dependabot/npm_and_yarn/drizzle-orm-0.45.2

needs attention

90de5b6 · fullPR #356reviewed 2026-07-28 18:10 UTC0H · 2M · 1L · 1I

The branch

Purpose

Dependabot security bump: drizzle-orm 0.37.0 → 0.45.2 to patch SQL injection vulnerability in sql.identifier()/sql.as()

Goal

Update drizzle-orm across all 19 workspace packages to the latest patched version

Sub-goals

Bump drizzle-orm in all package.json files
Regenerate pnpm-lock.yaml

The changes (whole branch)

What: All 19 workspace package.json files updated drizzle-orm specifier from ^0.37.0 to ^0.45.2; pnpm-lock.yaml regenerated
Why: Security fix: drizzle-orm 0.45.2 patches CWE-89 SQL injection in sql.identifier() and sql.as() escaping
Areas: apps+2−2domains+5−5packages+4−4services+8−8scripts+1−1pnpm-lock.yaml+0−0
Blast: 20 files, +20/−20 across all workspace packages — package manifest only, no source changes

security-fix dependency-bump no-source-changes

➖github-ci· Token scope insufficient to read check results➖coderabbit· Skipped — bot user detected

Findings · 4

correctness1

medium

DrizzleQueryError wrapping (0.44.0) may break top-level error.code probing in several shells

domains/core/src/context/context.shells.ts:86

Shells that probe error.code === '23505' at the top level (context.shells.ts:86, credit-metering.shells.ts:134, asset.shells.ts:96, and several metrics shells) may miss unique-constraint violations if DrizzleQueryError moves PG fields to error.cause.*. Shells using the dual-probe pattern (invitation, utility-contract) are already resilient. Run integration tests before merging.

security1

info

Net security improvement: fixes SQL injection (CWE-89) in sql.identifier()/sql.as()

Codebase does not use these APIs directly (confirmed); fix is defense-in-depth. Lockfile pins 0.45.2 by content hash.

conventions2

medium

drizzle-kit@0.29.1 not bumped alongside drizzle-orm→0.45.2

packages/database/package.json

drizzle-kit and drizzle-orm are versioned in lockstep; 0.29.1 was built against 0.36–0.38.x. db:generate, db:push, and db:studio may fail on schema files using newer APIs. Bump before the next schema migration.

low

packages/event-bus not bumped — two drizzle-orm versions in lockfile (0.38.4 + 0.45.2)

packages/event-bus/package.json

Dependabot missed packages/event-bus devDependency (still ^0.38.2). No production runtime impact; hygiene fix only.