[meta] - can we cut a new release with the node-pre-gyp bump?

[spanishpear]

Heya!

In #440 we updated node-pre-gyp to reduce downstream dependencies of node-odbc

Any chance we could get an npm release in the new year with these changes? Would really appreciate it 💟
Happy to help with any appropriate PR's

Thanks!

Originally posted by @spanishpear in #440 (comment)

[BrendanC23]

+1 When running npm audit, I am getting the error

node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization - GHSA-8qq5-rm4j-mr97
Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS - GHSA-r6q2-hw4h-h46w
@mapbox/node-pre-gyp <=1.0.11
Depends on vulnerable versions of tar

[alexantoniogonzalez2]

@kadler @spanishpear hi guys, just trying to bring your attention for this issue. A new release would help to mitigate tar vulnerabilities introduced by node-pre-gyp. Thanks.

[lukaselmer]

@kadler @spanishpear can we create a release please? Even an RC release would help us a lot:

npm publish --tag rc

Thanks! 🙏🙏🙏

[lukaselmer]

#436 and #440 should still be open until there is a new release

[Janmroca]

Any news on this? Last release was more than a year ago...

I have changed my odbc dependency to point to the last commit in the main branch for now, at least it solved a bunch of CVEs, but I don't love this approach.

[abmusse]

We are working through updating the CI to use NPM trusted publishing. Should be cutting a release soon.

[lukaselmer]

We are working through updating the CI to use NPM trusted publishing. Should be cutting a release soon.

@abmusse I improved a couple of things in my fork https://github.com/lukaselmer/node-odbc, including trusted publishing, updating/replacing some dependencies, etc. Feel free to cherry-pick the trusted publishing from my fork. Would you be interested in pulling some of these changes back to this repo?

[abmusse]

Thanks, @lukaselmer I think we've got the Trusted Publisher setup mostly figured out we've currently just got some permission issues with action that generates the Github release.

As for your other changes, we would definitely be open review your changes via PR!

[kadler]

2.5.0 has been released: https://www.npmjs.com/package/odbc/v/2.5.0