Skip to content

[Snyk] Fix for 3 vulnerabilities #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@
"@midwayjs/cross-domain": "^3.12.10",
"@midwayjs/decorator": "^3.12.3",
"@midwayjs/i18n": "3.13.7",
"@midwayjs/koa": "^3.12.0",
"@midwayjs/koa": "^4.0.0",

@cursor cursor Bot Mar 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Major version bump breaks compatibility with v3 ecosystem

High Severity

Upgrading @midwayjs/koa from v3 to ^4.0.0 while all other @midwayjs/* packages remain at v3 will break the application. The official Midway v4 migration guide requires upgrading all packages together (@midwayjs/core, @midwayjs/bootstrap, @midwayjs/decorator, @midwayjs/mock, etc.) to v4 simultaneously. Additionally, @midwayjs/koa v4 pulls in koa@3.0.3 (up from v2), and the project's @types/koa at ^2.13.12 conflicts with the bundled @types/koa@3.0.0. Midway v4 also requires Node.js v20+, but the project declares >=18.0.0. The Snyk metadata itself flags isBreakingChange: true.

Additional Locations (1)
Fix in Cursor Fix in Web

@devin-ai-integration devin-ai-integration Bot Mar 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Major version mismatch: @midwayjs/koa v4 paired with all other @midwayjs/ packages at v3*

Upgrading @midwayjs/koa to ^4.0.0 while keeping every other @midwayjs/* package on v3 (@midwayjs/core: ^3.13.0, @midwayjs/bootstrap: ^3.12.5, @midwayjs/mock: ^3.12.10, @midwayjs/cross-domain: ^3.12.10, @midwayjs/bull: 3, @midwayjs/mongoose: 3, @midwayjs/redis: 3, @midwayjs/validate: 3, @midwayjs/i18n: 3.13.7, @midwayjs/decorator: ^3.12.3) creates a cross-major-version mismatch. Per the yarn.lock, @midwayjs/koa@4.0.0 depends on koa@3.0.3, whereas all the v3 midway ecosystem packages were built and tested against koa v2. This will likely cause runtime incompatibilities across middleware, filters, and the test harness (the test files at test/user/user.entity.test.ts:2 and test/user/user.controller.test.ts:2 import { Application, Framework } from @midwayjs/koa, which may not be compatible with the v4 API). All @midwayjs/* packages should be upgraded to v4 together, or @midwayjs/koa should remain on v3.

Prompt for agents 
In package.json line 16, either revert @midwayjs/koa back to ^3.12.0 to match all other @midwayjs/* packages at v3, or upgrade ALL @midwayjs/* dependencies (core, bootstrap, bull, cross-domain, decorator, i18n, mongoose, redis, validate, mock, cli) to their v4 equivalents simultaneously. The midway framework expects all its packages to be on the same major version. Additionally, if upgrading to v4, update @types/koa in devDependencies from ^2.13.12 to match the v3 koa types that @midwayjs/koa@4 depends on.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

"@midwayjs/logger": "^2.19.3",
"@midwayjs/mongoose": "3",
"@midwayjs/redis": "3",
"@midwayjs/validate": "3",
"@typegoose/typegoose": "^11.7.1",
"dotenv": "^16.3.1",
"glob": "^10.3.10",
"lint-staged": "^15.2.2",
"lint-staged": "^15.4.2",
"lodash": "^4.17.21",
"mongoose": "^7.0.0",
"mongoose-delete": "^1.0.1",
Expand Down
Loading
Loading