fix: validate session variable assignments - #18290
Conversation
Backport of #18272 to v6. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
pg-native 3.8.0 uses `??`, which Node 10 cannot parse, so requiring it throws a SyntaxError before any test runs. Node 18 keeps using the current release. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
@denyspakizh-tob what do you think about this PR? |
pg-native 3.8.0 uses `??`, which Node 10 cannot parse, so requiring it throws a SyntaxError before any test runs. Pin the last release Node 10 can load and keep newer Node versions on the current one. Ported from #18290 so that the backport there stays limited to its own change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
LGTM |
Backport of #18272 to v6.
sequelize.set()builds itsSETstatement by interpolating both keys and values directly. Values now go through the normal escaping path, and names are validated against the 1-64 character unquoted user-variable grammar.Added unit coverage for the generated SQL and integration coverage for the round-trip.
Also pins
pg-nativeto 3.7.0 on the Node 10 legs of the Postgres matrix. 3.8.0 uses??, which Node 10 cannot parse, so requiring it throws aSyntaxErrorbefore any test runs. This is unrelated to the backport and was already failing onv6.List of Breaking Changes
Quoted user-variable names, such as
`my var`,'x', or"x", are now rejected. Use an unquoted name matching the supported grammar.🤖 Generated with Claude Code