objection 2.2.14 → 2.2.18

package/lib/relations/RelationOwner.js

@@ -71,9 +71,11 @@ class RelationOwner {
       if (values) {
         builder.whereInComposite(relatedRefs, values);
       } else {
+        builder.where(false);
         builder.resolve([]);
       }
     } else {
+      builder.where(false);
       builder.resolve([]);
     }
 

package/lib/utils/objectUtils.js

@@ -189,7 +189,6 @@ function once(func) {
 
 function flatten(arrays) {
   const out = [];
-  let outIdx = 0;
 
   for (let i = 0, l = arrays.length; i < l; ++i) {
     const value = arrays[i];
@@ -225,6 +224,11 @@ function set(obj, path, value) {
 
   for (let i = 0, l = path.length - 1; i < l; ++i) {
     const key = path[i];
+
+    if (!isSafeKey(key)) {
+      return inputObj;
+    }
+
     let child = obj[key];
 
     if (!isObject(child)) {
@@ -243,7 +247,11 @@ function set(obj, path, value) {
   }
 
   if (path.length > 0 && isObject(obj)) {
-    obj[path[path.length - 1]] = value;
+    const key = path[path.length - 1];
+
+    if (isSafeKey(key)) {
+      obj[key] = value;
+    }
   }
 
   return inputObj;
@@ -253,7 +261,11 @@ function zipObject(keys, values) {
   const out = {};
 
   for (let i = 0, l = keys.length; i < l; ++i) {
-    out[keys[i]] = values[i];
+    const key = keys[i];
+
+    if (isSafeKey(key)) {
+      out[key] = values[i];
+    }
   }
 
   return out;
@@ -357,6 +369,10 @@ function compareStrict(val1, val2) {
   return val1 === val2;
 }
 
+function isSafeKey(key) {
+  return isNumber(key) || (isString(key) && key !== '__proto__');
+}
+
 module.exports = {
   isEmpty,
   isString,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "objection",
-  "version": "2.2.14",
+  "version": "2.2.18",
   "description": "An SQL-friendly ORM for Node.js",
   "main": "lib/objection.js",
   "license": "MIT",
@@ -65,7 +65,7 @@
     "db-errors": "^0.2.3"
   },
   "peerDependencies": {
-    "knex": "0.x"
+    "knex": "<0.95.0"
   },
   "devDependencies": {
     "@types/node": "^14.14.13",

package/typings/objection/index.d.ts

@@ -58,7 +58,9 @@ declare namespace Objection {
     ): ValueBuilder;
   }
 
-  export interface ReferenceBuilder extends Castable {}
+  export interface ReferenceBuilder extends Castable {
+    from(tableReference: string): this;
+  }
   export interface ReferenceFunction {
     (expression: string): ReferenceBuilder;
   }
@@ -752,8 +754,8 @@ declare namespace Objection {
   export interface GraphOptions {
     minimize?: boolean;
     separator?: string;
-    aliases?: string[];
-    joinOperation: string;
+    aliases?: {[key: string]: string};
+    joinOperation?: string;
     maxBatchSize?: number;
   }
 
@@ -1080,11 +1082,6 @@ declare namespace Objection {
     // Deprecated
     omit(properties: string[]): this;
 
-    traverse(filterConstructor: typeof Model, traverser: TraverserFunction): R;
-    traverse(traverser: TraverserFunction): R;
-    traverseAsync(filterConstructor: typeof Model, traverser: TraverserFunction): Promise<R>;
-    traverseAsync(traverser: TraverserFunction): Promise<R>;
-
     page(page: number, pageSize: number): PageQueryBuilder<this>;
     range(): PageQueryBuilder<this>;
     range(start: number, end: number): PageQueryBuilder<this>;
@@ -1509,6 +1506,12 @@ declare namespace Objection {
       models: Model | Model[],
       traverser: TraverserFunction
     ): void;
+    traverseAsync(models: Model | Model[], traverser: TraverserFunction): Promise<void>;
+    traverseAsync(
+      filterConstructor: ModelConstructor<Model>,
+      models: Model | Model[],
+      traverser: TraverserFunction
+    ): Promise<void>;
 
     beforeFind(args: StaticHookArguments<any>): any;
     afterFind(args: StaticHookArguments<any>): any;
@@ -1644,6 +1647,12 @@ declare namespace Objection {
       models: Model | Model[],
       traverser: TraverserFunction
     ): void;
+    static traverseAsync(models: Model | Model[], traverser: TraverserFunction): Promise<void>;
+    static traverseAsync(
+      filterConstructor: typeof Model,
+      models: Model | Model[],
+      traverser: TraverserFunction
+    ): Promise<void>;
 
     static beforeFind(args: StaticHookArguments<any>): any;
     static afterFind(args: StaticHookArguments<any>): any;