Repository navigation

fix(security): keep caller-named fields off internal columns and operators - #1056

Open

abnegate wants to merge 11 commits into

fix/injection-hardeningfrom

fix/injection-hardening-follow-ups

Open

fix(security): keep caller-named fields off internal columns and operators#1056
abnegate wants to merge 11 commits into
fix/injection-hardeningfrom
fix/injection-hardening-follow-ups

Commits on Nov 5, 2026
- fix(adapter): keep storage columns out of document writes that skip validation
  
  abnegate
  and
  claude
  committed
  e662482
- fix(sql): run ddl one statement per prepare
  
  abnegate
  and
  claude
  committed
  6014651
- fix(validator): stop allowlist regexes accepting a trailing newline
  
  abnegate
  and
  claude
  committed
  129e2ac
- fix(mongo): scope each read's maxTimeMS to its own event
  
  abnegate
  and
  claude
  committed
  7981f21
- fix(sql): let relationship ddl converge after a partial failure
  
  abnegate
  and
  claude
  committed
  8a3dfa6
- fix(pool): drop a borrowed connection's stale per-event timeouts
  
  abnegate
  and
  claude
  committed
  d62d1af
- fix(validator): refuse keys that reach a storage column once filtered
  
  abnegate
  and
  claude
  committed
  51be506
- fix(memory): refuse increments of storage columns
  
  abnegate
  and
  claude
  committed
  3240196
- docs: recommend disabling mysql multi-statements
  
  abnegate
  and
  claude
  committed
  f6e6615
- style: drop narrating comments and abbreviated catch names
  
  abnegate
  and
  claude
  committed
  c029eb4
- test(pool): expect a read adapter to clear every event's stale timeout
  
  abnegate
  and
  claude
  committed
  6bb4549