From 090f2b993c00b3dc4eb9209014bc5d77fc2a6e24 Mon Sep 17 00:00:00 2001 From: Pierre Merlet Date: Thu, 29 Oct 2026 10:26:55 +0100 Subject: [PATCH] fix(datasource-demo-fintech): bump sqlite3 to ^6.0.1 to drop the vulnerable tar chain sqlite3@5 pulled node-gyp@8 / cacache and tar@6.2.1 (critical advisory, tar <= 7.5.20) into every project generated by projects:create:demo. sqlite3@6 depends on tar ^7.5.10 and no longer needs that chain. Co-Authored-By: Claude Sonnet 5.5 --- packages/datasource-demo-fintech/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/datasource-demo-fintech/package.json b/packages/datasource-demo-fintech/package.json index ceb3d27a0b..59336a62c2 100644 --- a/packages/datasource-demo-fintech/package.json +++ b/packages/datasource-demo-fintech/package.json @@ -16,7 +16,7 @@ "@forestadmin/datasource-sql": "1.17.17", "@forestadmin/datasource-toolkit": "1.56.2", "knex": "^3.1.0", - "sqlite3": "^5.1.7" + "sqlite3": "^6.0.1" }, "files": [ "dist/**/*.js",