ReviewOS

stacks/bun-query-builder

public
Clone

Push over the same URL. A password will not work: create a token under access tokens and use it in place of one.

Star 0 Watch 0

A safe, performant & fully-typed query builder for Bun.

  • Open
    fix(types): publish portable declarations without private source aliases

    #1201 opened 2 hours ago by chris

  • Closed
    Qualified cursor columns lose the next-page cursor in joined queries

    #1199 opened 5 days ago by chris

  • Closed
    SQL injection: the LIKE family, reorder, the avg/sum/max/min aggregates and the belongsToMany filters interpolate column names unvalidated

    #1198 opened 6 days ago by glennmichael123 · 1 comment

  • Closed
    ci(release): a slow npm readback fails the release and skips the GitHub release and binaries

    #1197 opened 6 days ago by glennmichael123 · 1 comment

  • Closed
    fix(orm): an update that sets updated_at assigns it twice, which Postgres refuses

    #1196 opened 6 days ago by glennmichael123

  • Closed
    A join cannot alias its table, so a self-join cannot be written

    #1195 opened 7 days ago by glennmichael123

  • Closed
    A schema.unix() attribute is generated as integer on Postgres, so millisecond timestamps overflow it

    #1194 opened 7 days ago by glennmichael123

  • Closed
    A multi-row insert takes its column list from the first row, so keys only present in later rows are silently dropped

    #1189 opened 8 days ago by glennmichael123

  • Closed
    SQL injection: window functions interpolate partitionBy, orderBy, column and alias unvalidated

    #1185 opened 8 days ago by glennmichael123

  • Closed
    toArray() does not apply hidden: true, so password/token attributes serialize in full

    #1182 opened 8 days ago by glennmichael123

  • Closed
    SQL injection: orderBy/groupBy/select interpolate column names unvalidated, while where/join validate them

    #1181 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    timestamptz is indistinguishable from datetime on MySQL, so it does not round-trip and the drift auditor must excuse it

    #1179 opened 8 days ago by glennmichael123 · 2 comments

  • Closed
    auditSchemaDrift cannot report a naive-vs-aware timestamp mismatch, and `other` passes everything

    #1177 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    auditSchemaDrift cannot see naive-vs-aware timestamps, so a timestamptz column under a datetime model reports clean

    #1176 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    unsafe() executes ?-style placeholders on Postgres, failing at the wrong token

    #1171 opened 8 days ago by glennmichael123

  • Closed
    test: make JSON helper smoke test dialect-independent

    #1165 opened 8 days ago by chris · 1 comment

  • Closed
    perf: add a narrow SQL runtime entry

    #1164 opened 8 days ago by chris · 1 comment

  • Closed
    SQLite: a belongsTo FK added to an existing table is dropped — ADD COLUMN omits inline REFERENCES

    #1154 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    returningAll() emits RETURNING * on MySQL, so every write using it fails with a syntax error

    #1153 opened 8 days ago by glennmichael123

  • Closed
    whereRaw(sql, [value]) type-checks and is accepted, then throws once another clause binds and on every write, and the docs teach that form

    #1146 opened 8 days ago by glennmichael123

  • Closed
    hooks: native SQL metadata loss in 0.2.69 (duplicate of #1142)

    #1145 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    fix(transactions): afterCommit errors retry already-committed writes

    #1144 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    fix(cache): isolate cached results by SQL, bindings and connection

    #1143 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    fix(hooks): MySQL query events report [object Promise] instead of SQL

    #1142 opened 8 days ago by glennmichael123 · 1 comment

  • Closed
    executeMigration discards its dir argument, and cannot run a corpus spread across directories

    #1137 opened 8 days ago by glennmichael123

  • Closed
    configureOrm installs a globalDb that can never be released

    #1134 opened 8 days ago by chris · 1 comment

  • Closed
    having() and havingRaw() infer HAVING vs AND from the statement text, so the first HAVING fuses onto the GROUP BY list

    #1122 opened 2 months ago by glennmichael123

  • Closed
    Clause placement scans SQL text, so a raw fragment can swallow the WHERE or the JOIN and the query silently returns the wrong rows

    #1121 opened 2 months ago by glennmichael123

  • Closed
    A where() after a set operator emits AND, so the statement fails to parse

    #1120 opened 2 months ago by glennmichael123

  • Closed
    An array value in object-form where() means IN on a SELECT but matches nothing on UPDATE/DELETE

    #1114 opened 2 months ago by glennmichael123