[Snyk] Upgrade dexie from 4.2.1 to 4.4.3#2
Open
sickn33 wants to merge 1 commit into
Open
Conversation
Snyk has created this PR to upgrade dexie from 4.2.1 to 4.4.3. See this package in npm: dexie See this project in Snyk: https://app.eu.snyk.io/org/antigravity-awesome-skills-default/project/badae22a-c3b3-490d-9d87-98a5c3803489?utm_source=github&utm_medium=referral&page=upgrade-pr
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade dexie from 4.2.1 to 4.4.3.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 9 versions ahead of your current version.
The recommended version was released a month ago.
Release notes
Package name: dexie
This is a maintenance release with bug fixes and a configuration API improvement.
Related Package Releases
Bug Fixes
dexie@4.4.3
fix:
delByKeyPath()creates empty intermediate objects on missing path —Dexie.delByKeyPath(obj, "foo.bar")on an object withoutfoowould create{foo: {}}as a side effect instead of doing nothing. This caused a real-world bug in dexie-cloud-addon where clearing a dotted key from a changeSpec (e.g.claims.sub) would leave{claims: {}}in the spec, which then overwrote the inline primary key withundefined, resulting in:DataError: Evaluating the object store's key path did not yield a value. Fixed insetByKeyPathto bail out early when value isundefinedand the intermediate path doesn't exist. (#2303)fix: Collection.sortBy() mutates frozen array in immutable cache mode — calling
.sortBy()on a table when using immutable cache mode could throwTypeError: Cannot assign to read only propertybecauseArray.sort()was called on a frozen array. Fixed by sorting on a copy instead. (#2294)dexie-cloud-addon@4.4.12
rename:
maxStringLength→largeStringThreshold— the string offloading option is renamed for clarity. The old name is kept as a backward-compatible alias. (#2290)fix: blob writebacks routed through BlobSavingQueue to avoid PSD context loss — after an async native
fetch(blob download), Dexie's PSD zone is no longer active, causingtable.mutate()to crash withCannot read properties of undefined (reading 'table'). This surfaced as[dexie-cloud:blobResolve] Failed to resolve BlobRefs. Fixed by always routing blob writebacks throughBlobSavingQueue.saveBlobs(), which opens a proper Dexie rw-transaction in a fresh JS task. Fixes lazy blob mode crash when using Dexie hooks with dexie-cloud-addon. (#2302)fix: eager blob downloader could starve RAM — the eager downloader triggered
blobResolveMiddlewarewhich resolved all pending blobs into memory at once. Fixed by downloading blobs in chunks with a query limit, so memory usage stays bounded regardless of how many blobs are pending. (#2302)fix: in-flight blob downloads are now deduplicated — if a blob is requested after download starts but before it is persisted, the existing download promise is reused instead of starting a new download. (#2302)
fix: use
cache: no-storefor blob fetch requests — avoids the browser caching raw blob responses and double-storing them. (#2302)dexie-cloud-addon@4.4.13
$loginsupdate — when a user received a server update for the$loginstable, dexie-cloud-addon tried to clearclaims.subfrom the changeSpec usingdelByKeyPath. Due to the bug above, this left{claims: {}}in the spec, overwriting the inline primary key withundefinedand causingDataError: Evaluating the object store's key path did not yield a value. Fixed by guarding against empty changeSpec objects after key deletion. (#2304)Other Changes
dexie-observableanddexie-syncableREADME updated to mark them as legacy/unmaintained, with a recommendation to usedexie-cloud-addonfor sync. (#2298)This is a maintenance release containing several bug fixes accumulated since v4.4.1.
Related Package Releases
Bug Fixes
dexie-cloud-addon@4.4.8
Dexie.ignoreTransaction()was called (#2287)9debfc0)configurable: trueto awarenessdefineProperty— fixes compatibility issues with certain bundlers and proxies (#2280)changeSpecsinupdatemutations — incorrect inclusion of primary key could cause sync failures in certain edge cases (#2277)syncStateon logout to prevent spinner — logging out no longer resets sync state, avoiding an unwanted loading spinner on re-login (#2276)wrappedCursor.valuein non-blob and error paths in blob resolve middleware (f470167)dexie-cloud-addon@4.4.10
dexie-cloud-addon@4.4.11
Other Changes
This release introduces Blob Offloading and String Offloading for Dexie Cloud, enabling efficient handling of large binary and text data. It also includes IDB 3.0 optimizations and several bug fixes.
Related Package Releases
New Features
⚡ IDB 3.0 Optimizations
Leverages IndexedDB 3.0
getAll(options)for more efficient key range queries, reducing overhead for collection operations.📦 Blob Offloading for Dexie Cloud
Large binary data (Blob, File, ArrayBuffer, TypedArray) is now automatically offloaded to cloud blob storage during sync. Data is stored normally in IndexedDB — offloading happens transparently during the sync process.
blobMode: 'lazy'to download blobs on-demand instead of eagerly after sync (default is 'eager')db.cloud.blobProgressfor download progressimport dexieCloud from 'dexie-cloud-addon';
const db = new Dexie('mydb', { addons: [dexieCloud] });
db.version(1).stores({ photos: '@ id, title' });
db.cloud.configure({ databaseUrl: '...', blobMode: 'eager' });
// Store binary data — syncs normally, offloads transparently
await db.photos.add({
title: 'Vacation',
image: new Blob([imageData], { type: 'image/jpeg' })
});
📝 String Offloading for Dexie Cloud
Long strings are now offloaded to blob storage during sync, keeping IndexedDB data compact while preserving full string content in the cloud.
maxStringLengthoption (default: 32768 characters)Bug Fixes
Other Changes
v4.4.0
This release introduces Social Authentication for Dexie Cloud, allowing users to sign in with Google, GitHub, Microsoft, Apple, or custom OAuth2 providers as an alternative to email OTP authentication.
Related Package Releases
New Features
🔐 Social Authentication for Dexie Cloud
Dexie Cloud now supports OAuth 2.0 social login providers as an alternative to the existing OTP (One-Time Password) email authentication.
Supported Providers:
The Dexie Cloud server acts as an OAuth broker, handling all provider interactions. The client library never receives provider tokens—only Dexie Cloud authorization codes which are exchanged for Dexie Cloud tokens.
Usage:
Social auth is enabled by default on the client but need to be configured in manager first. When
db.cloud.login()is called, users will see a provider selection dialog if OAuth providers are configured on the server.await db.cloud.login();
// Or specify a provider directly
await db.cloud.login({ provider: 'google' });
Configuration Options:
});">
⚡ Suspense Support in dexie-react-hooks (Experimental)
Requires installation of dexie-react-hooks@4.2.1-beta.1
New experimental hooks for React Suspense integration:
function useYoungFriends(ageLimit: number) {
return useSuspendingLiveQuery(
() => db.friends.where('age').below(ageLimit).toArray(),
["useYoungFriends", ageLimit]
);
}
function MyComponent() {
// Suspends until data is available - no undefined state!
const friends = useYoungFriends(30);
// friends is guaranteed to be defined here
return <FriendList friends={friends} />;
}
// Wrap with Suspense boundary
function App() {
return (
<Suspense fallback={<Loading />}>
<MyComponent />
</Suspense>
);
}
dexie-cloud-addon Changes
New Exports
AuthProvidersResponse- Type for the/auth-providersendpoint responseOAuthProviderInfo- Type for OAuth provider metadataNew API Methods
db.cloud.getAuthProviders()- Fetches available authentication providers from the serverExtended LoginHints Interface for db.cloud.login()
New Configuration Options
// ... existing options ...
/** Enable social/OAuth authentication.
* - true (default): Fetch providers from server, show if available
* - false: Disable OAuth, always use OTP flow
*/
socialAuth?: boolean;
/** Redirect URI for OAuth callback.
* Defaults to window.location.href for web SPAs.
* For Capacitor/native apps, set to a custom URL scheme.
*/
oauthRedirectUri?: string;
}
Default UI Updates
The default login GUI now includes:
Documentation
Migration Notes
This release is fully backward compatible. Social authentication is opt-in and requires server-side configuration of OAuth providers. Existing OTP authentication continues to work as before.
New package versions
dexie
dexie-cloud-addon
y-dexie
Full Changelog: v4.2.0...v4.2.1
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information: