knex 3.2.7 → 3.2.9

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Master (Unreleased)
 
+# 3.2.9 - 3 April, 2026
+
+### Bug fixes
+
+- fix: support DELETE... LIMIT in dialects that support it (mysql), but continue to disallow ones that don't [#6429](https://github.com/knex/knex/issues/6429)
+- fix(postgres): escape double quotes in searchPath to prevent SQL injection [#6411](https://github.com/knex/knex/issues/6411)
+- fix(sqlite): append RETURNING statement when insert empty row [#5471](https://github.com/knex/knex/issues/5471)
+- fix: add type support for Array<Buffer> [#6428](https://github.com/knex/knex/issues/6428)
+
+# 3.2.8 - 30 March, 2026
+
+### Bug fixes
+
+- Reverts the breaking changes added in [#6227](https://github.com/knex/knex/issues/6227). This means that the ESM import of Knex is reverted to `import { knex } from 'knex/knex.mjs` [#6422](https://github.com/knex/knex/issues/6422)
+- fix(types): allow a `QueryBuilder` type as a value in an `update` [#6419](https://github.com/knex/knex/issues/6419)
+
 # 3.2.7 - 27 March, 2026
 
 ### Bug fixes

package/knex.mjs

@@ -4,7 +4,6 @@
 //     Knex may be freely distributed under the MIT license.
 //     For details and documentation:
 //     http://knexjs.org
-
 import knex from './lib/index.js';
 
 export { knex };

package/lib/dialects/mysql/query/mysql-querycompiler.js

@@ -27,12 +27,15 @@ class QueryCompiler_MySQL extends QueryCompiler {
 
     this._emptyInsertValue = '() values ()';
   }
-  // Compiles an `delete` allowing comments
+  // Compiles a `delete` query, allowing comments and LIMIT.
   del() {
     const sql = super.del();
     if (sql === '') return sql;
     const comments = this.comments();
-    return (comments === '' ? '' : comments + ' ') + sql;
+    const limit = this.limit();
+    return (
+      (comments === '' ? '' : comments + ' ') + sql + (limit ? ` ${limit}` : '')
+    );
   }
 
   // Compiles an `insert` query, allowing for multiple
@@ -287,6 +290,12 @@ class QueryCompiler_MySQL extends QueryCompiler {
   }
 }
 
+// MySQL supports LIMIT on single-table DELETE statements.
+QueryCompiler_MySQL.prototype.invalidClauses = {
+  delete: ['having'],
+  truncate: ['where', 'having', 'limit'],
+};
+
 // Set the QueryBuilder & QueryCompiler on the client object,
 // in case anyone wants to modify things to suit their own purposes.
 module.exports = QueryCompiler_MySQL;

package/lib/dialects/postgres/index.js

@@ -174,7 +174,9 @@ class Client_PG extends Client {
       path = [path];
     }
 
-    path = path.map((schemaName) => `"${schemaName}"`).join(',');
+    path = path
+      .map((schemaName) => `"${schemaName.replace(/"/g, '""')}"`)
+      .join(',');
 
     return new Promise(function (resolver, rejecter) {
       connection.query(`set search_path to ${path}`, function (err) {

package/lib/dialects/sqlite3/query/sqlite-querycompiler.js

@@ -42,14 +42,16 @@ class QueryCompiler_SQLite3 extends QueryCompiler {
         insertValues[0] &&
         isEmpty(insertValues[0])
       ) {
-        return {
-          sql: sql + this._emptyInsertValue,
-        };
+        sql += this._emptyInsertValue;
+        const { returning } = this.single;
+        if (returning) sql += this._returning(returning);
+        return { sql, returning };
       }
     } else if (typeof insertValues === 'object' && isEmpty(insertValues)) {
-      return {
-        sql: sql + this._emptyInsertValue,
-      };
+      sql += this._emptyInsertValue;
+      const { returning } = this.single;
+      if (returning) sql += this._returning(returning);
+      return { sql, returning };
     }
 
     const insertData = this._prepInsert(insertValues);

package/lib/query/querycompiler.js

@@ -48,7 +48,7 @@ const methodAliases = {
   first: 'select',
   pluck: 'select',
 };
-const invalidClauses = {
+const defaultInvalidClauses = {
   delete: ['having', 'limit'],
   truncate: ['where', 'having', 'limit'],
 };
@@ -77,9 +77,12 @@ class QueryCompiler {
     this.builder = this.formatter.builder;
   }
 
-  // Categorically refuse to execute certain queries that have defined certain clause groups
+  // Categorically refuse to execute certain queries that have defined certain clause groups.
   // For example, if a "having" clause is defined but we're executing a "delete" query, that
   // is never valid in any of the supported dialects.
+  //
+  // Dialects override `invalidClauses` on the prototype to adjust which clauses are
+  // disallowed for each verb (e.g. MySQL allows `limit` on `delete`).
   _preValidate() {
     // Query builders don't really store the SQL verb they expect to generate; this would
     // be nicer if we could avoid the fanout of "call an arbitrary method on one of a dozen
@@ -87,12 +90,13 @@ class QueryCompiler {
     // methods used by the codebase for now.
     const method = this.method;
     const verb = hasOwn(methodAliases, method) ? methodAliases[method] : method;
-    if (!hasOwn(invalidClauses, verb)) return;
+
+    const invalid = this.invalidClauses[verb];
+    if (!invalid) return;
 
     // For certain verbs, certain clauses just don't exist / aren't supported. The list
     // here is intentionally not complete; it's just checking the things that allow users
     // to make dangerous errors.
-    const invalid = invalidClauses[verb];
     for (let i = 0; i < invalid.length; i++) {
       const clause = invalid[i];
 
@@ -1631,4 +1635,6 @@ class QueryCompiler {
   }
 }
 
+QueryCompiler.prototype.invalidClauses = defaultInvalidClauses;
+
 module.exports = QueryCompiler;

package/package.json

@@ -1,31 +1,9 @@
 {
   "name": "knex",
-  "version": "3.2.7",
+  "version": "3.2.9",
   "description": "A batteries-included SQL query & schema builder for PostgresSQL, MySQL, CockroachDB, MSSQL and SQLite3",
   "main": "knex.js",
   "types": "types/index.d.ts",
-  "exports": {
-    ".": {
-      "import": {
-        "types": "./types/index.d.mts",
-        "default": "./knex.mjs"
-      },
-      "require": {
-        "types": "./types/index.d.ts",
-        "default": "./knex.js"
-      }
-    },
-    "./bin/*.js": "./bin/*.js",
-    "./bin/*": "./bin/*",
-    "./types/*.d.ts": "./types/*.d.ts",
-    "./types/*": "./types/*.d.ts",
-    "./lib/*.js": "./lib/*.js",
-    "./lib/*": "./lib/*.js",
-    "./knex": "./knex.js",
-    "./knex.js": "./knex.js",
-    "./knex.mjs": "./knex.mjs",
-    "./package.json": "./package.json"
-  },
   "engines": {
     "node": ">=16"
   },
@@ -162,7 +140,6 @@
     "pg": "^8.20.0",
     "pg-query-stream": "^4.14.0",
     "prettier": "2.8.7",
-    "resolve.exports": "^2.0.3",
     "rimraf": "^5.0.5",
     "semver": "^7.7.4",
     "sinon": "^15.0.1",

package/types/index.d.ts

@@ -501,9 +501,12 @@ declare namespace Knex {
     | Array<Date>
     | Array<boolean>
     | Buffer
+    | Array<Buffer>
     | Record<string, unknown>
     | Knex.Raw;
 
+  type ValueOrBuilder = Value | Knex.QueryBuilder;
+
   interface ValueDict extends Dict<Value | Knex.QueryBuilder> {}
   interface AliasDict extends Dict<string> {}
 
@@ -1018,7 +1021,7 @@ declare namespace Knex {
       >[]
     >(
       columnName: K1,
-      value: DbColumn<ResolveTableType<TRecord, 'update'>[K1]>,
+      value: DbColumn<ResolveTableType<TRecord, 'update'>[K1]> | QueryBuilder,
       returning: readonly K2[],
       options?: DMLOptions
     ): QueryBuilder<TRecord, TResult2>;
@@ -1028,7 +1031,7 @@ declare namespace Knex {
     ): QueryBuilder<TRecord, number>;
     update<TResult2 = SafePartial<TRecord>[]>(
       columnName: string,
-      value: Value,
+      value: ValueOrBuilder,
       returning: string | readonly string[],
       options?: DMLOptions
     ): QueryBuilder<TRecord, TResult2>;
@@ -1101,7 +1104,7 @@ declare namespace Knex {
 
     update<TResult2 = number>(
       columnName: string,
-      value: Value
+      value: ValueOrBuilder
     ): QueryBuilder<TRecord, TResult2>;
 
     returning(

package/types/index.d.mts

@@ -1,14 +0,0 @@
-// ESM-specific types for Knex.js
-// This file provides ESM type definitions that wrap the CJS types from index.d.ts
-// to match the exports defined in knex.mjs
-
-import type { Knex } from './index.d.ts';
-
-// Re-declare the knex factory function for ESM consumers.
-// This matches the call signature from the CJS types.
-declare function knex<TRecord extends {} = any, TResult = unknown[]>(
-  config: Knex.Config | string
-): Knex<TRecord, TResult>;
-
-export { knex, Knex };
-export default knex;