[Snyk] Security upgrade typeorm from 0.2.24 to 0.3.31

[saumilmac]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Arbitrary Code Injection SNYK-JS-TYPEORM-18170276	758

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection

[saumilmac]

The upgrade from TypeORM version 0.2.24 to 0.3.31 is a major version jump that introduces significant and numerous breaking changes. This is not a simple upgrade and will require substantial code refactoring, particularly around database connection and data access patterns.

Key Breaking Changes:

• DataSource API: The most significant change is the deprecation of createConnection() and getConnection(). You must now initialize and manage your database connection using the new DataSource object. This impacts how the application starts and how database configuration is handled.
• Repository and Method Deprecations: Several widely-used methods have been deprecated or removed. getRepository() is deprecated, and methods like findOne(id) have had their signatures changed. The findAndCount method has been removed entirely and must be replaced with separate find and count calls.
• Configuration Files: Support for ormconfig.json is deprecated. Configuration should be managed within the DataSource options object, typically in a datasource.ts file.
• Query and Find Options: The join option within FindOptions (used in find methods) is deprecated. Complex queries with joins must now be written using the QueryBuilder.
• CLI and Migrations: The command-line interface has been updated to work with the new DataSource configuration, requiring changes to package.json scripts for generating and running migrations.

Source: TypeORM Changelog, Migration discussions

Recommendation: This upgrade cannot be merged without a dedicated refactoring effort. Developers must carefully follow a migration guide to transition from the old connection and repository patterns to the new DataSource-centric approach. All database queries, especially those involving joins or deprecated methods, will need to be reviewed and updated.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.