kysely - npm Package Compare versions

Comparing version 0.28.16 to 0.28.17

dist/cjs/dialect/mysql/mysql-query-compiler.d.ts

@@ -20,3 +20,9 @@ import type { CreateIndexNode } from '../../operation-node/create-index-node.js';
     protected sanitizeStringLiteral(value: string): string;
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

dist/cjs/dialect/mysql/mysql-query-compiler.js

@@ -5,4 +5,5 @@ "use strict";
 const default_query_compiler_js_1 = require("../../query-compiler/default-query-compiler.js");
-const LITERAL_ESCAPE_REGEX = /\\|'/g;
+const LITERAL_ESCAPE_REGEX = /[\\']/g;
 const ID_WRAP_REGEX = /`/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 class MysqlQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompiler {
@@ -43,2 +44,10 @@ getCurrentParameterPlaceholder() {
     }
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\\\\\' : char === "'" ? "''" : '\\\\"');
+    }
     visitCreateIndex(node) {
@@ -45,0 +54,0 @@ this.append('create ');

dist/cjs/dialect/sqlite/sqlite-query-compiler.d.ts

@@ -13,3 +13,4 @@ import type { DefaultInsertValueNode } from '../../operation-node/default-insert-value-node.js';
     protected sanitizeIdentifier(identifier: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitDefaultInsertValue(_: DefaultInsertValueNode): void;
 }

dist/cjs/dialect/sqlite/sqlite-query-compiler.js

@@ -6,2 +6,3 @@ "use strict";
 const ID_WRAP_REGEX = /"/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 class SqliteQueryCompiler extends default_query_compiler_js_1.DefaultQueryCompiler {
@@ -33,2 +34,5 @@ visitOrAction(node) {
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : char === "'" ? "''" : '\\"');
+    }
     visitDefaultInsertValue(_) {
@@ -35,0 +39,0 @@ // sqlite doesn't support the `default` keyword in inserts.

dist/cjs/query-builder/delete-query-builder.d.ts

@@ -656,6 +656,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -662,0 +658,0 @@ *

dist/cjs/query-builder/insert-query-builder.d.ts

@@ -755,6 +755,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -761,0 +757,0 @@ *

dist/cjs/query-builder/json-path-builder.js

@@ -12,2 +12,3 @@ "use strict";
 const value_node_js_1 = require("../operation-node/value-node.js");
+const HASH_NEGATIVE_INDEX_REGEX = /^#-\d+$/;
 class JSONPathBuilder {
@@ -86,2 +87,9 @@ #node;
     at(index) {
+        if ((typeof index !== 'number' && typeof index !== 'string') ||
+            (typeof index === 'number' && !Number.isInteger(index)) ||
+            (typeof index === 'string' &&
+                index !== 'last' &&
+                !HASH_NEGATIVE_INDEX_REGEX.test(index))) {
+            throw new Error(`Unexpected index value in .at(...): ${index}`);
+        }
         return this.#createBuilderWithPathLeg('ArrayLocation', index);
@@ -88,0 +96,0 @@ }

dist/cjs/query-builder/merge-query-builder.d.ts

@@ -133,6 +133,2 @@ import type { AliasedExpression, Expression } from '../expression/expression.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -531,6 +527,2 @@ *
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -537,0 +529,0 @@ *

dist/cjs/query-builder/returning-interface.d.ts

@@ -11,6 +11,2 @@ import type { ReturningAllRow, ReturningCallbackRow, ReturningRow } from '../parser/returning-parser.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -17,0 +13,0 @@ *

dist/cjs/query-builder/update-query-builder.d.ts

@@ -853,6 +853,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -859,0 +855,0 @@ *

dist/cjs/query-compiler/default-query-compiler.d.ts

@@ -225,2 +225,3 @@ import type { AliasNode } from '../operation-node/alias-node.js';
     protected sanitizeStringLiteral(value: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected addParameter(parameter: unknown): void;
@@ -227,0 +228,0 @@ protected appendImmediateValue(value: unknown): void;

dist/cjs/query-compiler/default-query-compiler.js

@@ -16,2 +16,3 @@ "use strict";
 const LIT_WRAP_REGEX = /'/g;
+const JSON_PATH_MEMBER_WRAP_REGEX = /['"]/g;
 class DefaultQueryCompiler extends operation_node_visitor_js_1.OperationNodeVisitor {
@@ -1172,9 +1173,13 @@ #sql = '';
         const isArrayLocation = node.type === 'ArrayLocation';
-        this.append(isArrayLocation ? '[' : '.');
-        this.append(typeof node.value === 'string'
-            ? this.sanitizeStringLiteral(node.value)
-            : String(node.value));
+        const value = String(node.value);
         if (isArrayLocation) {
+            this.append('[');
+            this.append(this.sanitizeStringLiteral(value));
             this.append(']');
         }
+        else {
+            this.append('."');
+            this.append(this.sanitizeJSONPathMemberValue(value));
+            this.append('"');
+        }
     }
@@ -1326,2 +1331,5 @@ visitJSONOperatorChain(node) {
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_WRAP_REGEX, (char) => char === "'" ? "''" : '\\"');
+    }
     addParameter(parameter) {
@@ -1328,0 +1336,0 @@ this.#parameters.push(parameter);

dist/esm/dialect/mysql/mysql-query-compiler.d.ts

@@ -20,3 +20,9 @@ import type { CreateIndexNode } from '../../operation-node/create-index-node.js';
     protected sanitizeStringLiteral(value: string): string;
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitCreateIndex(node: CreateIndexNode): void;
 }

dist/esm/dialect/mysql/mysql-query-compiler.js

 /// <reference types="./mysql-query-compiler.d.ts" />
 import { DefaultQueryCompiler } from '../../query-compiler/default-query-compiler.js';
-const LITERAL_ESCAPE_REGEX = /\\|'/g;
+const LITERAL_ESCAPE_REGEX = /[\\']/g;
 const ID_WRAP_REGEX = /`/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 export class MysqlQueryCompiler extends DefaultQueryCompiler {
@@ -40,2 +41,10 @@ getCurrentParameterPlaceholder() {
     }
+    /**
+     * Member values appear inside `"..."` in the JSON path, which itself sits
+     * inside a SQL string literal. They must therefore be escaped twice — once
+     * for the JSON path grammar, then again for MySQL's string literal parser.
+     */
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\\\\\' : char === "'" ? "''" : '\\\\"');
+    }
     visitCreateIndex(node) {
@@ -42,0 +51,0 @@ this.append('create ');

dist/esm/dialect/sqlite/sqlite-query-compiler.d.ts

@@ -13,3 +13,4 @@ import type { DefaultInsertValueNode } from '../../operation-node/default-insert-value-node.js';
     protected sanitizeIdentifier(identifier: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected visitDefaultInsertValue(_: DefaultInsertValueNode): void;
 }

dist/esm/dialect/sqlite/sqlite-query-compiler.js

 /// <reference types="./sqlite-query-compiler.d.ts" />
 import { DefaultQueryCompiler } from '../../query-compiler/default-query-compiler.js';
 const ID_WRAP_REGEX = /"/g;
+const JSON_PATH_MEMBER_ESCAPE_REGEX = /[\\'"]/g;
 export class SqliteQueryCompiler extends DefaultQueryCompiler {
@@ -30,2 +31,5 @@ visitOrAction(node) {
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_ESCAPE_REGEX, (char) => char === '\\' ? '\\\\' : char === "'" ? "''" : '\\"');
+    }
     visitDefaultInsertValue(_) {
@@ -32,0 +36,0 @@ // sqlite doesn't support the `default` keyword in inserts.

dist/esm/query-builder/delete-query-builder.d.ts

@@ -656,6 +656,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -662,0 +658,0 @@ *

dist/esm/query-builder/insert-query-builder.d.ts

@@ -755,6 +755,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -761,0 +757,0 @@ *

dist/esm/query-builder/json-path-builder.js

@@ -10,2 +10,3 @@ /// <reference types="./json-path-builder.d.ts" />
 import { ValueNode } from '../operation-node/value-node.js';
+const HASH_NEGATIVE_INDEX_REGEX = /^#-\d+$/;
 export class JSONPathBuilder {
@@ -84,2 +85,9 @@ #node;
     at(index) {
+        if ((typeof index !== 'number' && typeof index !== 'string') ||
+            (typeof index === 'number' && !Number.isInteger(index)) ||
+            (typeof index === 'string' &&
+                index !== 'last' &&
+                !HASH_NEGATIVE_INDEX_REGEX.test(index))) {
+            throw new Error(`Unexpected index value in .at(...): ${index}`);
+        }
         return this.#createBuilderWithPathLeg('ArrayLocation', index);
@@ -86,0 +94,0 @@ }

dist/esm/query-builder/merge-query-builder.d.ts

@@ -133,6 +133,2 @@ import type { AliasedExpression, Expression } from '../expression/expression.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -531,6 +527,2 @@ *
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -537,0 +529,0 @@ *

dist/esm/query-builder/returning-interface.d.ts

@@ -11,6 +11,2 @@ import type { ReturningAllRow, ReturningCallbackRow, ReturningRow } from '../parser/returning-parser.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -17,0 +13,0 @@ *

dist/esm/query-builder/update-query-builder.d.ts

@@ -853,6 +853,2 @@ import type { OperationNodeSource } from '../operation-node/operation-node-source.js';
      *
-     * Note that on SQLite you need to give aliases for the expressions to avoid
-     * [this bug](https://sqlite.org/forum/forumpost/033daf0b32) in SQLite.
-     * For example `.returning('id as id')`.
-     *
      * Also see the {@link returningAll} method.
@@ -859,0 +855,0 @@ *

dist/esm/query-compiler/default-query-compiler.d.ts

@@ -225,2 +225,3 @@ import type { AliasNode } from '../operation-node/alias-node.js';
     protected sanitizeStringLiteral(value: string): string;
+    protected sanitizeJSONPathMemberValue(value: string): string;
     protected addParameter(parameter: unknown): void;
@@ -227,0 +228,0 @@ protected appendImmediateValue(value: unknown): void;

dist/esm/query-compiler/default-query-compiler.js

@@ -14,2 +14,3 @@ /// <reference types="./default-query-compiler.d.ts" />
 const LIT_WRAP_REGEX = /'/g;
+const JSON_PATH_MEMBER_WRAP_REGEX = /['"]/g;
 export class DefaultQueryCompiler extends OperationNodeVisitor {
@@ -1170,9 +1171,13 @@ #sql = '';
         const isArrayLocation = node.type === 'ArrayLocation';
-        this.append(isArrayLocation ? '[' : '.');
-        this.append(typeof node.value === 'string'
-            ? this.sanitizeStringLiteral(node.value)
-            : String(node.value));
+        const value = String(node.value);
         if (isArrayLocation) {
+            this.append('[');
+            this.append(this.sanitizeStringLiteral(value));
             this.append(']');
         }
+        else {
+            this.append('."');
+            this.append(this.sanitizeJSONPathMemberValue(value));
+            this.append('"');
+        }
     }
@@ -1324,2 +1329,5 @@ visitJSONOperatorChain(node) {
     }
+    sanitizeJSONPathMemberValue(value) {
+        return value.replace(JSON_PATH_MEMBER_WRAP_REGEX, (char) => char === "'" ? "''" : '\\"');
+    }
     addParameter(parameter) {
@@ -1326,0 +1334,0 @@ this.#parameters.push(parameter);

package.json

 {
   "name": "kysely",
-  "version": "0.28.16",
+  "version": "0.28.17",
   "description": "Type safe SQL query builder",
@@ -5,0 +5,0 @@ "repository": {

README.md

 [![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner2-direct.svg)](https://stand-with-ukraine.pp.ua)
 
 [![NPM Version](https://img.shields.io/npm/v/kysely?style=flat&label=latest)](https://github.com/kysely-org/kysely/releases/latest)
-[![Socket Badge](https://badge.socket.dev/npm/package/kysely/0.28.16)](https://socket.dev/npm/package/kysely/overview/0.28.16)
+[![Socket Badge](https://badge.socket.dev/npm/package/kysely/0.28.17)](https://socket.dev/npm/package/kysely/overview/0.28.17)
 [![Tests](https://github.com/kysely-org/kysely/actions/workflows/test.yml/badge.svg)](https://github.com/kysely-org/kysely)
@@ -6,0 +6,0 @@ [![License](https://img.shields.io/github/license/kysely-org/kysely?style=flat)](https://github.com/kysely-org/kysely/blob/master/LICENSE)

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

3289226

0.04%

Lines of code

91139

0.03%

No dependency changes