Skip to content

Upgrading pg 1 to 2

Breaking1.3.0 → 2.11.2Breaking2Security1New10Changed4

Full comparisonBack to pg
BreakingUpgrade verdict

2 breaking changes and a security fix.

In plain terms
  • The library no longer converts 64-bit integers from PostgreSQL's binary format on its own; that feature is now a separate add-on.
  • Some database number types now arrive in JavaScript as different types than before, so code that expected the old types may need updating.
  • Remote Code Execution in pg
Must act 3 items need code or config changes

Adds js-string-escape 1.0.1, nan ~0.6.0, pgpass 0.0.1.

Installs 7 packages in all (was 2).

What you must change

Breaking2
Removes built-in support for binary Int64 parsing.
2.3.0CHANGELOG.mdSummarizedView source
Changes default PostgreSQL to JavaScript type conversions for float4, float8, int8, numeric and decimal to avoid data loss.
float4float8int8numericdecimal
2.0.0CHANGELOG.mdSummarizedView source
Security1
Remote Code Execution in pg
Critical · CVSS 9.8
2.11.2GitHub AdvisoryOriginalView source