1.0 Tracking Branch

[wesleytodd]

This PR will track the 1.x release progress. Unfortunately I didn't plan on the amount of time from when I started merging those PR's from the fork. So I rolled back the master branch here to the last release (0.2.3). This now contains what I will start publishing as the release candidates for 1.x.

Current known issues (will open separate tickets to track them if I don't fix them this weekend):

• Missing docs on all the new features and changes (Docs written now)
• Cases where migrations are merged out of the order they are created are still not handled correctly (will warn users if this happens)
• Migrations listed in the state file but not in the migrations directory not handled (an error occurs in this case)
• Integrate support for dotenv #85
• Error when no promise or callback provided #86

[wesleytodd]

Ok, I just published a pre-release version if anyone wants to start testing this work.

npm install migrate@next

Unfortunately, I also forgot about the silly behavior of npm where a new install will pull pre-release versions on the latest tag. So I also published a patch version of the main line branch where I added some language to the readme to make people aware of the new work being done here. Hopefully it will help get some eyes on this work.

[cmeza]

Following closely as we're about to start a big node api re-write.

[wesleytodd]

Ok, I think the bulk of the work is done here. I have feature additions that I want to work on, like testing and verifying migrations, but those can be added as minor points releases so we don't hold this any longer.

Can a few people take a look and make sure I didn't overlook anything major? Maybe run a through a few example use cases or something? If I don't hear back I will pull the trigger sometime this weekend on the 1.0.0 publish.

[dastoori]

@wesleytodd It seems the slug dependency has a vulnerability:
dodo/node-slug#82
https://nodesecurity.io/check/migrate/1.0.0-2

[wesleytodd]

I will update that package when a patch is available. But TBQH, I am not worried about a ReDOS vouln, because if you are creating migrations from untrusted sources you have bigger problems ;)

But thanks for the report @dastoori.

[wesleytodd]

Published 1.0.0-3 on the next tag. This includes the dotenv integration and the patch for promise warning. If people can test it I think I am happy with this one being the official 1.0.0, since there are no more major pending features.

[jskorepa]

It works for me 👍

[wesleytodd]

Published!!

[LinusU]

🎉 🚀

Great work!

[wesleytodd]

To follow up, I just published v1.6.2 with the patched version of node-slug mentioned above.

Fixed here: dodo/node-slug#82