Skip to content

chore(deps): bump drizzle-orm from 1.0.0-beta.15-859cf75 to 1.0.0-beta.20 - #259

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/drizzle-orm-1.0.0-beta.20
Open

chore(deps): bump drizzle-orm from 1.0.0-beta.15-859cf75 to 1.0.0-beta.20#259
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/drizzle-orm-1.0.0-beta.20

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 8, 2026

Copy link
Copy Markdown
Contributor

Bumps drizzle-orm from 1.0.0-beta.15-859cf75 to 1.0.0-beta.20.

Release notes

Sourced from drizzle-orm's releases.

1.0.0-beta.20

  • Fixed sql.identifier(), sql.as() escaping issues. Previously all the values passed to this functions were not properly escaped causing a possible SQL Injection (CWE-89) vulnerability

Thanks to @​EthanKim88, @​0x90sh and @​wgoodall01 for reaching out to us with a reproduction and suggested fix

v1.0.0-beta.19

New Features

sqlcommenter support for PostgreSQL and MySQL

You can now add custom tags to the query. These tags will be appended to the end of each query, helping the database add metadata/tags to it. This will be especially useful with PlanetScale’s new Database Traffic Control feature

// raw string support
db.select().from().comment("key='val'");
db.select().from().comment("my_first_tag");
// developer friendly dedicated to tags
db.select().from().comment({ key: 'val' });

Example:

db.select().from(comments).comment({ priority: 'high', category: "analytics" });
select "id", "name" from "comments" /*priority='high',category='analytics'*/

The only limitation is that you can't use comments with a prepared statement:

// can't be used
const p = db.select().from().prepare();
// ❌
p.comment({ key: 'val' }).execute();

Bug fixes

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 8, 2026
@vercel

vercel Bot commented Apr 8, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sreetamdas-com Error Error Apr 20, 2026 10:31am

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Apr 8, 2026

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs
sreetamdas-com 4e769e7 Apr 20 2026, 10:31 AM

Bumps [drizzle-orm](https://github.com/drizzle-team/drizzle-orm) from 1.0.0-beta.15-859cf75 to 1.0.0-beta.20.
- [Release notes](https://github.com/drizzle-team/drizzle-orm/releases)
- [Commits](https://github.com/drizzle-team/drizzle-orm/commits/v1.0.0-beta.20)

---
updated-dependencies:
- dependency-name: drizzle-orm
  dependency-version: 1.0.0-beta.20
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/drizzle-orm-1.0.0-beta.20 branch from beaa291 to 4e769e7 Compare April 20, 2026 10:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants