Repository navigation
Bump thrift dependency past GHSA-r67j-r569-jrwp #370
Description
Activity
For clarity GHSA-r67j-r569-jrwp claims that
@databricks/sql@0.23.0thrift@0.23.0is the fixed versionThere is also https://nvd.nist.gov/vuln/detail/CVE-2026-43870, which is also fixed by
@databricks/sql@0.23.0thrift@0.23.0@andyedwardsibm thanks, good call - I'll update the issue. In your comments though, I think you mean to be referencing
thrift@0.23.0rather than@databricks/sql?Oo yes, my bad... fixing
This package is also now affected by GHSA-526f-jxpj-jmg2. Any update on a fix timeline for this?
Reacted by Jorge RamirezAny update on this issue?
Thanks for reporting. This is being actively looked into and should be fixed with PR #390
Hey, 3 weeks later, this is still an issue. Any ETA on when will it be fixed @msrathore-db ?
Hello, any updates on this and when the PR will be merged. We really need the HIGH sevs to be fixed
Here is some more notes of the CVE:
Thanks for reporting. This is being actively looked into and should be fixed with PR #390
@msrathore-db any chance of adding the fix in the next release?
Reacted by Kevin BoutinSo... is v2.0.0 about to be released? Right now, there still isn't a released version of
@databricks/sqlavailable that hasthrift@^0.23.0as a dependency;@databricks/sql@1.17.0still usesthrift@0.16.0working on it
Reacted by Andy Edwards- added a commit that references this issue
on Jul 14, 2026 I had tried updating to 2.0.0 version and while running tests the following issue occured:
.../node_modules/thrift/node_modules/uuid/dist-node/index.js:1 export { default as MAX } from './max.js'; ^^^^^^ SyntaxError: Unexpected token 'export'For more details I had created a ticket.
#461any help would be much appreciated
Summary
@databricks/sqlcurrently pinsthriftat a version that's flagged by GHSA-r67j-r569-jrwp (Apache Thrift Node.js bindings vulnerable to uncontrolled recursion). Downstream consumers runningnpm audit --audit-level=highin CI are now seeing this fail with "No fix available" because the lockfile-resolved thrift version falls inside the advisory's affected range.Can be reproduced in any project that depends on
@databricks/sql@^1.13.0Requested change
Bump the
thriftpeer/runtime dependency in@databricks/sqlto a version outside the advisory range (the next patched release on or after0.23.0)