MariaDB Node.js Connector 3.5.4 and 3.4.7 now available

MariaDB is pleased to announce the immediate availability of the MariaDB Connector/Node.js 3.5.4, 3.4.7, 3.3.4, and 3.2.5 GA releases.

Release Notes

MariaDB Connector/Node.js 3.5.4 is a Stable (GA) release.

Notable changes in this release include:

New maxAllowedColumns option (default 65535), bounding the column count a server may announce for a result-set or a prepared statement. Without it, a rogue server can make the client allocate metadata for a result-set that never completes.
Connection options are merged through the prototype chain instead of being flat-cloned for every command (#353, contribution by erulabs)
Enable standard TLS certificate identity validation under Deno
Add JavaScript SAST (CodeQL and eslint-plugin-security) to CI
Fixes for various issues

Two connection options changed since 3.5.3:

maxAllowedColumns (new, integer, default 65535) — maximum number of columns a server-announced result-set or prepare metadata may declare. The column count is read from the wire before any metadata is allocated for it, so a malicious or man-in-the-middle server announcing an enormous count could otherwise exhaust client memory. A larger count closes the connection with a fatal error instead. The value must be an integer greater than 0.
maxAllowedPacket (default changed) — when the option is not set, the default is now a quarter of the memory available to the process (the cgroup limit when containerized, physical memory otherwise), bounded to [16 MB, 1 GB]. It was previously a fixed 16 MB. The value is also advertised to the server in the handshake response and now bounds packet reassembly on the read side: a server announcing a larger packet is refused rather than growing the reassembly buffer. Set it to the server’s real max_allowed_packet; a lower value rejects legitimate results.

MariaDB Connector/Node.js 3.4.7 is a Stable (GA) release.

Notable changes in this release include: