inline-sql-toolkit 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.6.2 - 2026-11-11
+
+- Fixed: ordinal replacement (`--ordinals` / `replaceOrdinals: true`) no longer miscounts a select item that holds an interpolation outside parentheses (`{dims}`, `%s`, `%(name)s`). Such an item may expand to several columns at runtime, so it is now treated like a `*` column: its ordinal and every later ordinal are kept, while ordinals before it still resolve. An interpolation inside parentheses (`SUM({col})`) remains one column. Previously `SELECT {dims}, cal_yr_mo_cd, … GROUP BY 1, 2, 3 ORDER BY 1, 2` could be rewritten to group and sort by `cal_yr_mo_cd` where the original ordinal `2` meant the second expanded column — silently changing ORDER BY ordering.
+
+## 0.6.1 - 2026-11-06
+
+- Security: pin the dev-only transitive `minimatch` to 11.0.1 via package overrides, resolving CVE-2026-118764 (GHSA-g3hv-75wg-m249) reported by the OSV scanner.
+
 ## 0.6.0 - 2026-11-06
 
 - Feature: the CLI accepts directory arguments and processes every `.py` / `.mo.py` file below them recursively, in path order. Scans skip dot-prefixed directories, `node_modules`, `.venv`, and `__pycache__`, and never follow symbolic-link directories; a file named directly and also found in a directory is processed once. A directory with no Python files in it exits with code 2. Files named explicitly are still processed whatever their extension.

package/dist/cli.js

@@ -1448,7 +1448,7 @@ function firstItemStart(tokens, start) {
 function normalizeName(text) {
   return text.replace(/^["`]|["`]$/g, "").toLowerCase();
 }
-function columnOf(tokens, start, end) {
+function columnOf(sql2, tokens, start, end) {
   const visible = tokens.slice(start, end).filter((token) => !isCommentToken(token));
   const first = visible[0];
   const last2 = visible[visible.length - 1];
@@ -1459,10 +1459,22 @@ function columnOf(tokens, start, end) {
       alias: void 0,
       aggregate: false,
       star: false,
+      expands: false,
       outputName: void 0,
       names: []
     };
   }
+  const expands = visible.some((token) => {
+    if (token.depth !== first.depth) return false;
+    if (token.text.startsWith("{")) return true;
+    if (!/^[+\-*/%<>=!~|&^:]+$/.test(token.text)) return false;
+    for (let offset = 0; offset < token.text.length; offset += 1) {
+      if (token.text[offset] !== "%") continue;
+      const next = sql2[token.start + offset + 1];
+      if (next === "s" || next === "(") return true;
+    }
+    return false;
+  });
   const secondLast = visible[visible.length - 2];
   const simpleColumn = visible.length % 2 === 1 && visible.every((token, i) => i % 2 === 0 ? isNameToken(token) : token.text === ".");
   let alias;
@@ -1486,6 +1498,7 @@ function columnOf(tokens, start, end) {
     alias,
     aggregate,
     star,
+    expands,
     outputName,
     names
   };
@@ -1493,7 +1506,9 @@ function columnOf(tokens, start, end) {
 function ordinalReplacement(sql2, tokens, scope, clause, ordinal) {
   const column = scope.columns[ordinal - 1];
   if (column === void 0) return void 0;
-  if (scope.columns.slice(0, ordinal).some((candidate) => candidate.star)) return void 0;
+  if (scope.columns.slice(0, ordinal).some((candidate) => candidate.star || candidate.expands)) {
+    return void 0;
+  }
   if (clause === "order" && scope.setOperand) return void 0;
   const others = scope.columns.filter((candidate) => candidate !== column);
   const otherNames = new Set(others.map((candidate) => candidate.outputName));
@@ -1608,12 +1623,12 @@ function replaceOrdinals(sql2) {
     if (scope.phase === "select") {
       if (isKeyword(token, "from")) {
         if (scope.columnStart < index) {
-          scope.columns.push(columnOf(tokens, scope.columnStart, index));
+          scope.columns.push(columnOf(sql2, tokens, scope.columnStart, index));
         }
         scope.phase = "from";
       } else if (token.text === ",") {
         if (scope.columnStart < index) {
-          scope.columns.push(columnOf(tokens, scope.columnStart, index));
+          scope.columns.push(columnOf(sql2, tokens, scope.columnStart, index));
         }
         scope.columnStart = index + 1;
       }

package/package.json

@@ -11,7 +11,7 @@
   "bugs": {
     "url": "https://github.com/hidenobunagai/inline-sql-toolkit/issues"
   },
-  "version": "0.6.0",
+  "version": "0.6.2",
   "icon": "icon.png",
   "type": "module",
   "bin": {
@@ -181,6 +181,7 @@
     "fast-uri": "3.1.9",
     "glob": "14.0.3",
     "js-yaml": "4.3.2",
+    "minimatch": "11.0.1",
     "nanoid": "3.3.18",
     "postcss": "8.5.23",
     "qs": "6.16.1",