Security vulnerability in libpq thus dependency tree issue: pg -> pg-native -> libpq

[Leigh-M]

pg depends on pg-native. pg-native has a high severity vulnerability issue with its version of libpq. Thus 'npm audit fix' does not work. Or with '--force' flag breaks the build.

Will install [email protected], which is a breaking change
node_modules/libpq
pg-native *
Depends on vulnerable versions of libpq
node_modules/pg-native
pg >=8.4.0
Depends on vulnerable versions of pg-native
node_modules/pg

Just registering here so it is logged

[brianc]

Oh i see - its a bug in the libpq binding. So type-checking the argument on the JavaScript side before passing this to the C/C++ binding should fix the issue. I'll try to look at this today & get a fix out.