[chappie-daemon]

The same bump as #1024, applied to this branch because rewrite/main still declares "knex": "2.4.2" and still imports it at runtime.

AIKIDO-2026-10469: knex 0.0.1–3.2.8 interpolates values passed to searchPath for the Postgres dialect into generated SQL without validating or escaping them, so a value an attacker influences becomes an injected identifier.

Why this branch needs it

knex is not dormant here:

src/@types/base.ts
src/clean-db.ts
src/cli/commands/invite.ts
src/database/client.ts
src/database/transaction.ts
src/scripts/benchmark-queries.ts
crates/nostream-storage/tests/capture/gen-storage-parity.mjs   # require('knex'), knex({ client: 'pg', … })

The TypeScript server and its test:unit suite still run in checks.yml, and the parity generator loads knex to apply the captured migrations.

Version chosen: 3.2.9

The smallest published version containing the fix — #6411, "escape double quotes in searchPath to prevent SQL injection" — and the version the advisory names. 3.2.10 and 3.3.0 add nothing for this advisory.

Breaking changes read from the release notes:

• 3.0.0 — drops Node < 16 (this repo requires >=24.14.1); typing fixes for raw bindings and mixed modules.
• 3.2.0 — RawBinding tightened, "types no longer allow knex to be called without tablename", first on 0 matches documented, migration lifecycle hooks.
• 3.2.9 — the fix, plus a SQLite RETURNING fix and DELETE … LIMIT for MySQL. Neither applies here.

The one code change

src/scripts/benchmark-queries.ts passed bindings as readonly unknown[] to db.raw(); an assertion to unknown no longer satisfies RawBinding. The assertion is dropped because toSQL().bindings is already the accepted type — this removes an assertion rather than adding one:

   const { rows } = await db.raw<{ rows: { 'QUERY PLAN': ExplainResult[] }[] }>(
     `EXPLAIN (ANALYZE, BUFFERS, VERBOSE, FORMAT JSON) ${sql}`,
-    bindings as readonly unknown[],
+    bindings,
   )

Compile-time only: the emitted JavaScript is byte-identical with and without the assertion — sha256sum dist/src/scripts/benchmark-queries.js is df144e2b…df1dda in both builds.

search_path: not used

$ grep -rn "search_path" src/
$ echo "exit=$?"
exit=1

No match anywhere in the repository outside node_modules. The vulnerable path is not reachable here; the bump removes a vulnerable dependency rather than closing a reachable hole.

Verification

$ pnpm run build:check
> nostream@3.4.0 build <repo>
> tsc --project tsconfig.build.json --noEmit

$ pnpm run test:unit
  ws-protocol-probe wire parsing
    ✔ parses JSON array messages from Buffer payloads
    ✔ parses fragmented Buffer array payloads


  2183 passing (23s)

$ pnpm run lint
Checked 494 files in 194ms. No fixes applied.

$ pnpm run check:deps
> knip --config .knip.json --production --include files,dependencies --no-progress --reporter compact

Exits 0 with no output. Resolved dependency:

$ node -p "require('knex/package.json').version"
3.2.9

The docker:test:integration suite needs a real Postgres and is covered by CI's integration job.

Note on the lockfile

knex 3.2.9 declares an optional peer on pg-query-stream ^4.14.0; this repo pins 4.3.0 directly, so pnpm resolves the peer to 4.3.0. The peer is optional (used only by knex's .stream()), the lockfile installs cleanly with --frozen-lockfile, and nothing here calls it. Bumping pg-query-stream is out of scope for a security bump.

Changeset

.changeset/knex-3-2-9-security.md, in this branch's empty-front-matter form.

[changeset-bot]

🦋 Changeset detected

Latest commit: 93d996d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 13ee4155-c7e5-43aa-9d96-b37d85a33c38

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​knex@​2.4.2 ⏵ 3.2.9

View full report

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Upgrades knex from 2.4.2 to 3.2.9 and updates the lockfile.

• Nostream's database tools now use Knex 3.2.9.

Acknowledgment: chappie-daemon explicitly deferred the known pg-query-stream peer mismatch because upgrading it is out of scope for this security update.

_{Reviews (1) · Last reviewed commit: "fix(deps): bump knex to 3.2.9 for the se..." · Reviewed by Greptile}

[coveralls]

Coverage Report for CI Build 41318259154

Coverage decreased (-0.006%) to 73.973%

Details

• Coverage decreased (-0.006%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	10291
Covered Lines:	7992
Line Coverage:	77.66%
Relevant Branches:	5362
Covered Branches:	3587
Branch Coverage:	66.9%
Branches in Coverage %:	Yes
Coverage Strength:	867.55 hits per line

---

💛 - Coveralls

[chappie-daemon]

Superseded by #1035, per Cameri: instead of a per-fix PR onto this branch, main is merged into rewrite/main wholesale. The knex 3.2.9 bump this PR carried is in main via #1024 and arrives on the rewrite branch with that merge — the merged tree reads knex: 3.2.9, so nothing here is lost.