@mikro-orm/core 6.6.13-dev.2 → 6.6.13-dev.4

package/entity/EntityHelper.js

@@ -40,11 +40,6 @@ class EntityHelper {
         if (!prototype.toJSON) { // toJSON can be overridden
             Object.defineProperty(prototype, 'toJSON', {
                 value(...args) {
-                    // Guard against being called on the prototype itself (e.g. by serializers
-                    // walking the object graph and calling toJSON on prototype objects)
-                    if (this === prototype) {
-                        return {};
-                    }
                     return EntityTransformer_1.EntityTransformer.toObject(this, ...args.slice(meta.toJsonParams.length));
                 },
                 writable: true,
@@ -52,6 +47,22 @@ class EntityHelper {
                 enumerable: false,
             });
         }
+        // Walkers / serializers reaching the prototype directly invoke its methods and
+        // accessors with `this === prototype`. Wrap each so that case is a no-op rather
+        // than throwing (when a user `@Property({ persist: false })` getter dereferences
+        // unhydrated instance state) or installing state on the prototype itself (#7151).
+        for (const name of Object.getOwnPropertyNames(prototype)) {
+            const desc = Object.getOwnPropertyDescriptor(prototype, name);
+            const fn = desc.get ?? desc.value;
+            if (name === 'constructor' || typeof fn !== 'function' || fn.__guarded) {
+                continue;
+            }
+            const guarded = function (...args) {
+                return this === prototype ? undefined : fn.apply(this, args);
+            };
+            guarded.__guarded = true;
+            Object.defineProperty(prototype, name, desc.get ? { ...desc, get: guarded } : { ...desc, value: guarded });
+        }
     }
     /**
      * As a performance optimization, we create entity state methods in a lazy manner. We first add

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "6.6.13-dev.2",
+  "version": "6.6.13-dev.4",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "main": "index.js",
   "module": "index.mjs",
@@ -64,7 +64,7 @@
     "esprima": "4.0.1",
     "fs-extra": "11.3.3",
     "globby": "11.1.0",
-    "mikro-orm": "6.6.13-dev.2",
+    "mikro-orm": "6.6.13-dev.4",
     "reflect-metadata": "0.2.2"
   }
 }

package/utils/QueryHelper.js

@@ -92,7 +92,10 @@ class QueryHelper {
         if (meta.primaryKeys.every(pk => pk in where) && Utils_1.Utils.getObjectKeysSize(where) === meta.primaryKeys.length) {
             return !!key && !enums_1.GroupOperator[key] && key !== '$not' && Object.keys(where).every(k => !Utils_1.Utils.isPlainObject(where[k]) || Object.keys(where[k]).every(v => {
                 if (Utils_1.Utils.isOperator(v, false)) {
-                    return true;
+                    // multi-value operators (e.g. `$in`/`$nin`) cannot be inlined into a composite
+                    // PK tuple — `getPrimaryKeyValues` would flatten the operator's array alongside
+                    // the sibling PK values, producing a malformed `(col1, col2) IN ((a, b))` clause
+                    return !meta.compositePK || !Array.isArray(where[k][v]);
                 }
                 if (meta.properties[k].primary && [enums_1.ReferenceKind.ONE_TO_ONE, enums_1.ReferenceKind.MANY_TO_ONE].includes(meta.properties[k].kind)) {
                     return this.inlinePrimaryKeyObjects(where[k], meta.properties[k].targetMeta, metadata, v);