@mikro-orm/core 7.1.12-dev.9 → 7.1.12

package/EntityManager.d.ts

@@ -601,7 +601,7 @@ export declare class EntityManager<Driver extends IDatabaseDriver = IDatabaseDri
      * some additional lazy properties, if so, we reload and merge the data from database
      */
     protected shouldRefresh<T extends object, P extends string = never, F extends string = never, E extends string = never>(meta: EntityMetadata<T>, entity: T, options: FindOneOptions<T, P, F, E>): boolean;
-    protected prepareOptions(options: (FindOptions<any, any, any, any> | FindOneOptions<any, any, any, any> | CountOptions<any, any> | CountByOptions<any>) & AbortQueryOptions): void;
+    protected prepareOptions<Options extends (FindOptions<any, any, any, any> | FindOneOptions<any, any, any, any> | CountOptions<any, any> | CountByOptions<any>) & AbortQueryOptions>(options: Options): Options;
     /**
      * @internal
      */

package/EntityManager.js

@@ -116,7 +116,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const meta = this.metadata.get(entityName);
         em.validateIndexUsage(meta, where, options);
         await em.tryFlush(entityName, options);
@@ -199,7 +199,7 @@ export class EntityManager {
      */
     async *stream(entityName, options = {}) {
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         options.strategy = 'joined';
         await em.tryFlush(entityName, options);
         const where = (await em.processWhere(entityName, options.where ?? {}, options, 'read'));
@@ -258,6 +258,7 @@ export class EntityManager {
      * Registers global filter to this entity manager. Global filters are enabled by default (unless disabled via last parameter).
      */
     addFilter(options) {
+        options = { ...options };
         if (options.entity) {
             options.entity = Utils.asArray(options.entity).map(n => Utils.className(n));
         }
@@ -528,7 +529,7 @@ export class EntityManager {
     async findAndCount(entityName, where, options = {}) {
         const em = this.getContext(false);
         await em.tryFlush(entityName, options);
-        options.flushMode = 'commit'; // do not try to auto flush again
+        options = { ...options, flushMode: 'commit' }; // do not try to auto flush again
         return Promise.all([
             em.find(entityName, where, options),
             em.count(entityName, where, options),
@@ -592,6 +593,7 @@ export class EntityManager {
      */
     async findByCursor(entityName, options) {
         const em = this.getContext(false);
+        options = { ...options };
         options.overfetch ??= true;
         options.where ??= {};
         if (Utils.isEmpty(options.orderBy) && !Raw.hasObjectFragments(options.orderBy)) {
@@ -610,10 +612,10 @@ export class EntityManager {
     async refreshOrFail(entity, options = {}) {
         const ret = await this.refresh(entity, options);
         if (!ret) {
-            options.failHandler ??= this.config.get('findOneOrFailHandler');
+            const failHandler = options.failHandler ?? this.config.get('findOneOrFailHandler');
             const wrapped = helper(entity);
             const where = wrapped.getPrimaryKey();
-            throw options.failHandler(wrapped.__meta.className, where);
+            throw failHandler(wrapped.__meta.className, where);
         }
         return ret;
     }
@@ -667,7 +669,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entity = em.#unitOfWork.tryGetById(entityName, where, options.schema);
         // query for a not managed entity which is already in the identity map as it
         // was provided with a PK this entity does not exist in the db, there can't
@@ -739,11 +741,11 @@ export class EntityManager {
         }
         if (!entity || isStrictViolation) {
             const key = options.strict ? 'findExactlyOneOrFailHandler' : 'findOneOrFailHandler';
-            options.failHandler ??= this.config.get(key);
+            const failHandler = options.failHandler ?? this.config.get(key);
             const name = Utils.className(entityName);
             /* v8 ignore next */
             where = Utils.isEntity(where) ? helper(where).getPrimaryKey() : where;
-            throw options.failHandler(name, where);
+            throw failHandler(name, where);
         }
         return entity;
     }
@@ -778,7 +780,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         let where;
         let entity = null;
@@ -916,7 +918,7 @@ export class EntityManager {
             return ret;
         }
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         let propIndex;
         if (data === undefined) {
@@ -1202,7 +1204,7 @@ export class EntityManager {
      */
     async lock(entity, lockMode, options = {}) {
         options = Utils.isPlainObject(options) ? options : { lockVersion: options };
-        this.getContext(false).prepareOptions(options);
+        options = this.getContext(false).prepareOptions(options);
         await this.getUnitOfWork().lock(entity, { lockMode, ...options });
     }
     /**
@@ -1210,7 +1212,7 @@ export class EntityManager {
      */
     async insert(entityNameOrEntity, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         if (data === undefined) {
             entityName = entityNameOrEntity.constructor;
@@ -1277,7 +1279,7 @@ export class EntityManager {
             overrides = overridesOrOptions;
         }
         options ??= {};
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const meta = em.metadata.get(entityName);
         const res = await em.driver.nativeClone(entityName, where, overrides, {
             ctx: em.#transactionContext,
@@ -1293,7 +1295,7 @@ export class EntityManager {
      */
     async insertMany(entityNameOrEntities, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         let entityName;
         if (data === undefined) {
             entityName = entityNameOrEntities[0].constructor;
@@ -1336,7 +1338,7 @@ export class EntityManager {
      */
     async nativeUpdate(entityName, where, data, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.processUnionWhere(entityName, options, 'update');
         data = QueryHelper.processObjectParams(data);
         where = await em.processWhere(entityName, where, { ...options, convertCustomTypes: false }, 'update');
@@ -1385,7 +1387,7 @@ export class EntityManager {
      */
     async nativeDelete(entityName, where, options = {}) {
         const em = this.getContext(false);
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.processUnionWhere(entityName, options, 'delete');
         where = (await em.processWhere(entityName, where, options, 'delete'));
         validateParams(where, 'delete condition');
@@ -1428,6 +1430,7 @@ export class EntityManager {
             return this.merge(entityName.constructor, entityName, data);
         }
         const em = options.disableContextResolution ? this : this.getContext();
+        options = { ...options };
         options.schema ??= em.#schema;
         options.validate ??= true;
         options.cascade ??= true;
@@ -1461,6 +1464,7 @@ export class EntityManager {
      */
     create(entityName, data, options = {}) {
         const em = this.getContext();
+        options = { ...options };
         options.schema ??= em.#schema;
         const entity = em.#entityFactory.create(entityName, data, {
             ...options,
@@ -1484,6 +1488,7 @@ export class EntityManager {
      * Gets a reference to the entity identified by the given type and identifier without actually loading it, if the entity is not yet loaded
      */
     getReference(entityName, id, options = {}) {
+        options = { ...options };
         options.schema ??= this.schema;
         options.convertCustomTypes ??= false;
         const meta = this.metadata.get(entityName);
@@ -1504,13 +1509,10 @@ export class EntityManager {
      */
     async count(entityName, where = {}, options = {}) {
         const em = this.getContext(false);
-        // Shallow copy options since the object will be modified when deleting orderBy
-        options = { ...options };
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         await em.tryFlush(entityName, options);
         where = await em.processWhere(entityName, where, options, 'read');
         options.populate = (await em.preparePopulate(entityName, options));
-        options = { ...options };
         // save the original hint value so we know it was infer/all
         const meta = em.metadata.find(entityName);
         options._populateWhere = options.populateWhere ?? this.config.get('populateWhere');
@@ -1639,8 +1641,9 @@ export class EntityManager {
         }
         // For TPT inheritance, check the entity's own properties, not just the root's
         // For STI, meta.properties includes all properties anyway
-        const ret = p in meta.properties;
-        if (parts.length > 0) {
+        // use an own-property check so inherited `Object.prototype` members (e.g. `__proto__`, `constructor`) are not treated as populatable
+        const ret = Object.hasOwn(meta.properties, p);
+        if (ret && parts.length > 0) {
             return this.canPopulate(meta.properties[p].targetMeta.class, parts.join('.'));
         }
         return ret;
@@ -1654,7 +1657,7 @@ export class EntityManager {
             return entities;
         }
         const em = this.getContext();
-        em.prepareOptions(options);
+        options = em.prepareOptions(options);
         const entityName = arr[0].constructor;
         const preparedPopulate = await em.preparePopulate(entityName, { populate: populate, filters: options.filters, populateHints: options.populateHints }, options.validate);
         await em.#entityLoader.populate(entityName, arr, preparedPopulate, options);
@@ -1665,6 +1668,7 @@ export class EntityManager {
      */
     fork(options = {}) {
         const em = options.disableContextResolution ? this : this.getContext(false);
+        options = { ...options };
         options.clear ??= true;
         options.useContext ??= false;
         options.freshEventManager ??= false;
@@ -2073,10 +2077,13 @@ export class EntityManager {
         if (!Utils.isEmpty(options.fields) && !Utils.isEmpty(options.exclude)) {
             throw new ValidationError(`Cannot combine 'fields' and 'exclude' option.`);
         }
-        options.schema ??= this.#schema;
-        options.signal ??= this.signal;
-        options.inflightQueryAbortStrategy ??= this.inflightQueryAbortStrategy;
-        options.logging = options.loggerContext = Utils.merge({ id: this.id }, this.loggerContext, options.loggerContext, options.logging);
+        // the options object belongs to the caller, everything below works on our own copy
+        const opts = { ...options };
+        opts.schema ??= this.#schema;
+        opts.signal ??= this.signal;
+        opts.inflightQueryAbortStrategy ??= this.inflightQueryAbortStrategy;
+        opts.logging = opts.loggerContext = Utils.merge({ id: this.id }, this.loggerContext, opts.loggerContext, opts.logging);
+        return opts;
     }
     /**
      * @internal

package/entity/EntityLoader.js

@@ -1,5 +1,5 @@
 import { QueryHelper } from '../utils/QueryHelper.js';
-import { Utils } from '../utils/Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from '../utils/Utils.js';
 import { ValidationError } from '../errors.js';
 import { LoadStrategy, PopulatePath, ReferenceKind, } from '../enums.js';
 import { Reference } from './Reference.js';
@@ -124,10 +124,10 @@ export class EntityLoader {
     mergeNestedPopulate(populate) {
         const tmp = populate.reduce((ret, item) => {
             /* v8 ignore next */
-            if (item.field === PopulatePath.ALL) {
+            if (item.field === PopulatePath.ALL || DANGEROUS_PROPERTY_NAMES.includes(item.field)) {
                 return ret;
             }
-            if (!ret[item.field]) {
+            if (!Object.hasOwn(ret, item.field)) {
                 ret[item.field] = item;
                 return ret;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mikro-orm/core",
-  "version": "7.1.12-dev.9",
+  "version": "7.1.12",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
   "keywords": [
     "data-mapper",

package/unit-of-work/UnitOfWork.js

@@ -124,7 +124,6 @@ export class UnitOfWork {
         if (options?.newEntity) {
             return entity;
         }
-        const forceUndefined = this.#em.config.get('forceUndefined');
         const wrapped = helper(entity);
         if (options?.loaded && wrapped.__initialized && !wrapped.__onLoadFired) {
             this.#loadedEntities.add(entity);

package/utils/QueryHelper.js

@@ -1,5 +1,5 @@
 import { Reference } from '../entity/Reference.js';
-import { Utils } from './Utils.js';
+import { DANGEROUS_PROPERTY_NAMES, Utils } from './Utils.js';
 import { ARRAY_OPERATORS, GroupOperator, JSON_KEY_OPERATORS, ReferenceKind } from '../enums.js';
 import { JsonType } from '../types/JsonType.js';
 import { helper } from '../entity/wrap.js';
@@ -269,7 +269,11 @@ export class QueryHelper {
             options.forEach(filter => (opts[filter] = true));
         }
         else if (Utils.isPlainObject(options)) {
-            Object.keys(options).forEach(filter => (opts[filter] = options[filter]));
+            Object.keys(options).forEach(filter => {
+                if (!DANGEROUS_PROPERTY_NAMES.includes(filter)) {
+                    opts[filter] = options[filter];
+                }
+            });
         }
         return Object.keys(filters)
             .filter(f => QueryHelper.isFilterActive(meta, f, filters[f], opts))

package/utils/Utils.js

@@ -153,7 +153,7 @@ export function parseJsonSafe(value) {
 /** Collection of general-purpose utility methods used throughout the ORM. */
 export class Utils {
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.1.12-dev.9';
+    static #ORM_VERSION = '7.1.12';
     /**
      * Checks if the argument is instance of `Object`. Returns false for arrays.
      */