Security fix:
getSub()now returnsnullwhen it encounters a non-"own" property (including__proto__) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Compatibility changes:
redis: Thesocketandclient_optionssettings, deprecated since v1.3.1, have been removed.redis: The client configuration object has changed with the new version of theredisclient library. See theredisclient library documentation for details.
Bug fixes:
redis: SeveralfindKeys()fixes.
Updated database dependencies:
redis: Updatedredisfrom 3.1.2 to 4.1.0.
Security fix:
getSub()now returnsnullwhen it encounters a non-"own" property (including__proto__) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Bug fixes:
- Fixed
findKeys()calls containing special regular expression characters (applicable to the database drivers that use the glob-to-regex helper function).
Compatibility changes:
- Minimum supported Node.js version is now 14.15.0.
elasticsearch: New index name and mapping (schema). To automatically copy existing data to the new index when the ueberdb client is initialized, set themigrate_to_newer_schemaoption totrue.- As mentioned in the v2.2.0 changes, passing callbacks to the database methods is deprecated. Use the returned Promises instead.
postgrespool: As mentioned in the v1.4.15 changes,postgrespoolis deprecated. Usepostgresinstead.redis: As mentioned in the v1.3.1 changes, thesocketandclient_optionssettings are deprecated. Pass the client options object directly.
Bug fixes:
elasticsearch: Rewrote driver to fix numerous bugs and modernize the code.
Updated database dependencies:
couch: Updatednanoto 10.0.0.dirty_git: Updatedsimple-gitto 3.7.1.elasticsearch: Switched the client library from the deprecatedelasticsearchto@elastic/elasticsearchversion 7.17.0.postgres: Updatedpgto 8.7.3.sqlite: Updatedsqlite3to 5.0.6.
Security fix:
getSub()now returnsnullwhen it encounters a non-"own" property (including__proto__) or any non-object while walking the given property path. This should make it easier to avoid accidental prototype pollution vulnerabilities.
Compatibility changes:
- Passing callbacks to the database methods is deprecated; use the returned Promises instead.
New features:
- Database methods now return a Promise if a callback is not provided.
Bug fixes:
- A call to
flush()immediately after a call toset(),setSub(), orremove()(within the same ECMAScript macro- or microtask) now flushes the new write operation. - Fixed a bug where
findKeys()would return stale results when write buffering is enabled and writes are pending. couch: Rewrote driver to fix numerous bugs.
Security fix:
- Fix
setSub()prototype pollution vulnerability.
memory: Newdatasetting that allows users to supply the backing Map object (rather than create a new Map).
Updated database dependencies:
dirty_git: Updatedsimple-gitto 3.6.0.mssql: Updatedmssqlto 8.1.0.
- When saving an object that has a
.toJSON()method, the value returned from that method is saved to the database instead of the object itself. This matches the behavior ofJSON.stringify(). The.toJSON()method is used even if the chosen database driver never actually converts anything to JSON. - New
memorydatabase driver that stores values in memory only.
Updated database (and other) dependencies:
mongodb: Updatedmongodbto 3.7.3.mssql: Updatedmssqlto 7.3.0.dirty_git: Updatedsimple-gitto 2.47.0.
postgres: You can now provide a connection string instead of a settings object. For example:const db = new ueberdb.Database('postgres', 'postgres://user:password@host/dbname');
postgres,postgrespool: Thepostgrespooldatabase driver was renamed topostgres, replacing the oldpostgresdriver. The oldpostgrespoolname is still usable, but is deprecated. For users of the oldpostgresdriver, this change increases the number of concurrent database connections. You may need to increase your configured connection limit.sqlite: Updatedsqlite3to 5.0.2.
Updated dependencies:
cassandra: Updatedcassandra-driverto 4.6.3.couch: Updatednanoto 9.0.3.dirty: Updateddirtyto 1.1.3.dirty_git: Updatedsimple-gitto 2.45.0.mongodb: Updatedmongodbto 3.6.11.mssql: Updatedmssqlto 7.2.1.postgres,postgrespool: Updatedpgto 8.7.1.
mongodb: ThedbNamesetting has been renamed todatabasefor consistency with other database drivers. ThedbNamesetting will continue to work (for backwards compatibility), but it is deprecated and is ignored ifdatabaseis set.mongodb: Thedatabase(formerlydbName) setting is now optional. If it is not specified, the database name embedded in theurlsetting is used.
redis: Updatedredisdependency to 3.1.2.
- Each write operation in a bulk write batch is now retried if the bulk write fails.
- Fixed write metrics for
setSub()read failures.
mysql: Use a connection pool to improve performance and simplify the code.
mysql: Reconnect on fatal error.mysql: Log MySQL errors.
- New experimental setting to limit the number of operations written at a time when flushing outstanding writes.
mysql: Bulk writes are limited to 100 changes at a time to avoid query timeouts.mysql: Raised default cache size from 500 entries to 10000.
- Refined the experimental read and write metrics.
- The two callback arguments in
remove(),set(), andsetSub()have changed: Instead of a callback that is called after the write is buffered and another callback that is called after the write is committed, both callbacks are now called after the write is committed. Futhermore, the second callback argument is now deprecated. - Modernized record locking.
- Experimental metrics for reads, writes, and locking.
dirty: Updateddirtydependency.
redis: The database config object is now passed directly to theredispackage. For details, see https://www.npmjs.com/package/redis/v/3.0.2#options-object-properties. Old-style settings objects (where theredisoptions are in theclient_optionsproperty) are still supported but deprecated.
dirty: Workaround for a bug in the upstreamdirtydriver.
redis: Experimental support for passing the settings object directly to theredispackage.
redis: Fixed "Callback was already called" exception during init.
- All: Fixed a major bug introduced in v1.1.10 that caused
setSub()to silently discard changes. - All: Fixed a bug that prevented cache entries from being marked as most recently used.
mssql: Updatedmssqldependency.dirty_git: Updatedsimple-gitdependency.sqlite: Updatedsqlite3dependency.
mssql: Updatedmssqldependency.
- All: Fixed minor
setSub()corner cases.
- New
flush()method. - The
doShutdown()method is deprecated. Useflush()instead. - The
close()method now flushes unwritten entries before closing the database connection. - Bug fix:
null/undefinedis no longer cached if there is an error reading from the database.
- Major performance improvement: The caching logic was rewritten with much more efficient algorithms. Also: Scans for entries to evict is performed less often. Depending on your workload you might observe a slight memory usage increase.
mysqldependency bumped to 7.0.0-alpha4 to avoid a security vulnerability in one of its indirect dependencies.
- Bug fix: When write buffering is disabled, reads of keys with values that were changed but not yet written to the underlying database used to return the previous value. Now the updated value is returned.
- Minor performance improvement: Setting a key to the same value no longer triggers a database write.
- Minor performance improvement: Debug log message strings are no longer generated if debug logging is not enabled.
- The
database()constructor is deprecated; useDatabase()instead.
See the Git history.