Skip to content

feat: remove cjs support, move to esm#24

Open
JackDevAU wants to merge 8 commits intomainfrom
feat/remove-cjs-fix-bugs
Open

feat: remove cjs support, move to esm#24
JackDevAU wants to merge 8 commits intomainfrom
feat/remove-cjs-fix-bugs

Conversation

@JackDevAU
Copy link
Member

@JackDevAU JackDevAU commented Dec 4, 2025

This is a major version change

Description:

Migrate from cjs to esm, replace Jest with Vitest, fix SQL injection vulnerabilities, improve type safety, and add comprehensive test coverage.

What was Added/Changed:

Package.json

  • Added "type": "module" and exports field for ESM support
  • Replaced Jest with Vitest (vitest: ^2.1.0)
  • Removed @tinacms/scripts, ts-jest, jest and related dependencies
  • Removed sucrase peer dependency
  • Added typedoc: ^0.28.15 for documentation generation
  • Updated scripts: build now uses tsc directly, test uses vitest run

src/index.ts

  • Fixed SQL injection vulnerability by using parameterized queries instead of string interpolation
  • Changed _batch to use SQLite transactions with prepared statements
  • Changed _put to use INSERT ... ON CONFLICT (upsert) instead of plain INSERT
  • Added _close methods to all iterators to properly release resources
  • Fixed LIMIT clause to use parameterized binding
  • Added UNIQUE constraint on the key column in table creation
  • Removed unused client property from iterator classes
  • Improved type safety: NextCallback defined locally, params typed as unknown[]

Tests

  • Migrated from Jest to Vitest
    • Iterator options (gt, gte, lt, lte, reverse, limit)
    • Read-only mode
    • Clear with options
    • Edge cases (empty strings, special characters, unicode, long values)
    • Upsert behavior verification
    • File-based persistence
    • SQL injection prevention
    • Iterator closing behavior

@changeset-bot
Copy link

changeset-bot bot commented Dec 4, 2025

🦋 Changeset detected

Latest commit: 22fb153

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
sqlite-level Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@CLAassistant
Copy link

CLAassistant commented Dec 4, 2025

CLA assistant check
All committers have signed the CLA.

@JackDevAU JackDevAU force-pushed the feat/remove-cjs-fix-bugs branch from 13b0849 to 1af81e7 Compare December 4, 2025 05:38
@JackDevAU JackDevAU force-pushed the feat/remove-cjs-fix-bugs branch from 1af81e7 to b47374c Compare December 4, 2025 08:03
JackDevAU and others added 3 commits December 4, 2025 18:08
*  _clear was broken — only handled gte via a LIKE prefix match. Rewrote to support all range options (gt, gte, lt, lte) and clear-all with no options, matching the abstract-level contract.
* limit: 0 was falsy — if (options.limit) skipped limit: 0, returning everything instead of nothing. Fixed to options.limit != null && options.limit >= 0.
* gt/gte/lt/lte falsy checks — empty string or 0 values were silently skipped. Changed to != null checks. Also refactored condition building to use a conditions[] array.
* stmt.iterate(params) — changed to stmt.iterate(...params) for explicit spread rather than relying on better-sqlite3 implicit array handling.
* async _close — removed misleading async keyword from iterator _close methods since they're synchronous callback-based.
* _clear missing readOnly guard — added the same LEVEL_READ_ONLY check that _put, _del, and _batch have.
* Dead main/types fields in package.json — removed; redundant with the exports map now that CJS is dropped.

  Added test coverage

  Went from 55 → 66 tests. Added:
  - 7 _clear tests (clear-all, gt, gte, lt, lte, two range combos)
  - _clear readOnly test
  - limit: 0 test
  - Key iterator _close via break
  - Value iterator _close via break
  - Updated SQL injection clear tests to match new range semantics

  Accepted / left as-is

  UNIQUE constraint migration — major version bump covers it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants