@mikro-orm/core - npm Package Compare versions

Comparing version 7.2.0-dev.9 to 7.2.0-dev.10

package.json

 {
   "name": "@mikro-orm/core",
-  "version": "7.2.0-dev.9",
+  "version": "7.2.0-dev.10",
   "description": "TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Supports MongoDB, MySQL, PostgreSQL and SQLite databases as well as usage with vanilla JavaScript.",
@@ -5,0 +5,0 @@ "keywords": [

utils/RawQueryFragment.d.ts

@@ -64,2 +64,8 @@ import type { AnyString, Dictionary, EntityKey } from '../typings.js';
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
@@ -66,0 +72,0 @@ *

utils/RawQueryFragment.js

@@ -149,2 +149,8 @@ import { Utils } from './Utils.js';
  *
+ * Named parameters are supported via an object of parameters, use `:name` for values and `:name:` for identifiers:
+ *
+ * ```ts
+ * raw('select :col: from geo where city = :city or region = :city', { col: 'city', city: 'Brno' });
+ * ```
+ *
  * You can also use the `sql` tagged template function, which works the same, but supports only the simple string signature:
@@ -195,9 +201,12 @@ *
     if (typeof params === 'object' && !Array.isArray(params)) {
-        const pairs = Object.entries(params);
+        const dict = params;
         const objectParams = [];
-        for (const [key, value] of pairs) {
-            sql = sql.replace(`:${key}:`, '??');
-            sql = sql.replace(`:${key}`, '?');
-            objectParams.push(value);
-        }
+        // single left-to-right scan keeps values in SQL-placeholder order while `::` casts and unknown tokens stay untouched
+        sql = sql.replace(/(?<!:):([$\w]+)(:(?!:))?/g, (match, key, identifier) => {
+            if (!Object.hasOwn(dict, key)) {
+                return match;
+            }
+            objectParams.push(dict[key]);
+            return identifier ? '??' : '?';
+        });
         return new RawQueryFragment(sql, objectParams);
@@ -204,0 +213,0 @@ }

utils/Utils.js

@@ -156,3 +156,3 @@ import { clone } from './clone.js';
     static PK_SEPARATOR = '~~~';
-    static #ORM_VERSION = '7.2.0-dev.9';
+    static #ORM_VERSION = '7.2.0-dev.10';
     /**
@@ -159,0 +159,0 @@ * Checks if the argument is instance of `Object`. Returns false for arrays.

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

1588410

0.04%

Lines of code

33877

0.04%

Number of low supply chain risk alerts

8

-11.11%

No dependency changes