[Snyk] Upgrade typeorm from 0.2.24 to 0.3.31

[andreiraca]

Snyk has created this PR to upgrade typeorm from 0.2.24 to 0.3.31.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 770 versions ahead of your current version.

• The recommended version was released 23 days ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	SQL Injection SNYK-JS-TYPEORM-17391479	218	No Known Exploit
	Prototype Pollution SNYK-JS-TYPEORM-590152	218	Mature
	Arbitrary Code Injection SNYK-JS-TYPEORM-18170276	218	Proof of Concept
	SQL Injection SNYK-JS-TYPEORM-13746469	218	Proof of Concept
	Function Call With Incorrect Argument Type SNYK-JS-SHAJS-12089400	218	Proof of Concept
	Prototype Pollution SNYK-JS-HIGHLIGHTJS-1045326	218	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-HIGHLIGHTJS-1048676	218	No Known Exploit

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: typeorm

• 0.3.31 - 2026-07-13
  

  Bug Fixes

  • cache: release query runner on error in storeInCache (#12545) (a84b9b3)
  • correct grammar in AlreadyHasActiveConnectionError message (#12554) (304d129)
  • entity-manager: default invalidWhereValuesBehavior to throw on the write path (#12690) (44d8052)
  • entity-manager: validate where criteria in increment/decrement (#12692) (8a51b75)
  • mongodb: use cursor.transform for doc to entity transformation and skip load broadcast in next if toArray (#11926) (0bbefc9)
  • move hashing function to PlatformTools (#12648) (c456cbd)
  • multiple recursive cte problems (#12490) (7c26654)
  • normalization of FindOptionsWhere for arrays and Buffers (#12577) (a8173fc)
  • persistence: preserve select false columns on the in-memory entity after save() (#12501) (324c46c)
  • postgres: improve normalizeDatetimeFunction for tstzrange data type (#12182) (bf47c9f)
  • query-builder: reject empty where criteria on update and delete operations (#12629) (81b9466)
  • query-builder: wrap inner joins under left joins correctly (#11137) (d5f4b9d)
  • remove require() calls that break bundlers (#12647) (30f9fc7)
  • tree-entity: tree entity schema propagation in internal TreeRepository methods (#12590) (7fb7c2c)

  Full Changelog: 0.3.30...0.3.31

• 0.3.30 - 2026-05-18
  

  What's Changed

  • fix: scope invalidWhereValuesBehavior to high-level abstractions only by @ naorpeled in #11878
  • fix: scope computed-columns join to correct table in MSSQL schema query by @ PreAgile in #12288
  • fix: preserve user-defined shared join columns in change set by @ PreAgile in #12354
  • revert: fix up limit with joins by @ alumni
  • fix(find-options): allow array values in JsonContains by @ kyungseopk1m in #12420
  • fix(cockroachdb): adjust join in loadTables to load correct table columns by @ Cprakhar in #12413
  • ci: use the v0.3 branch as base for detect-changes by @ alumni
  • chore(release): release 0.3.30 by @ alumni in #12511

  Full Changelog: 0.3.29...0.3.30

• 0.3.29 - 2026-05-08
  

  What's Changed

  • fix: fix up aggregate methods ambiguous column by @ Cprakhar in #11822
  • fix: prevent eager-loaded entities from overwriting manual relations by @ LeviHeber in #11267
  • fix: release query runner when there is no migration to revert by @ mjr128 in #11232
  • fix: add async to the method using setFindOptions() by @ bindon in #10787
  • chore: disable eslint errors for chai assertions by @ alumni in #11833
  • ci(tests): Remove limitation of branches to run on by @ OSA413 in #11794
  • ci: upgrade actions to v6 by @ pkuczynski in #11844
  • docs(v0.3): add version dropdown (stable/dev) by @ naorpeled in #11863
  • fix(sap): QueryBuilder parameter of type JS Date not escaped correctly by @ alumni in #11867
  • feat(sap): add pool timeout by @ alumni in #11868
  • feat(qodo): enable new review experience in v0.3 by @ naorpeled in #11910
  • feat: add returning option to update/upsert operations by @ naorpeled in #11782
  • test: enable repository-returning test by @ gioboa in #11913
  • chore(qodo): disable in progress notification in v0.3 by @ naorpeled in #11928
  • ci(docs): add deploy Github Action to v0.3 branch by @ naorpeled in #11929
  • chore(qodo): disable persistent comments and inline code suggestions in v0.3 by @ naorpeled in #11989
  • chore(deps): update all dependencies to the latest minor version by @ alumni in #12015
  • fix(redis): redis cache version detection by @ mguida22 in #11936
  • ci: remove summary comments location policy by @ naorpeled in #12117
  • ci(qodo): remove /improve from pr and push commands by @ naorpeled in #12129
  • ci: migrate from npm to pnpm by @ pkuczynski in #12193
  • ci(qodo): sync qodo pr agent config from master by @ naorpeled in #12265
  • ci: remove docs indexing by @ alumni in #12435
  • fix(security): validate limit() in Update/SoftDelete query builders by @ smith-xyz in #12437
  • chore(deps): update all minor by @ alumni in #12443
  • chore(release): release 0.3.29 by @ michaelbromley in #12442

  New Contributors

  • @ LeviHeber made their first contribution in #11267
  • @ mjr128 made their first contribution in #11232
  • @ bindon made their first contribution in #10787

  Full Changelog: 0.3.28...0.3.29

• 0.3.29-dev.cc07c90 - 2025-12-06
• 0.3.29-dev.a46eb0a - 2025-12-06
• 0.3.29-dev.73fda41 - 2025-12-03
• 0.3.29-dev.6e34756 - 2025-12-04
• 0.3.29-dev.514e3d8 - 2025-12-08
• 0.3.29-dev.2d8c515 - 2025-12-05
• 0.3.29-dev.2133c97 - 2025-12-08
• 0.3.28 - 2025-12-03
  

  What's Changed

  • build(deps): bump brace-expansion from 2.0.1 to 2.0.2 in /sample/playground by @ dependabot[bot] in #11522
  • chore: update dependencies by @ alumni in #11666
  • chore: fix package preview by @ alumni in #11542
  • fix: add multiSubnetFailover to mssql driver option types by @ isaru66 in #10804
  • ci: introduce jsdoc eslint plugin (warnings only) by @ pkuczynski in #11681
  • feat: add support for jsonpath column type in PostgreSQL by @ pkuczynski in #11684
  • feat: entity schema support trees by @ wszgrcy in #11606
  • ci: remove close stale issues GH action by @ gioboa in #11696
  • docs: remove unused docs example file by @ pkuczynski in #11675
  • docs: updated jsdoc link to PostgreSQL documentation for data types by @ pkuczynski in #11680
  • ci: bump actions/setup-node to v5 and benefit from automatic caching by @ pkuczynski in #11709
  • feat(cli/init): pick dependencies versions from our own package.json by @ pkuczynski in #11705
  • chore(lint/jsdoc): enable jsdoc/valid-types rule and fix offenses by @ pkuczynski in #11706
  • chore(docs): ehnance llms.txt by @ naorpeled in #11711
  • ci: bump actions/checkout version by @ gioboa in #11712
  • ci: harmonize MongoDB version used in CI, local development environment and init command and bump to v8 by @ pkuczynski in #11704
  • docs: remove contradictory statement in Active Record/Data Mapper guide by @ ericmorand in #11722
  • Fix typos in documentation / hacktoberfest by @ survivant in #11713
  • MongoDB connector now includes SOCKS5 proxy settings by @ Kumar-Kishan in #11731
  • docs: fix link to email, when vulnerability found by @ pkuczynski in #11667
  • style: remove commented out code in FindOptionsUtils by @ DeeprajPandey in #11721
  • docs: collect all migrations documentation in one place by @ pkuczynski in #11674
  • lint: fix offenses for @ typescript-eslint/no-unused-vars rule in samples folder by @ pkuczynski in #11757
  • lint: fix offenses for @ typescript-eslint/no-unused-vars rule in tests folder by @ pkuczynski in #11755
  • docs: fix typos in the js documentation by @ pkuczynski in #11754
  • fix: circular import in SapDriver.ts by @ abendi in #11750
  • chore(dev-deps): bump eslint and update config by @ pkuczynski in #11756
  • docs: fix broken migration links by @ mguida22 in #11760
  • ci: test if docs build and run task depending on the changes from PR by @ pkuczynski in #11761
  • ci: control development and CI version of Node.js via .nvmrc by @ pkuczynski in #11708
  • ci: add single step to validate if all tests passed by @ pkuczynski in #11763
  • ci: prevent running docs index on forks by @ pkuczynski in #11762
  • feat(mssql): support 'vector' type for MS SQL Server by @ artiz in #11732
  • docs: expand sponsors section and remove outdated translations by @ dlhck in #11771
  • docs(cockroach): fix typo in CockroachDriver jsdoc for mappedDataTypes by @ Edge-Seven in #11775
  • ci: migrate from nyc to c8 by @ pkuczynski in #11759
  • fix(deps): upgrade glob to fix CVE-2025-64756 by @ PabloThiele in #11784
  • build(deps): bump js-yaml in /docs by @ dependabot[bot] in #11779
  • ci: run tests on commits to master and next by @ mguida22 in #11783
  • docs: fix build status badge url by @ pkuczynski in #11790
  • chore: add GitHub Copilot instructions by @ Copilot in #11781
  • feat: export QueryPartialEntity and QueryDeepPartialEntity types by @ danielsharvey in #11748
  • ci(oracle): add extra sleep after container starts by @ OSA413 in #11795
  • chore: add Qodo config by @ naorpeled in #11791
  • feat: init version in postgres driver only if not set by @ hfhchan-plb in #11373
  • fix(cli): init command reading package.json from two folders up by @ pkuczynski in #11789
  • feat(mysql): add support for vector columns on MariaDB and MySQL by

[andreiraca]

The upgrade from TypeORM version 0.2.24 to 0.3.31 is a major version jump that introduces significant and numerous breaking changes. This is not a simple upgrade and will require substantial code refactoring, particularly around database connection and data access patterns.

Key Breaking Changes:

• DataSource API: The most significant change is the deprecation of createConnection() and getConnection(). You must now initialize and manage your database connection using the new DataSource object. This impacts how the application starts and how database configuration is handled.
• Repository and Method Deprecations: Several widely-used methods have been deprecated or removed. getRepository() is deprecated, and methods like findOne(id) have had their signatures changed. The findAndCount method has been removed entirely and must be replaced with separate find and count calls.
• Configuration Files: Support for ormconfig.json is deprecated. Configuration should be managed within the DataSource options object, typically in a datasource.ts file.
• Query and Find Options: The join option within FindOptions (used in find methods) is deprecated. Complex queries with joins must now be written using the QueryBuilder.
• CLI and Migrations: The command-line interface has been updated to work with the new DataSource configuration, requiring changes to package.json scripts for generating and running migrations.

Source: TypeORM Changelog, Migration discussions

Recommendation: This upgrade cannot be merged without a dedicated refactoring effort. Developers must carefully follow a migration guide to transition from the old connection and repository patterns to the new DataSource-centric approach. All database queries, especially those involving joins or deprecated methods, will need to be reviewed and updated.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.