As a security professional, I was horrified to find out that the maintainers don't consider this a security issue, though they did promise to take this seriousl

As a security professional, I was horrified to find out that the maintainers don't consider this a security issue, though they did promise to take this seriously and change the API when they were made aware of it in 2014 (https://github.com/mysqljs/mysql/issues/731 https://github.com/mysqljs/mysql/issues/731). So I bumped an issue, noting this is all over HN, and offered to write a pull request for the API change proposed by the maintainers: https://github.com/mysqljs/sqlstring/issues/60 https://github.com/mysqljs/sqlstring/issues/60 Doug agreed to accept such a request, so I just sat down to figure out the code and a reasonable upgrade plan. Three hours later, I could already write Doug this email (pasting it here because the issue and codebase are locked to non-contributors so I had to send it via email): OK, I have a draft pull request ready. Of course, it's a big change and I expect to get a lot of feedback and have a few rounds of back and forth and fixups before it is accepted. This is the plan as I envision it: * Release SqlString 3.0.0 that has a new allowObjectValues parameter defaulting to false. This is a new major, so it shouldn't break anybody's code. * Release mysqljs 2.19.0 (or should it be 2.18.3 for even higher adoption?) that depends on SqlString 3.0.0 but explicitly passes allowObjectValues on every call to it,with a default of true unless the user explicitly set it to false. This is a non-breaking change. This version will also add a deprecation warning whenever a ConnectionConfig is built without explicitly setting allowObjectValues, warning that the default will change in 3.0 and suggesting to set it to false unless it's needed and highlighting the need to typecheck values if it's set to true. * Release mysqljs 3.0 that changes the default and removes the deprecation warning, so new projects get a sane default. This involves, of course, changes to two repositories, so here they are (I can't open pull requests because I have not contributed in the past): https://github.com/SonOfLilit/sqlstring https://github.com/SonOfLilit/sqlstring https://github.com/SonOfLilit/mysql https://github.com/SonOfLilit/mysql (I didn't write the mysqljs3.0 patch yet to make pull request technicalities simpler, but it's trivial) Again, I'm new to this project, am not a javascript developer in my day job, and I expect - and am prepared to handle - nontrivial amounts of feedback and requests for improvement. For a brighter, safer future :-), Aur