Running encrypt/backfill tooling against a production database URL (sslmode=require) prints:
(node:9060) Warning: SECURITY WARNING: The SSL modes 'prefer', 'require', and 'verify-ca' are treated as aliases for 'verify-full'.
In the next major version (pg-connection-string v3.0.0 and pg v9.0.0), these modes will adopt standard libpq semantics, which have weaker security guarantees.
...
It comes from pg-connection-string (via pg), not from Stack code — but it fires on every invocation, reads as scary in a security product's tooling, and users can't tell whether it indicates a real problem.
Options: normalize connection strings to an explicit sslmode=verify-full before handing them to pg (preserving current behavior and silencing the warning), or filter this specific process warning in the CLI entrypoint with a one-line note in the docs. Either way the CLI should not surface an upstream advisory as if it were a CipherStash warning.
Found during a production backfill with stash@1.0.0-rc.4 tooling.
Running encrypt/backfill tooling against a production database URL (sslmode=require) prints:
It comes from
pg-connection-string(viapg), not from Stack code — but it fires on every invocation, reads as scary in a security product's tooling, and users can't tell whether it indicates a real problem.Options: normalize connection strings to an explicit
sslmode=verify-fullbefore handing them topg(preserving current behavior and silencing the warning), or filter this specific process warning in the CLI entrypoint with a one-line note in the docs. Either way the CLI should not surface an upstream advisory as if it were a CipherStash warning.Found during a production backfill with
stash@1.0.0-rc.4tooling.