Skip to content

[Snyk] Fix for 2 vulnerabilities #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
revan-zhang wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,11 @@
"@faker-js/faker": "^8.3.1",
"@midwayjs/bootstrap": "^3.12.5",
"@midwayjs/bull": "3",
"@midwayjs/core": "^3.13.0",
"@midwayjs/core": "^4.0.3",
"@midwayjs/cross-domain": "^3.12.10",
"@midwayjs/decorator": "^3.12.3",
"@midwayjs/i18n": "3.13.7",
"@midwayjs/koa": "^3.12.0",
"@midwayjs/koa": "^4.0.0",
Comment on lines +12 to +16

@devin-ai-integration devin-ai-integration Bot Apr 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Partial Midway v3→v4 upgrade installs two copies of @midwayjs/core, breaking dependency injection

Only @midwayjs/core and @midwayjs/koa are upgraded to v4, while all other @midwayjs/* packages remain on v3. This causes two separate versions of @midwayjs/core to be installed simultaneously (confirmed in yarn.lock: both @midwayjs/core@3.13.0 and @midwayjs/core@4.0.3). Specifically, @midwayjs/decorator@3.13.0 depends on @midwayjs/core@^3.13.0, pulling in the v3 copy. Since decorators like @Controller, @Inject, @Provide (used throughout src/) register metadata against the v3 core instance, but the application framework (@midwayjs/koa@4.0.3) and configuration use the v4 core instance, the IoC container will not see the registered components. Additionally, bootstrap.js uses @midwayjs/bootstrap@3.13.0 (still v3) to start the app, further mixing v3 and v4 runtime contexts. The remaining v3 packages that need upgrading include: @midwayjs/bootstrap, @midwayjs/bull, @midwayjs/cross-domain, @midwayjs/decorator, @midwayjs/i18n, @midwayjs/mongoose, @midwayjs/redis, @midwayjs/validate, and @midwayjs/mock.

Prompt for agents 
The PR upgrades @midwayjs/core and @midwayjs/koa to v4 but leaves all other @midwayjs/* packages on v3. This creates two copies of @midwayjs/core in the dependency tree (v3.13.0 via @midwayjs/decorator, and v4.0.3 direct), which breaks the IoC container since decorators register metadata against the wrong core instance.

To fix this, either:
1. Upgrade ALL @midwayjs/* packages to their v4 equivalents (bootstrap, bull, cross-domain, decorator, i18n, mongoose, redis, validate, mock, cli) following the official Midway v4 migration guide. Some packages may have been renamed, merged, or deprecated in v4.
2. Or revert core and koa back to v3 if the full migration is not yet ready.

Key packages in package.json that need v4 versions: @midwayjs/bootstrap, @midwayjs/bull, @midwayjs/cross-domain, @midwayjs/decorator, @midwayjs/i18n, @midwayjs/mongoose, @midwayjs/redis, @midwayjs/validate (dependencies), and @midwayjs/mock, @midwayjs/cli (devDependencies). Note that in Midway v4, @midwayjs/decorator may have been merged into @midwayjs/core, so the separate decorator dependency might need to be removed entirely.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

"@midwayjs/logger": "^2.19.3",
"@midwayjs/mongoose": "3",
"@midwayjs/redis": "3",
Expand Down
Loading
Loading