@alpha.consultings/eloquent-orm.js 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## [1.0.4](https://github.com/MetalDz/Eloquent-ORM.js/compare/v1.0.3...v1.0.4) (2026-03-25)
+
+
+### Bug Fixes
+
+* add real sql rest scenario matrix and correct serialization delete runtime ([194dc23](https://github.com/MetalDz/Eloquent-ORM.js/commit/194dc235d5b9ccd7f8a930ce7f9c6683d718a336))
+* reduce inactive tooling deps and harden security transparency ([72d591d](https://github.com/MetalDz/Eloquent-ORM.js/commit/72d591dc8fec12648f3844595c41e8c34fa2983a))
+
 ## [1.0.3](https://github.com/MetalDz/Eloquent-ORM.js/compare/v1.0.2...v1.0.3) (2026-03-24)
 
 

package/README.md

@@ -1,5 +1,14 @@
 # Eloquent ORM JS
 
+[![npm version](https://img.shields.io/npm/v/%40alpha.consultings%2F@alpha.consultings/eloquent-orm.js?logo=npm&label=npm)](https://www.npmjs.com/package/@alpha.consultings/eloquent-orm.js)
+[![downloads](https://img.shields.io/npm/dm/%40alpha.consultings%2F@alpha.consultings/eloquent-orm.js?label=downloads)](https://www.npmjs.com/package/@alpha.consultings/eloquent-orm.js)
+[![node](https://img.shields.io/node/v/%40alpha.consultings%2F@alpha.consultings/eloquent-orm.js?label=node)](https://www.npmjs.com/package/@alpha.consultings/eloquent-orm.js)
+[![ci](https://img.shields.io/github/actions/workflow/status/MetalDz/Eloquent-ORM.js/ci.yml?branch=ai_master&label=ci)](https://github.com/MetalDz/Eloquent-ORM.js/actions/workflows/ci.yml)
+[![coverage](https://img.shields.io/badge/coverage-100%25-brightgreen)](https://github.com/MetalDz/Eloquent-ORM.js)
+[![license](https://img.shields.io/npm/l/%40alpha.consultings%2F@alpha.consultings/eloquent-orm.js?label=license)](https://github.com/MetalDz/Eloquent-ORM.js/blob/ai_master/LICENSE)
+[![docs](https://img.shields.io/badge/docs-official-blue)](https://alphaconsultings.mintlify.app/)
+[![Socket Badge](https://badge.socket.dev/npm/package/@alpha.consultings/eloquent-orm.js)](https://socket.dev/npm/package/@alpha.consultings/eloquent-orm.js)
+
 Laravel-inspired ORM + CLI for Node.js + TypeScript with SQL and MongoDB runtime support.
 
 Package: `@alpha.consultings/eloquent-orm.js`
@@ -235,6 +244,9 @@ Some package scanners flag this package for network access and eval-like behavio
 - Outbound DB/cache connections are by design. This package opens runtime connections to MySQL, PostgreSQL, MongoDB, SQLite, and Memcached when those drivers are configured.
 - Mongo SRV mode may use custom DNS resolvers when configured. If you use a `mongodb+srv://` URI and set `MONGO_DNS_SERVERS`, the runtime may call Node's in-process DNS resolver override for Mongo SRV lookups.
 - Eval-like behavior is not part of this package's own runtime source. Scanner warnings usually come from the `mysql2` dependency, which generates row parsers dynamically for performance.
+- The well-known `readCodeFor` arbitrary code injection issue affected `mysql2` versions earlier than `3.9.7`. This package currently depends on `mysql2` `^3.15.2`, which is above that fixed line and is not in the vulnerable range.
+- I also verified that the `mysql2` project continued shipping security hardening after that fix. The official `3.19.1` release notes mention bounds checks, malformed payload handling, and config-injection hardening, and npm currently lists `3.20.0` as the latest stable release as of March 25, 2026.
+- I am intentionally not claiming every third-party summary verbatim. The specific claim I verified directly is: `mysql2 < 3.9.7` was vulnerable, while this package's supported range is above that threshold.
 
 For the current hosted docs and security guidance:
 

package/dist/core/model/BaseModel.d.ts

@@ -60,7 +60,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -69,7 +69,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -78,7 +78,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -87,7 +87,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -96,7 +96,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -105,7 +105,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -114,7 +114,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -123,7 +123,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -132,7 +132,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -141,7 +141,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -150,7 +150,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -159,7 +159,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -168,7 +168,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
         hidden: string[];
         appends: string[];
         toObject(): Record<string, unknown>;
-        toJSON(): string;
+        toJSON(): Record<string, unknown>;
         serializeValue(value: unknown): unknown;
         all(): Promise<unknown[]>;
         find(id: number | string, pk?: string): Promise<unknown | null>;
@@ -177,7 +177,7 @@ declare const SafeFinderStaticModel: ((abstract new (...args: any[]) => {
     hidden: string[];
     appends: string[];
     toObject(): Record<string, unknown>;
-    toJSON(): string;
+    toJSON(): Record<string, unknown>;
     serializeValue(value: unknown): unknown;
     all(): Promise<unknown[]>;
     find(id: number | string, pk?: string): Promise<unknown | null>;

package/dist/core/orm/mixins/SerializeMixin.d.ts

@@ -7,7 +7,7 @@ export interface SerializableModel {
     all(): Promise<unknown[]>;
     find(id: number | string, pk?: string): Promise<unknown | null>;
     toObject?(): Record<string, unknown>;
-    toJSON?(): string;
+    toJSON?(): Record<string, unknown>;
 }
 /** Generic abstract constructor used by all mixins */
 type Constructor<T = object> = abstract new (...args: any[]) => T;
@@ -32,7 +32,7 @@ export declare function SerializeMixin<TBase extends Constructor<SerializableMod
     /**
      * 🧠 Convert model to JSON string
      */
-    toJSON(): string;
+    toJSON(): Record<string, unknown>;
     /**
      * ♻️ Recursively serialize nested models, arrays, or plain objects
      */

package/dist/core/orm/mixins/SerializeMixin.js

@@ -51,7 +51,7 @@ function SerializeMixin(Base) {
          * 🧠 Convert model to JSON string
          */
         toJSON() {
-            return JSON.stringify(this.toObject());
+            return this.toObject();
         }
         /**
          * ♻️ Recursively serialize nested models, arrays, or plain objects

package/dist/core/orm/mixins/SoftDeletesMixin.js

@@ -11,6 +11,27 @@ const BaseMethodResolver_1 = require("./utils/BaseMethodResolver");
 function SoftDeletesMixin(Base) {
     const resolveBaseMethod = (0, BaseMethodResolver_1.createBaseMethodResolver)(Base);
     class SoftDeletableModel extends Base {
+        supportsSoftDeletes() {
+            const ctor = this.constructor;
+            if (ctor.softDeletes === true) {
+                return true;
+            }
+            const schema = ctor.schema;
+            if (!schema || typeof schema !== "object") {
+                return false;
+            }
+            return Object.entries(schema).some(([fieldName, field]) => {
+                if (fieldName === this.deletedAtColumn) {
+                    return true;
+                }
+                if (!field || typeof field !== "object") {
+                    return false;
+                }
+                const candidate = field;
+                return (candidate.type === "softDeletes" ||
+                    (candidate.kind === "mixin" && candidate.name === "SoftDeletes"));
+            });
+        }
         constructor(...args) {
             super(...args);
             this.deletedAtColumn = "deleted_at";
@@ -46,6 +67,19 @@ function SoftDeletesMixin(Base) {
             }
         }
         async delete(id, pk = "id") {
+            if (!this.supportsSoftDeletes()) {
+                const baseDelete = resolveBaseMethod(this, "delete");
+                if (typeof baseDelete !== "function") {
+                    throw new Error("Base 'delete' method not found for SoftDeletesMixin.");
+                }
+                const targetId = id ?? this.getTrackedPrimaryValue(pk);
+                if (targetId === undefined || targetId === null) {
+                    throw new Error(`Cannot delete ${this.constructor.name} without primary key '${pk}'.`);
+                }
+                await baseDelete(targetId, pk);
+                this.syncSoftDeleteState(targetId, pk, null, { removed: true });
+                return;
+            }
             const baseUpdate = resolveBaseMethod(this, "update");
             if (typeof baseUpdate !== "function") {
                 throw new Error("Base 'update' method not found for SoftDeletesMixin.");
@@ -79,6 +113,9 @@ function SoftDeletesMixin(Base) {
                 throw new Error("Base 'all' method not found for SoftDeletesMixin.");
             }
             const records = await baseAll();
+            if (!this.supportsSoftDeletes()) {
+                return records;
+            }
             return records.filter((record) => !record[this.deletedAtColumn]);
         }
         /**
@@ -92,6 +129,9 @@ function SoftDeletesMixin(Base) {
             const record = await baseFind(id, pk);
             if (!record)
                 return null;
+            if (!this.supportsSoftDeletes()) {
+                return record;
+            }
             const isDeleted = typeof record[this.deletedAtColumn] === "string" &&
                 record[this.deletedAtColumn] !== null;
             return isDeleted ? null : record;
@@ -115,6 +155,9 @@ function SoftDeletesMixin(Base) {
                 throw new Error("Base 'all' method not found for SoftDeletesMixin.");
             }
             const allRecords = (await baseAll());
+            if (!this.supportsSoftDeletes()) {
+                return [];
+            }
             return allRecords.filter((record) => typeof record[this.deletedAtColumn] === "string" &&
                 record[this.deletedAtColumn] !== null);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpha.consultings/eloquent-orm.js",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A Laravel Eloquent-inspired ORM Multi Driver SQL & NoSQL and Cache System and Artisan CLI like for Node.js Lovers",
   "keywords": [
     "orm",
@@ -81,7 +81,7 @@
     "test:mysql-smoke": "jest --runInBand --runTestsByPath src/lab_test/cli.integration.scenario.lifecycle.test.ts src/lab_test/cli.integration.make-migration.targeting.test.ts src/lab_test/cli.integration.migrate.targeting.test.ts src/lab_test/cli.integration.seed-and-demo.targeting.test.ts src/lab_test/cli.integration.factory-status.targeting.test.ts src/lab_test/migration.tracker.logic.test.ts src/lab_test/cache.commands.logic.test.ts",
     "coverage:misses": "npm run test:coverage && node scripts/coverage-misses.cjs",
     "test:critical": "jest --runInBand src/lab_test/cli.integration.scenario.lifecycle.test.ts src/lab_test/cli.integration.make-migration.targeting.test.ts src/lab_test/cli.integration.migrate.targeting.test.ts src/lab_test/cli.integration.seed-and-demo.targeting.test.ts src/lab_test/cli.integration.factory-status.targeting.test.ts src/lab_test/migration.tracker.logic.test.ts src/lab_test/cache.commands.logic.test.ts",
-    "test:pack-smoke": "node scripts/pack-smoke.js",
+    "test:pack-smoke": "npm run build && node scripts/pack-smoke.js",
     "test:pack-smoke:docker": "docker compose -f docker-compose.coverage-debug.yml run --rm pack-smoke",
     "dev": "ts-node src/index.ts",
     "cli": "ts-node bin/eloquent.ts",
@@ -115,11 +115,9 @@
     "@types/memcached": "^2.2.10",
     "@types/node": "^22.18.12",
     "@types/pg": "^8.15.5",
-    "eslint": "^9.38.0",
     "express": "^5.1.0",
     "jest": "^30.2.0",
     "semantic-release": "^24.2.9",
-    "ts-jest": "^29.4.5",
-    "typescript-eslint": "^8.46.1"
+    "ts-jest": "^29.4.5"
   }
 }