Repository navigation

Issues

New issue

Knex: The grand plan!
#6321 · mercmobily opened on Dec 9, 2025
2
Get involved! Get on Discord, tackle critical bugs
#6322 mercmobily opened on Dec 9, 2025
2

[Security] SQL Injection in CREATE VIEW via Inlined Query Bindings
knex/knex#6562 · opened on Nov 4, 2026
PostgreSQL: executionPromise resolves when COMMIT is answered with ROLLBACK (aborted transaction)
knex/knex#6547 · opened on Oct 17, 2026
Connection returned to the pool with an open transaction when ROLLBACK or COMMIT fails on the client (e.g. pg query_timeout)
knex/knex#6546 · opened on Oct 17, 2026
SQLite: a failed COMMIT leaves the connection inside the transaction, every later BEGIN fails
knex/knex#6544 · opened on Oct 15, 2026
SQLite: transactions that read then write fail with SQLITE_BUSY despite busy_timeout (allow BEGIN IMMEDIATE)
knex/knex#6542 · opened on Oct 6, 2026
[Security] SQL Injection in Oracle Dialect JSON Path Handling (_jsonPathWrap())
knex/knex#6539 · opened on Sep 24, 2026
Allow readonly string[] for withRecursive column names
knex/knex#6528 · opened on Sep 3, 2026
Expose QueryBuilder and Raw classes from the main entry point (deep import into knex/lib/* has no types)
knex/knex#6524 · opened on Aug 30, 2026
2
v3.3.0 (oracledb): "DPI-1011: connection was not acquired from a session pool" on destroyRawConnection
knex/knex#6519 · opened on Aug 25, 2026
How to use LifecycleHook in practice
knex/knex#6518 · opened on Aug 23, 2026
1
QOL Feat: Infer types from typed raw in keyed select
knex/knex#6513 · opened on Aug 11, 2026
[Security] SQL Injection via JSON default values in formatDefault() (CWE-89)
knex/knex#6509 · opened on Jul 31, 2026
onConflict().merge() without column args emits invalid SQL — columns===true guard missing in _merge()
knex/knex#6504 · opened on Jul 22, 2026
Could not resolve "mariadb/callback"
knex/knex#6498 · opened on Jul 2, 2026
sqlite3: spurious connection.filename warning when connection is a function
knex/knex#6495 · opened on Jun 29, 2026
Proposal: commit a lockfile and use npm ci for reliable CI
knex/knex#6469 · opened on Jun 11, 2026
Feature request: dropIndexIfExists schema builder method
knex/knex#6467 · opened on Jun 10, 2026
Enable creating gist_trgm_ops indexes
knex/knex#6459 · opened on May 31, 2026
1
Type mismatch in transaction callback when manually calling trx.commit(value)
knex/knex#6435 · opened on Apr 26, 2026
1
[Security] SQL injection in MSSQL and Oracle DDL operations
knex/knex#6432 · opened on Apr 10, 2026
idea: migration-aware backward compatible flags or aliases
< 7297 span class="trailingBadgesContainer__4AEjpg">
knex/knex#6425 · opened on Apr 1, 2026
Ability to create a schema "dump"
knex/knex#6424 · opened on Apr 1, 2026
1
Meta: 4.0 Release Ideas
knex/knex#6409 · opened on Mar 25, 2026
5
TracingChannel Proposal for observability
knex/knex#6394 · opened on Mar 17, 2026
1
Switch docs deployment to GitHub Pages official actions
knex/knex#6367 · opened on Jan 23, 2026

Navigation Menu

Repository navigation

Issues

Issues

[Security] SQL Injection in CREATE VIEW via Inlined Query Bindings

PostgreSQL: `executionPromise` resolves when COMMIT is answered with ROLLBACK (aborted transaction)

Connection returned to the pool with an open transaction when ROLLBACK or COMMIT fails on the client (e.g. pg `query_timeout`)

SQLite: a failed COMMIT leaves the connection inside the transaction, every later BEGIN fails

SQLite: transactions that read then write fail with SQLITE_BUSY despite busy_timeout (allow BEGIN IMMEDIATE)

[Security] SQL Injection in Oracle Dialect JSON Path Handling (_jsonPathWrap())

Allow `readonly string[]` for `withRecursive` column names

Expose QueryBuilder and Raw classes from the main entry point (deep import into knex/lib/* has no types)

v3.3.0 (oracledb): "DPI-1011: connection was not acquired from a session pool" on destroyRawConnection

How to use `LifecycleHook` in practice

QOL Feat: Infer types from typed raw in keyed select

[Security] SQL Injection via JSON default values in formatDefault() (CWE-89)

onConflict().merge() without column args emits invalid SQL — columns===true guard missing in _merge()

Could not resolve "mariadb/callback"

sqlite3: spurious `connection.filename` warning when `connection` is a function

Proposal: commit a lockfile and use npm ci for reliable CI

Feature request: dropIndexIfExists schema builder method

Enable creating gist_trgm_ops indexes

Type mismatch in transaction callback when manually calling trx.commit(value)

[Security] SQL injection in MSSQL and Oracle DDL operations

idea: migration-aware backward compatible flags or aliases

Ability to create a schema "dump"

Meta: 4.0 Release Ideas

`TracingChannel` Proposal for observability

Switch docs deployment to GitHub Pages official actions