Skip to main content
CYBERTEC Migrator Documentation
    Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Support
    latest Latest stable release View changelog ->
    CYBERTEC Migrator › Release Notes › v4.0.0

    v4.0.0

    8 min read

    • Internal postgres database:

      • Postgresql version in the internal database was upgraded from v13 to v18

    • Demo migration:

      • Evaluate the Migrator instantly with a pre-loaded sample HR schema — no live Oracle database connection required
      • Launch a demo from the migrations list via the new “Demo migration” action in the three-dot menu

    • AI Assistant (Enterprise Edition only):

      • Clearer error messages when the AI Assistant cannot be used. Users are now notified if it is not configured, the LLM server cannot be reached, or the API key is unauthorized - with each message advising to contact CYBERTEC

    • Internal database maintenance enhancements:

      • Upgraded the internal database to a custom, fully verified infrastructure to entirely remove default package exposure and ensure a clean environment

    Resolved Bugs

    • White page when opening a migration with the trial edition
    • Transpilation tab does not show all found issues
    • Code editors randomly loosing changes
    • Transpilation tab flickers on Brave browser

    Resolved CVEs

    • CVE-2026-21884, CVE-2026-22029 and CVE-2026-22030: react-router (dependency for facilitating routing in the GUI; affected feature is not used, no vulnerability)
    • CVE-2026-34077: react-router (production dependency for facilitating routing in the GUI; denial of service via reflected user input in the Framework Mode single-fetch feature; affected feature is not used, no vulnerability)
    • CVE-2026-42342: react-router (production dependency for facilitating routing in the GUI; denial of service via unbounded path expansion in the __manifest endpoint of Framework Mode; affected feature is not used, no vulnerability)
    • CVE-2025-13465 and CVE-2026-4800: lodash (dependency for utility functions; affected feature is exposed to external input, no vulnerability)
    • CVE-2025-12758: validator (dependency of class-validator; used for input validation; affected feature is not in use, no vulnerability)
    • CVE-2026-23745: tar (dependency of node-gyp and cacache; affected only during build time, no vulnerability)
    • CVE-2026-55388: piscina (transitive dependency of @pgtyped/cli for SQL type generation during the build process; prototype pollution gadget that may lead to remote code execution via inherited options.filename; not used in production)
    • GHSA-2rxc-gjrp-vjhx: anstream (dependency of clap for CLI argument parsing)
    • CVE-2026-27606: rollup (dependency of vite for automated testing; not used in production)
    • CVE-2026-53571: vite (dependency of vitest for automated testing; not used in production): on Windows, server.fs.deny could be bypassed via NTFS alternate data streams or 8.3 short names when the dev server is exposed to the network
    • CVE-2026-33228, CVE-2026-32141: flatted (dependency of eslint for code linting and formatting; not used in production)
    • CVE-2026-27904: minimatch (dependency for glob pattern matching; regular expression denial of service)
    • CVE-2026-33671: picomatch (transitive development dependency for glob pattern matching; ReDoS via crafted extglob patterns such as +(a|aa) causing catastrophic backtracking and Node.js event-loop blocking; not used in production)
    • CVE-2026-3520: multer (direct dependency for file uploads; potential for denial of service)
    • CVE-2026-5079: multer (direct/production dependency for file uploads; denial of service via deeply nested field names)
    • CVE-2026-44705: tmp (development dependency via cypress for automated testing; path traversal via unsanitized prefix/postfix values that enables directory escape; not used in production)
    • CVE-2026-44728: @babel/plugin-transform-modules-systemjs (dependency for the build process; not used in production)
    • CVE-2026-47429: vitest (direct dependency for automated testing; not used in production)
    • GHSA-gv7w-rqvm-qjhr: esbuild (direct dependency for project bundling; not used in production)
    • CVE-2026-6321: fast-uri (dependency of ajv for JSON schema validation)
    • CVE-2026-26318: systeminformation (dependency of cypress for automated testing; not used in production)
    • CVE-2026-12143: form-data (transitive dependency of superagent for HTTP testing and of @cypress/request for automated testing; CRLF injection via unescaped multipart field names and filenames; not used in production)
    • CVE-2026-46625: js-cookie (transitive production dependency of react-use for browser cookie handling in the GUI; per-instance prototype hijack via assign() enables cookie-attribute injection; affected feature is not in use, no vulnerability)
    • CVE-2026-4867: path-to-regexp (transitive production dependency of express via routing-controllers for HTTP request routing in the backend; regular expression denial of service via routes with three or more parameters in a single segment; affected pattern is not used in any of the migrator’s routes, no vulnerability)
    • CVE-2026-4926: path-to-regexp (transitive production dependency of express via routing-controllers for HTTP request routing in the backend; denial of service via sequential optional groups in route patterns whose generated regular expression grows exponentially with the number of groups; affected pattern is not used in any of the migrator’s routes, no vulnerability)
    • CVE-2026-27959: koa (transitive production dependency of routing-controllers for the underlying HTTP server framework in the backend; Host header injection via ctx.hostname/ctx.origin which perform naive parsing of the Host header without validating RFC 3986 hostname syntax, allowing an attacker-controlled value like evil.com:fake@legitimate.com to be returned as the hostname; affected feature is not used by the migrator, no vulnerability)
    • CVE-2026-53550: js-yaml (transitive development dependency of eslint and cosmiconfig for parsing YAML configuration files during development and build; quadratic-complexity DoS in merge-key handling via repeated aliases in the << merge sequence causes CPU exhaustion and Node.js event-loop blocking; not used in production)
    • CVE-2026-3449: @tootallnate/once (development dependency, transitive via node-gyp → make-fetch-happen → http-proxy-agent for fetching packages from the npm registry during the build process; incorrect control flow scoping in promise resolving when the AbortSignal option is used; not used in production)
    • CVE-2026-42338: ip-address (transitive development dependency via socks → socks-proxy-agent → make-fetch-happen → node-gyp for building native Node.js addons; cross-site scripting in the Address6 HTML-emitting methods group(), link(), and spanAll(), as well as in AddressError.parseMessage, because attacker-controlled content is embedded into the returned HTML without escaping; not used in production)
    • GHSA-r4q5-vmmm-2653: follow-redirects (transitive development dependency via http-server → http-proxy for serving the built frontend locally; when following a cross-domain redirect, only the standard authorization, proxy-authorization, and cookie headers are stripped while custom authentication headers such as X-API-Key or X-Auth-Token are forwarded verbatim to the redirect target, leaking them to an attacker-controlled host; not used in production)
    • GHSA-g7r4-m6w7-qqqr: esbuild (transitive development dependency of vite via vitest for automated testing; not used in production): on Windows, path traversal via backslash separators in the development server’s servedir allows reading arbitrary files outside the configured root directory
    • CVE-2026-8723: qs (transitive production dependency of body-parser and express for HTTP request parsing in the backend; qs.stringify throws a synchronous TypeError when called with arrayFormat: 'comma' and encodeValuesOnly: true on an array containing null or undefined, enabling a remotely triggerable denial of service via crafted JSON request bodies; affected options are not used by the migrator, no vulnerability)
    • CVE-2026-41907: uuid (direct production dependency for generating RFC 4122 UUIDs in the backend and frontend, as well as transitive production dependency via @ngneat/falso for random data generation in tests and via @cypress/request for HTTP request signing during automated testing; the v3(), v5() and v6() API methods accepted caller-provided output buffers without validating the offset or buffer length, allowing silent partial writes outside the intended 16-byte UUID range and potentially producing malformed identifiers; fixed by updating to ^13.0.1 and forcing the same version via resolutions for the transitive usages)
    • CVE-2026-33532: yaml (direct production dependency in the backend for parsing and stringifying YAML content, and transitive development dependency via cosmiconfig, lint-staged and openapi3-ts for configuration parsing, pre-commit hooks and OpenAPI document generation; the node resolution/composition phase used unbounded recursion, allowing a small crafted YAML document with deeply nested flow sequences (~2–10 KB) to trigger a RangeError: Maximum call stack size exceeded and potentially terminate the Node.js process; fixed by updating to ^2.8.3)
    • CVE-2026-24001: diff (direct production dependency in the frontend and transitive production dependency via @prantlf/jsonlint, as well as transitive development dependency via ts-node for diffing compiled TypeScript output line-by-line in the interactive REPL; the parsePatch and applyPatch methods entered an infinite loop and consumed memory without limit when parsing patches whose filename headers contained the line break characters \r, \u2028, or \u2029, allowing a small crafted patch to trigger a denial of service via process memory exhaustion; additionally, a ReDoS in the patch header with cubic complexity on its length further amplifies the impact; fixed by updating to ^8.0.3)
    • CVE-2025-13466: body-parser (direct production dependency in the backend for parsing URL-encoded and other HTTP request bodies in the express/routing-controllers stack; versions >= 2.2.0 < 2.2.1 handled URL-encoded payloads containing a very large number of parameters inefficiently, allowing an attacker to send thousands of parameters within the default 100KB request size limit and cause elevated CPU and memory usage, which could lead to service slowdown or partial outages under sustained malicious traffic; fixed by updating to ^2.2.1)
    • CVE-2025-69873: ajv (direct production dependency in the frontend for compiling and validating JSON schemas against user-uploaded migration files in the bulk-create flow, and transitive production dependency via @prantlf/jsonlint for JSON parsing; when the $data option is enabled, the pattern keyword accepts runtime data via JSON Pointer that is passed directly to the JavaScript RegExp() constructor without validation, allowing an attacker to inject a malicious regex pattern such as ^(a|a)*$ whose catastrophic backtracking causes full CPU blocking with a single HTTP request and therefore a complete denial of service; fixed by updating to ^8.18.0 and forcing the same version via resolutions for the transitive usage via @prantlf/jsonlint)
    • GHSA-j39j-6gw9-jw6h: git2 (development dependency of the backend’s build script for determining the current git commit hash; versions < 0.20.4 exhibit undefined behavior because dereferencing the Buf struct immediately after calling new() or default() on it passes a null pointer to slice::from_raw_parts, which according to its safety contract requires a non-null, properly aligned pointer even for zero-length slices; not used in production)
    gdoc_arrow_left_alt EULA A product of CYBERTEC v3.20.3 gdoc_arrow_right_alt