@stacksjs/database 0.75.36 → 0.75.37

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/types.d.ts +20 -1
  2. package/package.json +16 -16
package/dist/types.d.ts CHANGED
@@ -2,9 +2,28 @@
2
2
  * SQL template tag function.
3
3
  * Creates parameterized SQL queries from template literals.
4
4
  *
5
+ * Every interpolated value becomes a literal `?`, whatever the connection is.
6
+ * That is correct only because the query builder re-renders placeholders for
7
+ * the dialect when it compiles the statement, so a fragment handed to
8
+ * `.set()`, `.whereRaw()` or any other builder method comes out as `$1` on
9
+ * Postgres.
10
+ *
11
+ * **Do not read `.sql` and `.parameters` off one of these and run it through
12
+ * `unsafe()`.** Nothing re-renders it on that path, so Postgres receives the
13
+ * `?`, parses it as an operator, and fails at the following token - which is
14
+ * why the whole Postgres auth suite once failed with
15
+ * `syntax error at or near "LIMIT"` (stacksjs/stacks#2842). Build the string
16
+ * with `sqlHelpers(getDatabaseDialect()).param(n)` and pass the values as an
17
+ * array instead.
18
+ *
5
19
  * @example
6
20
  * ```ts
7
- * const query = sql`SELECT * FROM users WHERE id = ${userId}`
21
+ * // Safe: the builder compiles this for the connection's dialect.
22
+ * query.whereRaw(sql`created_at > ${cutoff}`)
23
+ *
24
+ * // Broken on Postgres: `?` reaches the server verbatim.
25
+ * const q = sql`SELECT * FROM users WHERE id = ${userId}`
26
+ * await db.primary.unsafe(q.sql, q.parameters)
8
27
  * ```
9
28
  */
10
29
  export declare function sql(strings: TemplateStringsArray, ...values: unknown[]): Sql;
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "@stacksjs/database",
3
3
  "type": "module",
4
4
  "sideEffects": false,
5
- "version": "0.75.36",
5
+ "version": "0.75.37",
6
6
  "description": "The Stacks database integration.",
7
7
  "author": "Chris Breuer",
8
8
  "contributors": [
@@ -66,26 +66,26 @@
66
66
  "prepublishOnly": "bun run build"
67
67
  },
68
68
  "dependencies": {
69
- "@stacksjs/config": "0.75.36",
70
- "@stacksjs/env": "0.75.36",
71
- "@stacksjs/error-handling": "0.75.36",
72
- "@stacksjs/faker": "^0.75.36",
73
- "@stacksjs/features": "0.75.36",
74
- "@stacksjs/logging": "0.75.36",
75
- "@stacksjs/model-meta": "0.75.36",
76
- "@stacksjs/path": "0.75.36",
77
- "@stacksjs/query-builder": "^0.75.36",
78
- "@stacksjs/security": "0.75.36",
79
- "@stacksjs/storage": "0.75.36",
80
- "@stacksjs/strings": "0.75.36",
69
+ "@stacksjs/config": "0.75.37",
70
+ "@stacksjs/env": "0.75.37",
71
+ "@stacksjs/error-handling": "0.75.37",
72
+ "@stacksjs/faker": "^0.75.37",
73
+ "@stacksjs/features": "0.75.37",
74
+ "@stacksjs/logging": "0.75.37",
75
+ "@stacksjs/model-meta": "0.75.37",
76
+ "@stacksjs/path": "0.75.37",
77
+ "@stacksjs/query-builder": "^0.75.37",
78
+ "@stacksjs/security": "0.75.37",
79
+ "@stacksjs/storage": "0.75.37",
80
+ "@stacksjs/strings": "0.75.37",
81
81
  "@stacksjs/ts-validation": "^0.5.6",
82
82
  "bun-query-builder": "^0.3.0",
83
83
  "dynamodb-tooling": "^0.3.2"
84
84
  },
85
85
  "devDependencies": {
86
- "@stacksjs/cli": "0.75.36",
87
- "@stacksjs/router": "0.75.36",
88
- "@stacksjs/utils": "0.75.36",
86
+ "@stacksjs/cli": "0.75.37",
87
+ "@stacksjs/router": "0.75.37",
88
+ "@stacksjs/utils": "0.75.37",
89
89
  "better-dx": "^0.2.24"
90
90
  }
91
91
  }