library from the deprecatedelasticsearch
to@elastic/elasticsearch
version 7.17.0.postgres
: Updatedpg
to 8.7.3.sqlite
: Updatedsqlite3
to 5.0.6.
Security fix:
getSub()
now returnsnull
when it encounters a non-"own" property (including__proto__
) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Compatibility changes:
- Passing callbacks to the database methods is deprecated; use the returned Promises instead.
New features:
- Database methods now return a Promise if a callback is not provided.
Bug fixes:
- A call to
flush()
immediately after a call toset()
,setSub()
, orremove()
(within the same ECMAScript macro- or microtask) now flushes the new write operation. - Fixed a bug where
findKeys()
would return stale results when write buffering is enabled and writes are pending. couch
: Rewrote driver to fix numerous bugs.
Security fix:
- Fix
setSub()
prototype pollution vulnerability.
memory
: Newdata
setting that allows users to supply the backing Map object (rather than create a new Map).
Updated database dependencies:
dirty_git
: Updatedsimple-git
to 3.6.0.mssql
: Updatedmssql
to 8.1.0.
- When saving an object that has a
.toJSON()
method, the value returned from that method is saved to the database instead of the object itself. This matches the behavior ofJSON.stringify()
. The.toJSON()
method is used even if the chosen database driver never actually converts anything to JSON. - New
memory
database driver that stores values in memory only.
Updated database (and other) dependencies:
mongodb
: Updatedmongodb
to 3.7.3.mssql
: Updatedmssql
to 7.3.0.dirty_git
: Updatedsimple-git
to 2.47.0.
postgres
: You can now provide a connection string instead of a settings object. For example:const db = new ueberdb.Database('postgres', 'postgres://user:password@host/dbname');
postgres
,postgrespool
: Thepostgrespool
database driver was renamed topostgres
, replacing the oldpostgres
driver. The oldpostgrespool
name is still usable, but is deprecated. For users of the oldpostgres
driver, this change increases the number of concurrent database connections. You may need to increase your configured connection limit.sqlite
: Updatedsqlite3
to 5.0.2.
Updated dependencies:
cassandra
: Updatedcassandra-driver
to 4.6.3.couch
: Updatednano
to 9.0.3.dirty
: Updateddirty
to 1.1.3.dirty_git
: Updatedsimple-git
to 2.45.0.mongodb
: Updatedmongodb
to 3.6.11.mssql
: Updatedmssql
to 7.2.1.postgres
,postgrespool
: Updatedpg
to 8.7.1.
mongodb
: ThedbName
setting has been renamed todatabase
for consistency with other database drivers. ThedbName
setting will continue to work (for backwards compatibility), but it is deprecated and is ignored ifdatabase
is set.mongodb
: Thedatabase
(formerlydbName
) setting is now optional. If it is not specified, the database name embedded in theurl
setting is used.
redis
: Updatedredis
dependency to 3.1.2.
- Each write operation in a bulk write batch is now retried if the bulk write fails.
- Fixed write metrics for
setSub()
read failures.
mysql
: Use a connection pool to improve performance and simplify the code.
mysql
: Reconnect on fatal error.mysql
: Log MySQL errors.
- New experimental setting to limit the number of operations written at a time when flushing outstanding writes.
mysql
: Bulk writes are limited to 100 changes at a time to avoid query timeouts.mysql
: Raised default cache size from 500 entries to 10000.
- Refined the experimental read and write metrics.
- The two callback arguments in
remove()
,set()
, andsetSub()
have changed: Instead of a callback that is called after the write is buffered and another callback that is called after the write is committed, both callbacks are now called after the write is committed. Futhermore, the second callback argument is now deprecated. - Modernized record locking.
- Experimental metrics for reads, writes, and locking.
dirty
: Updateddirty
dependency.
redis
: The database config object is now passed directly to theredis
package. For details, see https://www.npmjs.com/package/redis/v/3.0.2#options-object-properties. Old-style settings objects (where theredis
options are in theclient_options
property) are still supported but deprecated.
dirty
: Workaround for a bug in the upstreamdirty
driver.
redis
: Experimental support for passing the settings object directly to theredis
package.
redis
: Fixed "Callback was already called" exception during init.
- All: Fixed a major bug introduced in v1.1.10 that caused
setSub()
to silently discard changes. - All: Fixed a bug that prevented cache entries from being marked as most recently used.
mssql
: Updatedmssql
dependency.dirty_git
: Updatedsimple-git
dependency.sqlite
: Updatedsqlite3
dependency.
mssql
: Updatedmssql
dependency.
- All: Fixed minor
setSub()
corner cases.
- New
flush()
method. - The
doShutdown()
method is deprecated. Useflush()
instead. - The
close()
method now flushes unwritten entries before closing the database connection. - Bug fix:
null
/undefined
is no longer cached if there is an error reading from the database.
- Major performance improvement: The caching logic was rewritten with much more efficient algorithms. Also: Scans for entries to evict is performed less often. Depending on your workload you might observe a slight memory usage increase.
mysql
dependency bumped to 7.0.0-alpha4 to avoid a security vulnerability in one of its indirect dependencies.
- Bug fix: When write buffering is disabled, reads of keys with values that were changed but not yet written to the underlying database used to return the previous value. Now the updated value is returned.
- Minor performance improvement: Setting a key to the same value no longer triggers a database write.
- Minor performance improvement: Debug log message strings are no longer generated if debug logging is not enabled.
- The
database()
constructor is deprecated; useDatabase()
instead.
See the Git history.