@stacksjs/database 0.75.36 → 0.75.38

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/types.d.ts +21 -1
  2. package/package.json +17 -17
package/dist/types.d.ts CHANGED
@@ -2,9 +2,29 @@
2
2
  * SQL template tag function.
3
3
  * Creates parameterized SQL queries from template literals.
4
4
  *
5
+ * Every interpolated value becomes a literal `?`, whatever the connection is.
6
+ * That is correct only because the query builder re-renders placeholders for
7
+ * the dialect when it compiles the statement, so a fragment handed to `.set()`
8
+ * comes out as `$1` on Postgres. `.whereRaw()` does not accept a fragment with
9
+ * bound values at all: it throws and names `raw` or `where()` instead, because
10
+ * that path renders text verbatim and would drop the parameters.
11
+ *
12
+ * **Do not read `.sql` and `.parameters` off one of these and run it through
13
+ * `unsafe()`.** Nothing re-renders it on that path, so Postgres receives the
14
+ * `?`, parses it as an operator, and fails at the following token - which is
15
+ * why the whole Postgres auth suite once failed with
16
+ * `syntax error at or near "LIMIT"` (stacksjs/stacks#2842). Build the string
17
+ * with `sqlHelpers(getDatabaseDialect()).param(n)` and pass the values as an
18
+ * array instead.
19
+ *
5
20
  * @example
6
21
  * ```ts
7
- * const query = sql`SELECT * FROM users WHERE id = ${userId}`
22
+ * // Safe: the builder compiles this for the connection's dialect.
23
+ * query.whereRaw(sql`created_at > ${cutoff}`)
24
+ *
25
+ * // Broken on Postgres: `?` reaches the server verbatim.
26
+ * const q = sql`SELECT * FROM users WHERE id = ${userId}`
27
+ * await db.primary.unsafe(q.sql, q.parameters)
8
28
  * ```
9
29
  */
10
30
  export declare function sql(strings: TemplateStringsArray, ...values: unknown[]): Sql;
package/package.json CHANGED
@@ -2,7 +2,7 @@
2
2
  "name": "@stacksjs/database",
3
3
  "type": "module",
4
4
  "sideEffects": false,
5
- "version": "0.75.36",
5
+ "version": "0.75.38",
6
6
  "description": "The Stacks database integration.",
7
7
  "author": "Chris Breuer",
8
8
  "contributors": [
@@ -66,26 +66,26 @@
66
66
  "prepublishOnly": "bun run build"
67
67
  },
68
68
  "dependencies": {
69
- "@stacksjs/config": "0.75.36",
70
- "@stacksjs/env": "0.75.36",
71
- "@stacksjs/error-handling": "0.75.36",
72
- "@stacksjs/faker": "^0.75.36",
73
- "@stacksjs/features": "0.75.36",
74
- "@stacksjs/logging": "0.75.36",
75
- "@stacksjs/model-meta": "0.75.36",
76
- "@stacksjs/path": "0.75.36",
77
- "@stacksjs/query-builder": "^0.75.36",
78
- "@stacksjs/security": "0.75.36",
79
- "@stacksjs/storage": "0.75.36",
80
- "@stacksjs/strings": "0.75.36",
69
+ "@stacksjs/config": "0.75.38",
70
+ "@stacksjs/env": "0.75.38",
71
+ "@stacksjs/error-handling": "0.75.38",
72
+ "@stacksjs/faker": "^0.75.38",
73
+ "@stacksjs/features": "0.75.38",
74
+ "@stacksjs/logging": "0.75.38",
75
+ "@stacksjs/model-meta": "0.75.38",
76
+ "@stacksjs/path": "0.75.38",
77
+ "@stacksjs/query-builder": "^0.75.38",
78
+ "@stacksjs/security": "0.75.38",
79
+ "@stacksjs/storage": "0.75.38",
80
+ "@stacksjs/strings": "0.75.38",
81
81
  "@stacksjs/ts-validation": "^0.5.6",
82
- "bun-query-builder": "^0.3.0",
82
+ "bun-query-builder": "^0.3.4",
83
83
  "dynamodb-tooling": "^0.3.2"
84
84
  },
85
85
  "devDependencies": {
86
- "@stacksjs/cli": "0.75.36",
87
- "@stacksjs/router": "0.75.36",
88
- "@stacksjs/utils": "0.75.36",
86
+ "@stacksjs/cli": "0.75.38",
87
+ "@stacksjs/router": "0.75.38",
88
+ "@stacksjs/utils": "0.75.38",
89
89
  "better-dx": "^0.2.24"
90
90
  }
91
91
  }