@mikro-orm/core 7.0.10-dev.1 → 7.0.10-dev.10

package/entity/EntityHelper.js

@@ -7,7 +7,12 @@ import { ReferenceKind } from '../enums.js';
 import { helper } from './wrap.js';
 import { inspect } from '../logging/inspect.js';
 import { getEnv } from '../utils/env-vars.js';
-const entitySymbol = Symbol('Entity');
+// Globally registered so the marker survives the CJS/ESM dual-package hazard
+// (#7515) — `tsx` registers both an ESM and a CJS hook for the CLI and ends up
+// loading `@mikro-orm/core` twice. JSON payloads still cannot forge the marker
+// because Symbol-keyed properties have no JSON representation, which is the
+// threat model the symbol-vs-string switch in f7e59a5ce was guarding against.
+const entitySymbol = Symbol.for('@mikro-orm/core/EntityHelper.entity');
 /**
  * @internal
  */
@@ -39,11 +44,6 @@ export class EntityHelper {
             // toJSON can be overridden
             Object.defineProperty(prototype, 'toJSON', {
                 value: function (...args) {
-                    // Guard against being called on the prototype itself (e.g. by serializers
-                    // walking the object graph and calling toJSON on prototype objects)
-                    if (this === prototype) {
-                        return {};
-                    }
                     return EntityTransformer.toObject(this, ...args);
                 },
                 writable: true,
@@ -51,6 +51,22 @@ export class EntityHelper {
                 enumerable: false,
             });
         }
+        // Walkers / serializers reaching the prototype directly invoke its methods and
+        // accessors with `this === prototype`. Wrap each so that case is a no-op rather
+        // than throwing (when a user `@Property({ persist: false })` getter dereferences
+        // unhydrated instance state) or installing state on the prototype itself (#7151).
+        for (const name of Object.getOwnPropertyNames(prototype)) {
+            const desc = Object.getOwnPropertyDescriptor(prototype, name);
+            const fn = desc.get ?? desc.value;
+            if (name === 'constructor' || typeof fn !== 'function' || fn.__guarded) {
+                continue;
+            }
+            const guarded = function (...args) {
+                return this === prototype ? undefined : fn.apply(this, args);
+            };
+            guarded.__guarded = true;
+            Object.defineProperty(prototype, name, desc.get ? { ...desc, get: guarded } : { ...desc, value: guarded });
+        }
     }
     /**
      * As a performance optimization, we create entity state methods lazily. We first add

package/metadata/MetadataDiscovery.js

@@ -393,7 +393,7 @@ export class MetadataDiscovery {
             }
             if (prop.joinColumns.length > 1) {
                 prop.ownColumns = prop.joinColumns.filter(col => {
-                    return !meta.props.find(p => p.name !== prop.name && (!p.fieldNames || p.fieldNames.includes(col)));
+                    return !meta.props.find(p => p.name !== prop.name && p.fieldNames?.includes(col));
                 });
             }
             if (!prop.ownColumns || prop.ownColumns.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.0.10-dev.1",
+  "version": "7.0.10-dev.10",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/unit-of-work/UnitOfWork.js

@@ -1188,20 +1188,21 @@ export class UnitOfWork {
     }
     getCommitOrder() {
         const calc = new CommitOrderCalculator();
-        const set = new Set();
+        // keyed by `_id` so we return the SAME instances as the change set groups (GH #7511)
+        const metaById = new Map();
         this.#changeSets.forEach(cs => {
             if (cs.meta.inheritanceType === 'tpt') {
-                set.add(cs.meta);
+                metaById.set(cs.meta._id, cs.meta);
                 for (const parentCs of cs.tptChangeSets ?? []) {
-                    set.add(parentCs.meta);
+                    metaById.set(parentCs.meta._id, parentCs.meta);
                 }
             }
             else {
-                set.add(cs.rootMeta);
+                metaById.set(cs.rootMeta._id, cs.rootMeta);
             }
         });
-        set.forEach(meta => calc.addNode(meta._id));
-        for (const meta of set) {
+        metaById.forEach(meta => calc.addNode(meta._id));
+        for (const meta of metaById.values()) {
             for (const prop of meta.relations) {
                 if (prop.polymorphTargets) {
                     for (const targetMeta of prop.polymorphTargets) {
@@ -1213,11 +1214,11 @@ export class UnitOfWork {
                 }
             }
             // For TPT, parent table must be inserted BEFORE child tables
-            if (meta.inheritanceType === 'tpt' && meta.tptParent && set.has(meta.tptParent)) {
+            if (meta.inheritanceType === 'tpt' && meta.tptParent && metaById.has(meta.tptParent._id)) {
                 calc.addDependency(meta.tptParent._id, meta._id, 1);
             }
         }
-        return calc.sort().map(id => this.#metadata.getById(id));
+        return calc.sort().map(id => metaById.get(id));
     }
     resetTransaction(oldTx) {
         if (oldTx) {

package/utils/QueryHelper.js

@@ -106,7 +106,10 @@ export class QueryHelper {
                 Object.keys(where).every(k => !Utils.isPlainObject(where[k]) ||
                     Object.keys(where[k]).every(v => {
                         if (Utils.isOperator(v, false)) {
-                            return true;
+                            // multi-value operators (e.g. `$in`/`$nin`) cannot be inlined into a composite
+                            // PK tuple — `getPrimaryKeyValues` would flatten the operator's array alongside
+                            // the sibling PK values, producing a malformed `(col1, col2) IN ((a, b))` clause
+                            return !meta.compositePK || !Array.isArray(where[k][v]);
                         }
                         if (meta.properties[k].primary &&
                             [ReferenceKind.ONE_TO_ONE, ReferenceKind.MANY_TO_ONE].includes(meta.properties[k].kind)) {

package/utils/Utils.js

@@ -132,7 +132,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.0.10-dev.1';
+    static #ORM_VERSION = '7.0.10-dev.10';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */
@@ -647,8 +647,10 @@ export class Utils {
      * Extracts all possible values of a TS enum. Works with both string and numeric enums.
      */
     static extractEnumValues(target) {
-        const keys = Object.keys(target);
-        const values = Object.values(target);
+        // skip namespace-merged functions (GH #7500)
+        const entries = Object.entries(target).filter(([, v]) => typeof v !== 'function');
+        const keys = entries.map(([k]) => k);
+        const values = entries.map(([, v]) => v);
         const numeric = !!values.find(v => typeof v === 'number');
         const constEnum = values.length % 2 === 0 && // const enum will have even number of items
             values.slice(0, values.length / 2).every(v => typeof v === 'string') && // first half are strings

package/utils/fs-utils.js

@@ -14,10 +14,11 @@ export const fs = {
         if (tinyGlobby) {
             globSync = (patterns, options) => {
                 patterns = Utils.asArray(patterns).map(p => p.replace(/\\/g, '/'));
-                if (options?.cwd) {
-                    options = { ...options, cwd: options.cwd.replace(/\\/g, '/') };
-                }
-                return tinyGlobby.globSync(patterns, { ...options, expandDirectories: false });
+                // never forward `cwd: undefined` — tinyglobby >= 0.2.16 calls `path.resolve(undefined)` and throws
+                return tinyGlobby.globSync(patterns, {
+                    expandDirectories: false,
+                    ...(options?.cwd && { cwd: options.cwd.replace(/\\/g, '/') }),
+                });
             };
         }
     },