mssql 11.0.0 → 11.0.2

package/README.md

@@ -1,16 +1,31 @@
 # node-mssql
 
-Microsoft SQL Server client for Node.js
+**Microsoft SQL Server client for Node.js**
 
-[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Appveyor CI][appveyor-image]][appveyor-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+[![NPM Version][npm-image]][npm-url] [![NPM Downloads][downloads-image]][downloads-url] [![Join the chat at https://gitter.im/patriksimek/node-mssql](https://badges.gitter.im/Join%20Chat.svg)](https://gitter.im/patriksimek/node-mssql?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 
 Supported TDS drivers:
+
 - [Tedious][tedious-url] (pure JavaScript - Windows/macOS/Linux, default)
-- [Microsoft / Contributors Node V8 Driver for Node.js for SQL Server][msnodesqlv8-url] (v2 native - Windows or Linux/macOS 64 bits only)
+- [MSNodeSQLv8][msnodesqlv8-url] (Microsoft / Contributors Node V8 Driver for Node.js for SQL Server, v2 native - Windows or Linux/macOS 64 bits only)
 
 ## Installation
 
-    npm install mssql
+### Tedious driver (default)
+
+```
+npm install mssql
+```
+
+### MSNodeSQLv8 driver (optional)
+
+```
+npm install mssql msnodesqlv8
+```
+
+## SQL Server prerequisites
+
+This package requires TCP/IP to connect to SQL Server, and you may need to enable this in your installation.
 
 ## Short Example: Use Connect String
 
@@ -68,6 +83,32 @@ const sqlConfig = {
 })()
 ```
 
+## Windows Authentication Example Using MSNodeSQLv8
+
+```javascript
+const sql = require('mssql/msnodesqlv8');
+
+const config = {
+  server: "MyServer",
+  database: "MyDatabase",
+  options: {
+    trustedConnection: true, // Set to true if using Windows Authentication
+    trustServerCertificate: true, // Set to true if using self-signed certificates
+  },
+  driver: "msnodesqlv8", // Required if using Windows Authentication
+};
+
+(async () => {
+  try {
+    await sql.connect(config);
+    const result = await sql.query`select TOP 10 * from MyTable`;
+    console.dir(result);
+  } catch (err) {
+    console.error(err);
+  }
+})();
+```
+
 ## Documentation
 
 ### Examples
@@ -87,7 +128,7 @@ const sqlConfig = {
 ### Drivers
 
 * [Tedious](#tedious)
-* [Microsoft / Contributors Node V8 Driver for Node.js for SQL Server](#microsoft--contributors-node-v8-driver-for-nodejs-for-sql-server)
+* [MSNodeSQLv8](#msnodesqlv8)
 
 ### Connections
 
@@ -109,6 +150,13 @@ const sqlConfig = {
 * [bulk](#bulk-table-options-callback)
 * [cancel](#cancel)
 
+### Identifier rules
+
+* [Parameter names](#parameter-names)
+* [Column names](#column-names)
+* [Type names and sizes](#type-names-and-sizes)
+* [Procedure names](#procedure-names)
+
 ### Transactions
 
 * [Transaction](#transaction)
@@ -174,16 +222,16 @@ const sql = require('mssql')
         let result1 = await pool.request()
             .input('input_parameter', sql.Int, value)
             .query('select * from mytable where id = @input_parameter')
-            
+
         console.dir(result1)
-    
+
         // Stored procedure
-        
+
         let result2 = await pool.request()
             .input('input_parameter', sql.Int, value)
             .output('output_parameter', sql.VarChar(50))
             .execute('procedure_name')
-        
+
         console.dir(result2)
     } catch (err) {
         // ... error checks
@@ -208,7 +256,7 @@ sql.on('error', err => {
 
 sql.connect(config).then(pool => {
     // Query
-    
+
     return pool.request()
         .input('input_parameter', sql.Int, value)
         .query('select * from mytable where id = @input_parameter')
@@ -229,9 +277,9 @@ sql.on('error', err => {
 })
 
 sql.connect(config).then(pool => {
-    
+
     // Stored procedure
-    
+
     return pool.request()
         .input('input_parameter', sql.Int, value)
         .output('output_parameter', sql.VarChar(50))
@@ -263,7 +311,7 @@ sql.on('error', err => {
 })
 ```
 
-All values are automatically sanitized against sql injection. 
+All values are automatically sanitized against sql injection.
 This is because it is rendered as prepared statement, and thus all limitations imposed in MS SQL on parameters apply.
 e.g. Column names cannot be passed/set in statements using variables.
 
@@ -580,7 +628,7 @@ In addition to configuration object there is an option to pass config as a conne
 ```
 Server=localhost,1433;Database=database;User Id=username;Password=password;Encrypt=true
 ```
-###### Standard configuration using msnodesqlv8 driver
+###### Standard configuration using MSNodeSQLv8 driver
 ```
 Driver=msnodesqlv8;Server=(local)\INSTANCE;Database=database;UID=DOMAIN\username;PWD=password;Encrypt=true
 ```
@@ -648,12 +696,21 @@ On top of the extra options, an `authentication` property can be added to the po
 - **authentication** - An object with authentication settings, according to the [Tedious Documentation](https://tediousjs.github.io/tedious/api-connection.html). Passing this object will override `user`, `password`, `domain` settings.
 - **authentication.type** - Type of the authentication method, valid types are `default`, `ntlm`, `azure-active-directory-password`, `azure-active-directory-access-token`, `azure-active-directory-msi-vm`, or `azure-active-directory-msi-app-service`
 - **authentication.options** - Options of the authentication required by the `tedious` driver, depends on `authentication.type`. For more details, check [Tedious Authentication Interfaces](https://github.com/tediousjs/tedious/blob/v11.1.1/src/connection.ts#L200-L318)
+- `tedious` does not support Windows Authentication/Trusted Connection, however the `msnodesqlv8` driver does.
 
 More information about Tedious specific options: http://tediousjs.github.io/tedious/api-connection.html
 
-### Microsoft / Contributors Node V8 Driver for Node.js for SQL Server
+___
+
+### MSNodeSQLv8
 
-**Requires Node.js v10+ or newer. Windows 32-64 bits or Linux/macOS 64 bits only.** This driver is not part of the default package and must be installed separately by `npm install msnodesqlv8@^2`. To use this driver, use this require syntax: `const sql = require('mssql/msnodesqlv8')`.
+Alternative driver, requires Node.js v10+ or newer; Windows (32 or 64-bit) or Linux/macOS (64-bit only). It's not part of the default package so it must be [installed](#msnodesqlv8-driver) in addition. Supports [Windows/Trusted Connection authentication](#windows-authentication-example-using-msnodesqlv8).
+
+**To use this driver you must use this `require` statement:**
+
+```javascript
+const sql = require('mssql/msnodesqlv8')
+```
 
 Note: If you use import into your lib to prepare your request (`const { VarChar } = require('mssql')`) you also need to upgrade all your types import into your code (`const { VarChar } = require('mssql/msnodesqlv8')`) or a `connection.on is not a function` error will be thrown.
 
@@ -678,6 +735,8 @@ Driver={SQL Server Native Client 11.0};Server={#{server}\\#{instance}};Database=
 
 Please note that the connection string with this driver is not the same than tedious and use yes/no instead of true/false. You can see more on the [ODBC](https://docs.microsoft.com/fr-fr/dotnet/api/system.data.odbc.odbcconnection.connectionstring?view=dotnet-plat-ext-5.0) documentation.
 
+___
+
 ## Connections
 
 Internally, each `ConnectionPool` instance is a separate pool of TDS connections. Once you create a new `Request`/`Transaction`/`Prepared Statement`, a new TDS connection is acquired from the pool and reserved for desired action. Once the action is complete, connection is released back to the pool. Connection health check is built-in so once the dead connection is discovered, it is immediately replaced with a new one.
@@ -786,6 +845,7 @@ request.execute('procedure_name', (err, result) => {
 
 __Errors__
 - EREQUEST (`RequestError`) - *Message from SQL Server*
+- EINJECT (`RequestError`) - Procedure name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 - ECANCEL (`RequestError`) - Cancelled.
 - ETIMEOUT (`RequestError`) - Request timeout.
 - ENOCONN (`RequestError`) - No connection is specified for that request.
@@ -838,7 +898,7 @@ sql.map.register(Number, sql.BigInt)
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -863,7 +923,7 @@ request.output('output_parameter', sql.VarChar(50), 'abc')
 
 __Errors__ (synchronous)
 - EARGS (`RequestError`) - Invalid number of arguments.
-- EINJECT (`RequestError`) - SQL injection warning.
+- EINJECT (`RequestError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -947,6 +1007,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ```javascript
 const request = new sql.Request()
@@ -992,6 +1053,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 You can enable multiple recordsets in queries with the `request.multiple = true` command.
 
@@ -1038,6 +1100,7 @@ __Errors__
 - ECONNCLOSED (`ConnectionError`) - Connection is closed.
 - ENOTBEGUN (`TransactionError`) - Transaction has not begun.
 - EABORT (`TransactionError`) - Transaction was aborted (by user or because of an error).
+- EINJECT (`RequestError`) - Column name or parameter type is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1268,7 +1331,7 @@ ps.input('input_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1290,7 +1353,7 @@ ps.output('output_parameter', sql.VarChar(50))
 
 __Errors__ (synchronous)
 - EARGS (`PreparedStatementError`) - Invalid number of arguments.
-- EINJECT (`PreparedStatementError`) - SQL injection warning.
+- EINJECT (`PreparedStatementError`) - Parameter name is not a valid identifier. See [Identifiers](#identifiers).
 
 ---------------------------------------
 
@@ -1341,7 +1404,7 @@ ps.prepare('select @param as value', err => {
 
         console.log(result.recordset[0].value) // return 12345
         console.log(result.rowsAffected) // Returns number of affected rows in case of INSERT, UPDATE or DELETE statement.
-        
+
         ps.unprepare(err => {
             // ... error checks
         })
@@ -1374,9 +1437,9 @@ ps.prepare('select @param as value', err => {
 
     request.on('done', result => {
         // Always emitted as the last one
-        
+
         console.log(result.rowsAffected) // Returns number of affected rows in case of INSERT, UPDATE or DELETE statement.
-        
+
         ps.unprepare(err => {
             // ... error checks
         })
@@ -1682,7 +1745,7 @@ More information about JSON support can be found in [official documentation](htt
 
 ## Handling Duplicate Column Names
 
-If your queries contain output columns with identical names, the default behaviour of `mssql` will only return column metadata for the last column with that name. You will also not always be able to re-assemble the order of output columns requested. 
+If your queries contain output columns with identical names, the default behaviour of `mssql` will only return column metadata for the last column with that name. You will also not always be able to re-assemble the order of output columns requested.
 
 Default behaviour:
 ```javascript
@@ -1863,6 +1926,100 @@ Results in:
 ]
 ```
 
+## Identifiers
+
+Values are sent to the server as parameters and may hold anything. A few things
+are not values, and cannot be: the name of a parameter, the name of a column in a
+bulk load, the type a parameter is declared as, and the name of a stored procedure.
+Those are *identifiers*, and
+no SQL database can bind them, so this library builds them into the statement it
+sends. It checks them, and rejects anything that could end the identifier and have
+the rest of the value read as SQL.
+
+That check is not a substitute for your own. If any of these comes from somewhere
+you do not control, map it to a value you expect first:
+
+```javascript
+const columns = { name: 'name', created: 'created_at' }        // what you allow
+const column = columns[req.query.sortBy]                       // what they asked for
+if (!column) throw new Error('unknown column')
+
+request.input(column, sql.NVarChar, value)
+```
+
+### Parameter names
+
+`request.input()`, `request.output()` and the same methods on a prepared statement
+take a name without the leading `@`. It may hold letters, digits, marks and
+connector punctuation from any script, along with `@`, `#`, `$` and the two
+zero-width joiners. A name that is not a string or a number is rejected, as is one
+holding an invisible format character, because one of them is a separator the
+server treats as ending the identifier.
+
+Anything else raises `EINJECT`. Note that a name this library accepts may still be
+one the server rejects; the check is deliberately wider than the server's own rules
+so that it only refuses what could change the shape of the statement.
+
+### Column names
+
+`table.columns.add()` names a column in a bulk load, and the name is emitted as a
+quoted identifier. A `]` ends that quoting, so a name holding one must double it,
+which is how T-SQL escapes it:
+
+```javascript
+table.columns.add('a]]b', sql.Int)   // the column named a]b
+```
+
+A single `]` raises `EINJECT`. Column names are not otherwise restricted: spaces,
+punctuation and reserved words are all fine, because the quoting handles them.
+
+The keys of `options.order` are also identifiers, but the driver writes them into the bulk
+statement's `ORDER (...)` clause *unquoted* rather than as `[name]`. They follow the type
+name rule instead: bare, or quoted with brackets or double quotes.
+
+```javascript
+request.bulk(table, { order: { created_at: 'ASC' } })
+request.bulk(table, { order: { '[Created At]': 'DESC' } })   // quote a spaced name yourself
+```
+
+### Type names and sizes
+
+`sql.TVP()` takes the name of a table type, optionally qualified with a schema and
+optionally quoted with brackets or double quotes. A size — the length, precision or
+scale of a type such as `sql.VarChar()` — must be a number, or the word `max` the
+declaration accepts in its place. Padding is trimmed.
+
+```javascript
+request.input('rows', sql.TVP('dbo.[My Type]'), table)
+request.input('name', sql.VarChar(50), value)
+request.input('note', sql.VarChar('max'), value)
+```
+
+A size is checked wherever it is built into SQL, which includes the declaration a
+bulk load sends and the parameter list a query sends, not only `sql.TVP()`.
+
+### Procedure names
+
+`request.execute()` takes the name of a stored procedure, optionally qualified with
+a server, database and schema and optionally quoted with brackets or double quotes.
+An omitted part may be left empty, as T-SQL allows. The `msnodesqlv8` driver builds
+this into the statement it sends; the `tedious` driver sends it as a bound remote
+procedure call and could not be injected through it. Both check it, so a name is
+accepted or rejected the same way whichever driver you use.
+
+```javascript
+request.execute('dbo.[My Procedure]')
+request.execute('master..sp_who')      // an omitted schema is fine
+```
+
+The first and last parts must be present, so `.proc` and `db..` are rejected.
+
+Anything else raises `EINJECT`. Numbered procedures — the deprecated
+`procedure;1` form — are rejected, because the `;` cannot be told apart from the
+end of a statement.
+
+---------------------------------------
+
 ## Errors
 
 There are 4 types of errors you can handle:
@@ -1899,10 +2056,10 @@ Name | Code | Message
 `RequestError` | ECANCEL | Cancelled.
 `RequestError` | ETIMEOUT | Request timeout.
 `RequestError` | EARGS | Invalid number of arguments.
-`RequestError` | EINJECT | SQL injection warning.
+`RequestError` | EINJECT | Parameter name, column name or type is not a valid identifier.
 `RequestError` | ENOCONN | No connection is specified for that request.
 `PreparedStatementError` | EARGS | Invalid number of arguments.
-`PreparedStatementError` | EINJECT | SQL injection warning.
+`PreparedStatementError` | EINJECT | Parameter name is not a valid identifier.
 `PreparedStatementError` | EALREADYPREPARED | Statement is already prepared.
 `PreparedStatementError` | ENOTPREPARED | Statement is not prepared.
 
@@ -2133,8 +2290,6 @@ to create new connections or not
 [downloads-url]: https://www.npmjs.com/package/mssql
 [david-image]: https://img.shields.io/david/tediousjs/node-mssql.svg?style=flat-square
 [david-url]: https://david-dm.org/tediousjs/node-mssql
-[appveyor-image]: https://ci.appveyor.com/api/projects/status/e5gq1a0ujwams9t7/branch/master?svg=true
-[appveyor-url]: https://ci.appveyor.com/project/tediousjs/node-mssql
 
 [tedious-url]: https://www.npmjs.com/package/tedious
 [msnodesqlv8-url]: https://www.npmjs.com/package/msnodesqlv8

package/lib/base/prepared-statement.js

@@ -2,7 +2,7 @@
 
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('node:events')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { TransactionError, PreparedStatementError } = require('../error')
 const shared = require('../shared')
@@ -91,8 +91,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   input (name, type) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -144,8 +144,8 @@ class PreparedStatement extends EventEmitter {
    */
 
   output (name, type) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new PreparedStatementError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new PreparedStatementError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -235,17 +235,25 @@ class PreparedStatement extends EventEmitter {
       const req = new shared.driver.Request(this)
       req.stream = false
       req.output('handle', TYPES.Int)
-      req.input('params', TYPES.NVarChar, ((() => {
-        const result = []
+      let params
+      try {
+        params = []
         for (const name in this.parameters) {
           if (!objectHasProperty(this.parameters, name)) {
             continue
           }
           const param = this.parameters[name]
-          result.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
+          // a connection is held here, so a rejected declaration has to be reported
+          // through the path that releases it
+          params.push(`@${name} ${declare(param.type, param)}${param.io === 2 ? ' output' : ''}`)
         }
-        return result
-      })()).join(','))
+      } catch (e) {
+        this.parent.release(this._acquiredConnection)
+        this._acquiredConnection = null
+        this._acquiredConfig = null
+        return callback(new PreparedStatementError(e, 'EREQUEST'))
+      }
+      req.input('params', TYPES.NVarChar, params.join(','))
       req.input('stmt', TYPES.NVarChar, this.statement)
       req.execute('sp_prepare', (err, result) => {
         if (err) {

package/lib/base/request.js

@@ -3,7 +3,7 @@
 const debug = require('debug')('mssql:base')
 const { EventEmitter } = require('node:events')
 const { Readable } = require('node:stream')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, isValidParameterName } = require('../utils')
 const globalConnection = require('../global-connection')
 const { RequestError, ConnectionError } = require('../error')
 const { TYPES } = require('../datatypes')
@@ -107,8 +107,8 @@ class Request extends EventEmitter {
    */
 
   input (name, type, value) {
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if (arguments.length < 2) {
@@ -170,8 +170,8 @@ class Request extends EventEmitter {
   output (name, type, value) {
     if (!type) { type = TYPES.NVarChar }
 
-    if (/--| |\/\*|\*\/|'/.test(name)) {
-      throw new RequestError(`SQL injection warning for param '${name}'`, 'EINJECT')
+    if (!isValidParameterName(name)) {
+      throw new RequestError(`Invalid parameter name '${name}'. Parameter names may only contain identifier characters`, 'EINJECT')
     }
 
     if ((type === TYPES.Text) || (type === TYPES.NText) || (type === TYPES.Image)) {

package/lib/datatypes.js

@@ -1,5 +1,5 @@
 'use strict'
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeTypeName, assertSafeTypeSize } = require('./utils')
 const inspect = Symbol.for('nodejs.util.inspect.custom')
 
 const TYPES = {
@@ -132,19 +132,33 @@ for (const key in TYPES) {
 }
 
 module.exports.declare = (type, options) => {
+  // sizes and the type name reach the generated declaration directly, so they are checked
+  // here rather than trusted from whatever built the parameter. Each is read only in the
+  // branch that emits it, so a type that takes no size still needs no options.
   switch (type) {
-    case TYPES.VarChar: case TYPES.VarBinary:
-      return `${type.declaration} (${options.length > 8000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.NVarChar:
-      return `${type.declaration} (${options.length > 4000 ? 'MAX' : (options.length == null ? 'MAX' : options.length)})`
-    case TYPES.Char: case TYPES.NChar: case TYPES.Binary:
-      return `${type.declaration} (${options.length == null ? 1 : options.length})`
-    case TYPES.Decimal: case TYPES.Numeric:
-      return `${type.declaration} (${options.precision == null ? 18 : options.precision}, ${options.scale == null ? 0 : options.scale})`
-    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset:
-      return `${type.declaration} (${options.scale == null ? 7 : options.scale})`
+    case TYPES.VarChar: case TYPES.VarBinary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 8000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.NVarChar: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length > 4000 ? 'MAX' : (length == null ? 'MAX' : length)})`
+    }
+    case TYPES.Char: case TYPES.NChar: case TYPES.Binary: {
+      const length = assertSafeTypeSize(options.length)
+      return `${type.declaration} (${length == null ? 1 : length})`
+    }
+    case TYPES.Decimal: case TYPES.Numeric: {
+      const precision = assertSafeTypeSize(options.precision)
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${precision == null ? 18 : precision}, ${scale == null ? 0 : scale})`
+    }
+    case TYPES.Time: case TYPES.DateTime2: case TYPES.DateTimeOffset: {
+      const scale = assertSafeTypeSize(options.scale)
+      return `${type.declaration} (${scale == null ? 7 : scale})`
+    }
     case TYPES.TVP:
-      return `${options.tvpType} readonly`
+      return `${assertSafeTypeName(options.tvpType)} readonly`
     default:
       return type.declaration
   }

package/lib/msnodesqlv8/request.js

@@ -4,7 +4,7 @@ const msnodesql = require('msnodesqlv8')
 const debug = require('debug')('mssql:msv8')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare } = require('../datatypes')
 const { PARSERS: UDT } = require('../udt')
 const Table = require('../table')
@@ -154,16 +154,32 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => {
+          assertSafeColumnName(col.name)
+          // This driver hands the column definition to its table manager rather than writing
+          // it into SQL, so a size never reaches a statement here. It is checked all the same,
+          // so that a column either works on both drivers or on neither.
+          assertSafeTypeSize(col.length)
+          assertSafeTypeSize(col.precision)
+          assertSafeTypeSize(col.scale)
+        })
+        // checked here too, so an ordering key is accepted or rejected the same way on
+        // either driver even though this one does not build the statement itself
+        if (options && options.order) {
+          Object.keys(options.order).forEach(key => assertSafeTypeName(key))
+        }
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
 
       if (!table.name) {
-        setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
+        return setImmediate(callback, new RequestError('Table name must be specified for bulk insert.', 'ENAME'))
       }
 
       if (table.name.charAt(0) === '@') {
-        setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
+        return setImmediate(callback, new RequestError("You can't use table variables for bulk insert.", 'ENAME'))
       }
 
       this.parent.acquire(this, (err, connection) => {
@@ -189,8 +205,11 @@ class Request extends BaseRequest {
                 connection.hasError = true
               }
 
+              // a rejected identifier keeps its own code; anything else is a driver
+              // error, whose numeric code must not become the public one
+              const rejectedIdentifier = err.code === 'EINJECT'
               err = new RequestError(err)
-              err.code = 'EREQUEST'
+              err.code = rejectedIdentifier ? 'EINJECT' : 'EREQUEST'
             }
 
             this.parent.release(connection)
@@ -210,14 +229,29 @@ class Request extends BaseRequest {
               }
 
               const rows = []
-              for (const row of Array.from(table.rows)) {
-                const item = {}
-                for (let index = 0; index < table.columns.length; index++) {
-                  const col = table.columns[index]
-                  item[col.name] = row[index]
+              try {
+                for (const col of table.columns) {
+                  // re-checked here for the same reason as the name below, in case the
+                  // definition changed since it was checked above
+                  assertSafeTypeSize(col.length)
+                  assertSafeTypeSize(col.precision)
+                  assertSafeTypeSize(col.scale)
                 }
 
-                rows.push(item)
+                for (const row of Array.from(table.rows)) {
+                  const item = {}
+                  for (let index = 0; index < table.columns.length; index++) {
+                    const col = table.columns[index]
+                    // this driver hands the name to its table manager rather than writing
+                    // it into SQL, but it is checked here all the same: a name either
+                    // works on both drivers or on neither
+                    item[assertSafeColumnName(col.name)] = row[index]
+                  }
+
+                  rows.push(item)
+                }
+              } catch (e) {
+                return done(e)
               }
 
               mgr.insertRows(rows, done)
@@ -232,7 +266,16 @@ class Request extends BaseRequest {
               objectid = table.path
             }
 
-            return connection.queryRaw(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, function (err) {
+            // A connection is held from here on, so a column name that changed since it
+            // was checked above must be reported through `done`, which releases it.
+            let statement
+            try {
+              statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+            } catch (e) {
+              return done(e)
+            }
+
+            return connection.queryRaw(statement, function (err) {
               if (err) { return done(err) }
               go()
             })
@@ -314,12 +357,18 @@ class Request extends BaseRequest {
 
       if (!this._nested) {
         const input = []
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            input.push(`@${param.name} ${declare(param.type, param)}`)
           }
-          const param = this.parameters[name]
-          input.push(`@${param.name} ${declare(param.type, param)}`)
+        } catch (e) {
+          return callback(new RequestError(e, 'EREQUEST'))
         }
 
         const sets = []
@@ -634,14 +683,32 @@ class Request extends BaseRequest {
       if (err) return callback(err)
 
       const params = []
-      for (const name in this.parameters) {
-        if (!objectHasProperty(this.parameters, name)) {
-          continue
-        }
-        const param = this.parameters[name]
-        if (param.io === 2) {
-          params.push(`@${param.name} ${declare(param.type, param)}`)
+      let procedureName
+      try {
+        // this is built into `exec @___return___ = <name>` below and run as SQL text, so it is
+        // checked before it is emitted
+        procedureName = assertSafeProcedureName(procedure)
+        for (const name in this.parameters) {
+          if (!objectHasProperty(this.parameters, name)) {
+            continue
+          }
+          const param = this.parameters[name]
+          if (param.io === 2) {
+            // this callback is dispatched on its own tick, so a rejected declaration has
+            // to be handed back rather than thrown
+            params.push(`@${param.name} ${declare(param.type, param)}`)
+          } else {
+            // An input parameter is bound rather than written into the command, so only an
+            // output parameter's size is declared here and nothing would otherwise check an
+            // input's. It is checked so that a size is accepted or rejected the same way
+            // whichever driver is in use.
+            assertSafeTypeSize(param.length)
+            assertSafeTypeSize(param.precision)
+            assertSafeTypeSize(param.scale)
+          }
         }
+      } catch (e) {
+        return callback(new RequestError(e, 'EREQUEST'))
       }
 
       // set output params w/ values
@@ -657,7 +724,7 @@ class Request extends BaseRequest {
       }
 
       let cmd = `declare ${['@___return___ int'].concat(params).join(', ')};${sets.join(';')};`
-      cmd += `exec @___return___ = ${procedure} `
+      cmd += `exec @___return___ = ${procedureName} `
 
       const spp = []
       for (const name in this.parameters) {

package/lib/shared.js

@@ -57,7 +57,6 @@ const getTypeByValue = function (value) {
       return TYPES.NVarChar
 
     case 'number':
-    case 'bigint':
       if (value % 1 === 0) {
         if (value < -2147483648 || value > 2147483647) {
           return TYPES.BigInt
@@ -68,6 +67,13 @@ const getTypeByValue = function (value) {
         return TYPES.Float
       }
 
+    case 'bigint':
+      if (value < -2147483648n || value > 2147483647n) {
+        return TYPES.BigInt
+      } else {
+        return TYPES.Int
+      }
+
     case 'boolean':
       for (const item of Array.from(map)) {
         if (item.js === Boolean) {

package/lib/table.js

@@ -2,7 +2,7 @@
 
 const TYPES = require('./datatypes').TYPES
 const declareType = require('./datatypes').declare
-const objectHasProperty = require('./utils').objectHasProperty
+const { objectHasProperty, assertSafeColumnName } = require('./utils')
 
 const MAX = 65535 // (1 << 16) - 1
 const JSON_COLUMN_ID = 'JSON_F52E2B61-18A1-11d1-B105-00805F49916B'
@@ -99,9 +99,9 @@ Table.prototype._makeBulk = function _makeBulk () {
 }
 
 Table.prototype.declare = function declare () {
-  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${col.name}]`)
+  const pkey = this.columns.filter(col => col.primary === true).map(col => `[${assertSafeColumnName(col.name)}]`)
   const cols = this.columns.map(col => {
-    const def = [`[${col.name}] ${declareType(col.type, col)}`]
+    const def = [`[${assertSafeColumnName(col.name)}] ${declareType(col.type, col)}`]
 
     if (col.nullable === true) {
       def.push('null')

package/lib/tedious/request.js

@@ -4,7 +4,7 @@ const tds = require('tedious')
 const debug = require('debug')('mssql:tedi')
 const BaseRequest = require('../base/request')
 const RequestError = require('../error/request-error')
-const { IDS, objectHasProperty } = require('../utils')
+const { IDS, objectHasProperty, assertSafeColumnName, assertSafeTypeName, assertSafeTypeSize, assertSafeProcedureName } = require('../utils')
 const { TYPES, DECLARATIONS, declare, cast } = require('../datatypes')
 const Table = require('../table')
 const { PARSERS: UDT } = require('../udt')
@@ -219,6 +219,15 @@ class Request extends BaseRequest {
 
       try {
         table._makeBulk()
+        // Checked before a connection is borrowed, so that a rejected name cannot leave
+        // the pool short of one.
+        table.columns.forEach(col => assertSafeColumnName(col.name))
+        // tedious writes these into `insert bulk ... WITH (ORDER (<key> <direction>))`
+        // UNQUOTED — unlike a column name, which it emits as `[name]`. So the quoted-identifier
+        // rule does not apply here: what matters is that the key cannot end the clause. It is
+        // checked as an identifier, bare or quoted, which is what that position accepts. The
+        // checked keys are rebuilt into the options actually handed to the driver, so the value
+        // that was validated is the one emitted even if the caller's object changes after.
       } catch (e) {
         return callback(new RequestError(e, 'EREQUEST'))
       }
@@ -332,15 +341,38 @@ class Request extends BaseRequest {
           }
         }
 
-        const bulk = connection.newBulkLoad(table.path, options, done)
+        // A connection is held from here on, so anything that can throw has to hand the
+        // error back through `done`, which releases it. That includes newBulkLoad itself:
+        // tedious validates the bulk options there and throws for a bad `order` direction,
+        // which would otherwise strand the borrowed connection.
+        let bulk
+        let statement
+        try {
+          let bulkOptions = options
+          if (options && options.order) {
+            bulkOptions = Object.assign({}, options, {
+              order: Object.fromEntries(Object.entries(options.order)
+                .map(([key, direction]) => [assertSafeTypeName(key), direction]))
+            })
+          }
+          bulk = connection.newBulkLoad(table.path, bulkOptions, done)
+          for (const col of table.columns) {
+            // tedious emits this name as a quoted identifier of its own when it builds
+            // the `insert bulk` statement, so it is checked here as well as in
+            // Table#declare, in case the name changed since it was checked above.
+            bulk.addColumn(assertSafeColumnName(col.name), getTediousType(col.type), { nullable: col.nullable, length: assertSafeTypeSize(col.length), scale: assertSafeTypeSize(col.scale), precision: assertSafeTypeSize(col.precision) })
+          }
 
-        for (const col of table.columns) {
-          bulk.addColumn(col.name, getTediousType(col.type), { nullable: col.nullable, length: col.length, scale: col.scale, precision: col.precision })
+          if (table.create) {
+            const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
+            statement = `if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`
+          }
+        } catch (e) {
+          return done(e)
         }
 
         if (table.create) {
-          const objectid = table.temporary ? `tempdb..[${table.name}]` : table.path
-          const req = new tds.Request(`if object_id('${objectid.replace(/'/g, '\'\'')}') is null ${table.declare()}`, err => {
+          const req = new tds.Request(statement, err => {
             if (err) return done(err)
 
             connection.execBulkLoad(bulk, table.rows)
@@ -439,6 +471,26 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // Give up before the request is sent: the listeners attached just above have to
+        // come off the connection before it goes back to the pool, or they accumulate on
+        // it and fire for whoever borrows it next.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
         debug('request(%d): query', IDS.get(this), command)
 
         const req = new tds.Request(command, err => {
@@ -647,20 +699,23 @@ class Request extends BaseRequest {
                 param.value = getTediousType(param.type).validate(param.value, this.parent.collation)
               } catch (e) {
                 e.message = `Validation failed for parameter '${name}'. ${e.message}`
-                const err = new RequestError(e, 'EPARAM')
-
-                this.parent.release(connection)
-                return callback(err)
+                return abandon(new RequestError(e, 'EPARAM'))
               }
             }
 
             const declarations = []
-            for (const name in this.parameters) {
-              if (!objectHasProperty(this.parameters, name)) {
-                continue
+            try {
+              for (const name in this.parameters) {
+                if (!objectHasProperty(this.parameters, name)) {
+                  continue
+                }
+                const param = this.parameters[name]
+                // a connection is held here, so a rejected declaration has to be reported
+                // through the path that releases it
+                declarations.push(`@${name} ${declare(param.type, param)}`)
               }
-              const param = this.parameters[name]
-              declarations.push(`@${name} ${declare(param.type, param)}`)
+            } catch (e) {
+              return abandon(new RequestError(e, 'EREQUEST'))
             }
 
             const assigns = []
@@ -688,16 +743,22 @@ class Request extends BaseRequest {
             req.sqlTextOrProcedure = `declare ${declarations.join(', ')};select ${assigns.join(', ')};${req.sqlTextOrProcedure};${batchHasOutput ? (`select 1 as [___return___], ${selects.join(', ')}`) : ''}`
           }
         } else {
-          for (const name in this.parameters) {
-            if (!objectHasProperty(this.parameters, name)) {
-              continue
-            }
-            const param = this.parameters[name]
-            if (param.io === 1) {
-              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-            } else {
-              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+          try {
+            for (const name in this.parameters) {
+              if (!objectHasProperty(this.parameters, name)) {
+                continue
+              }
+              const param = this.parameters[name]
+              // tedious builds the sp_executesql declaration from these, so a rejected size
+              // has to be reported through the path that releases the connection
+              if (param.io === 1) {
+                req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              } else {
+                req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+              }
             }
+          } catch (e) {
+            return abandon(new RequestError(e, 'EREQUEST'))
           }
         }
 
@@ -793,6 +854,35 @@ class Request extends BaseRequest {
         connection.on('errorMessage', errorHandlers.errorMessage = handleError.bind(null, false, connection))
         connection.on('error', errorHandlers.error = handleError.bind(null, true, connection))
 
+        // A connection is held from here on. handleError builds a fresh Error and would
+        // relabel a rejected identifier as EREQUEST, so anything that can throw here is
+        // handed back through this instead, which keeps the code and releases the connection.
+        const abandon = (err) => {
+          delete this._cancel
+
+          if (hasReturned) {
+            return
+          }
+
+          for (const event in errorHandlers) {
+            connection.removeListener(event, errorHandlers[event])
+          }
+
+          this.parent.release(connection)
+          hasReturned = true
+
+          return callback(err)
+        }
+
+        let procedureName
+        try {
+          procedureName = assertSafeProcedureName(procedure)
+        } catch (e) {
+          // wrapped like every other rejection here, so the caller sees the same error class
+          // whichever driver is in use; MSSQLError keeps the EINJECT code through the wrap
+          return abandon(new RequestError(e, 'EREQUEST'))
+        }
+
         if (debug.enabled) {
           // log stored procedure executions and provided parameters
           const params = Object.keys(this.parameters).map(k => this.parameters[k])
@@ -805,7 +895,7 @@ class Request extends BaseRequest {
           debug('request(%d): execute %s %O', IDS.get(this), procedure, logParams)
         }
 
-        const req = new tds.Request(procedure, err => {
+        const req = new tds.Request(procedureName, err => {
           // to make sure we handle no-sql errors as well
           if (err && (!errors.length || (errors.length && err.message !== errors[errors.length - 1].message))) {
             err = new RequestError(err, 'EREQUEST')
@@ -967,16 +1057,20 @@ class Request extends BaseRequest {
           output[parameterName] = value
         })
 
-        for (const name in this.parameters) {
-          if (!objectHasProperty(this.parameters, name)) {
-            continue
-          }
-          const param = this.parameters[name]
-          if (param.io === 1) {
-            req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
-          } else {
-            req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: param.length, scale: param.scale, precision: param.precision })
+        try {
+          for (const name in this.parameters) {
+            if (!objectHasProperty(this.parameters, name)) {
+              continue
+            }
+            const param = this.parameters[name]
+            if (param.io === 1) {
+              req.addParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            } else {
+              req.addOutputParameter(param.name, getTediousType(param.type), parameterCorrection(param.value), { length: assertSafeTypeSize(param.length), scale: assertSafeTypeSize(param.scale), precision: assertSafeTypeSize(param.precision) })
+            }
           }
+        } catch (e) {
+          return abandon(new RequestError(e, 'EREQUEST'))
         }
 
         connection.callProcedure(req)

package/lib/utils.js

@@ -1,3 +1,5 @@
+const MSSQLError = require('./error/mssql-error')
+
 const IDS = new WeakMap()
 const INCREMENT = {
   Connection: 1,
@@ -7,8 +9,94 @@ const INCREMENT = {
   PreparedStatement: 1
 }
 
+// Parameter names are emitted into generated T-SQL as `@<name>`. The `@` occupies the
+// identifier's first position, so every character of the name sits in a subsequent
+// position, where T-SQL also permits digits and `$`. The set is deliberately wider than
+// the names the server will accept: it excludes the characters that could end the
+// identifier and let the rest of the name be read as SQL, and nothing else, so a name
+// the server dislikes still fails there rather than becoming an error here. The
+// exception is the invisible format characters, which are rejected outright.
+// Only the two zero-width joiners are taken from the format characters; the rest of that
+// category includes ZERO WIDTH SPACE, which the server does treat as a separator.
+const PARAM_NAME = /^(?:[\p{L}\p{N}\p{M}\p{Pc}@#$・･]|\u200C|\u200D)*$/u
+// A table-valued parameter's type name is emitted into the parameter declaration, and a
+// stored procedure's name is emitted into an `exec`, so both are checked the way the server
+// reads a qualified name: one or more parts separated by `.`, each either bare, holding only
+// the characters an identifier is made of, or quoted in brackets or double quotes, where
+// anything goes until the closing mark. Nothing that gets through can end the statement it
+// sits in and have the rest read as SQL.
+const QUALIFIED_NAME_PART = '(?:\\[(?:[^\\]]|\\]\\])*\\]|"(?:[^"]|"")*"|[\\p{L}\\p{N}\\p{M}\\p{Pc}@#$]+)'
+// An intermediate part may be omitted — `db..proc` and `server.db..proc` are ordinary
+// T-SQL — but the first and last parts must be present, so a bare `.`, a leading `.proc`
+// and a trailing `db..` are still refused. An empty part cannot end the identifier.
+const QUALIFIED_NAME = new RegExp(`^(?:${QUALIFIED_NAME_PART}(?:\\.${QUALIFIED_NAME_PART}?)*\\.)?${QUALIFIED_NAME_PART}$`, 'u')
+
+// A length, precision or scale is emitted into the same declaration. `max` is the only
+// word the declaration takes there; everything else the server wants is a number.
+const TYPE_SIZE = /^\w*$/
+
+// A column name is emitted as a quoted identifier, `[name]`, by this module and again by
+// the driver's own bulk load. Only `]` can terminate that quoting early, and doubling it
+// is the documented way to include one literally.
+const escapesQuotedIdentifier = (name) => String(name).replace(/]]/g, '').includes(']')
+
 module.exports = {
   objectHasProperty: (object, property) => Object.prototype.hasOwnProperty.call(object, property),
+  isValidParameterName: (name) => {
+    // Only primitives are accepted: an object could return a different value from a second
+    // toString() call, passing validation here and emitting something else into the SQL.
+    const type = typeof name
+    return (type === 'string' || type === 'number') && PARAM_NAME.test(String(name))
+  },
+  assertSafeTypeName: (name) => {
+    // A type name is optional: the tedious driver takes it from the Table passed as the
+    // value, and only uses this one when it is given.
+    if (name == null) {
+      return name
+    }
+    // Read once, and return what was read. Whatever is emitted is what was checked, so a
+    // value that reports a different name the second time cannot reach the SQL.
+    const type = String(name).trim()
+    if (!QUALIFIED_NAME.test(type)) {
+      throw new MSSQLError(`Invalid type name '${type}'. Type names may only contain identifier characters.`, 'EINJECT')
+    }
+    return type
+  },
+  assertSafeProcedureName: (name) => {
+    // The msnodesqlv8 driver builds `exec @___return___ = <name>` as SQL text, so the name is
+    // checked before it is emitted. The tedious driver sends it as a bound RPC and cannot be
+    // injected through it, but it is checked there too so that a name is accepted or rejected
+    // the same way whichever driver is in use.
+    // Read once, and return what was read, for the same reason as the type name.
+    const procedure = String(name).trim()
+    if (!QUALIFIED_NAME.test(procedure)) {
+      throw new MSSQLError(`Invalid procedure name '${procedure}'. Procedure names may only contain identifier characters.`, 'EINJECT')
+    }
+    return procedure
+  },
+  assertSafeTypeSize: (value) => {
+    if (value == null || typeof value === 'number') {
+      return value
+    }
+    // Read once and return what was read, for the same reason as the type name. Padding is
+    // trimmed rather than refused, and a word the server will reject still reaches it.
+    const size = String(value).trim()
+    if (!TYPE_SIZE.test(size)) {
+      throw new MSSQLError(`Invalid type size '${size}'. A length, precision or scale must be a number.`, 'EINJECT')
+    }
+    return size
+  },
+  assertSafeColumnName: (name) => {
+    const type = typeof name
+    if (type !== 'string' && type !== 'number') {
+      throw new MSSQLError(`Invalid column name '${String(name)}'. Column names must be a string or a number.`, 'EINJECT')
+    }
+    const column = String(name)
+    if (escapesQuotedIdentifier(column)) {
+      throw new MSSQLError(`Invalid column name '${column}'. A ']' in a column name must be written as ']]'.`, 'EINJECT')
+    }
+    return column
+  },
   INCREMENT,
   IDS: {
     get: IDS.get.bind(IDS),

package/package.json

@@ -21,7 +21,7 @@
     "azure",
     "node-mssql"
   ],
-  "version": "11.0.0",
+  "version": "11.0.2",
   "main": "index.js",
   "type": "commonjs",
   "repository": "github:tediousjs/node-mssql",
@@ -37,12 +37,12 @@
   "devDependencies": {
     "@commitlint/cli": "^19.3.0",
     "@commitlint/config-conventional": "^19.2.2",
-    "@semantic-release/commit-analyzer": "^11.1.0",
-    "@semantic-release/github": "^9.2.6",
-    "@semantic-release/npm": "^11.0.3",
-    "@semantic-release/release-notes-generator": "^12.1.0",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/npm": "^13.1.5",
+    "@semantic-release/release-notes-generator": "^14.1.0",
     "mocha": "^10.0.0",
-    "semantic-release": "^22.0.12",
+    "semantic-release": "^25.0.3",
     "standard": "^17.0.0"
   },
   "engines": {