Skip to content

Audit fixes (2026-09) - #2

Merged
luthermonson merged 2 commits into
mainfrom
fix/audit-2026-09
Sep 11, 2026
Merged

luthermonson merged 2 commits into
mainfrom
fix/audit-2026-09

Conversation

@luthermonson

Copy link
Copy Markdown
Contributor

Audited DB-bridge fixes for db-laravel. Adopts the newer ephpm_db_* natives (#259-#263: run/columns/in_transaction) behind function_exists (v0.6.3 floor preserved), fixes the \'->'' escaping on the tenant path where present, and refreshes docs/CI. Tests added/updated (agent ran suites green in a php:8.3 container).

…I matrix

- translateForBridge(): insertOrIgnore()'s compiled INSERT IGNORE is rewritten to SQLite INSERT OR IGNORE; upsert()'s ON DUPLICATE KEY UPDATE is rejected with an actionable RuntimeException (Turso rejects it and no rewrite preserves its column-level semantics safely) instead of failing as opaque malformed SQL. Documented in the README not-supported list.
- Add run() to DbOpsInterface (unified execute-and-report); statement()/unprepared() route through ops->run() so a rowset-producing statement is no longer mis-routed through execute(). SapiDbOps keeps the older-ePHPm floor via a query()/execute() fallback; SqlitePdoDbOps and RecordingOps implement run().
- CI now matrixes illuminate/database ^10/^11/^12 x PHP 8.2-8.4 (verified all three majors pass locally).
- Refresh current-release string v0.8.6 -> v0.10.2 and the stale 'unreleased main' note in SapiDbOps.
@ephpm

ephpm Bot commented Sep 11, 2026 •

Copy link
Copy Markdown

ePHPm Preview — removed

Preview deployment has been torn down.

@ephpm
ephpm Bot temporarily deployed to preview-pr-2 September 11, 2026 07:01 Inactive
@ephpm
ephpm Bot temporarily deployed to preview-pr-2 September 11, 2026 07:01 Inactive
@ephpm
ephpm Bot temporarily deployed to preview-pr-2 September 11, 2026 07:01 Inactive
The test matrix pins a Laravel version per leg (composer require --no-update
+ composer update), which writes a version-pinned composer.lock on disk. The
old in-leg 'composer validate --strict' then failed the lock content-hash
check on every leg (this library ships no composer.lock). Move validation to
a separate job on a clean checkout so it validates the manifest alone.
@ephpm
ephpm Bot temporarily deployed to preview-pr-2 September 11, 2026 07:05 Inactive
@ephpm
ephpm Bot temporarily deployed to preview-pr-2 September 11, 2026 07:05 Inactive
@luthermonson
luthermonson merged commit 79a1867 into main Sep 11, 2026
9 checks passed
@luthermonson
luthermonson deleted the fix/audit-2026-09 branch September 11, 2026 07:06

This branch was successfully deployed

1 active deployment
preview-pr-2 — 0ccea5a5 Deployed Sep 11, 2026 by ephpm[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant