Repository navigation
Release v1.0.0.dev13 - #36
Merged
Merged
Conversation
* fix: resolve SQL injection risks in DDL/DML statements - Fix partial index where_clause to accept ToSQLProtocol for parameterized queries - Fix CREATE TYPE ENUM values to use _escape_sql_string for escaping - Fix trigger function name to use format_identifier for proper quoting - Fix stored procedure names (CREATE/DROP/CALL) to use format_identifier - Fix extended statistics names to use format_identifier Resolves: SQL injection vulnerabilities in PostgreSQL backend * fix: resolve parameter loss bug in where_clause The ToSQLProtocol path was collecting parameters but returning hardcoded empty tuple, causing WHERE clause parameters to be silently dropped. This commit fixes the return statement to include the collected parameters. * test: add SQL injection security tests for PostgreSQL fixes - Add tests for CREATE TYPE ENUM value escaping - Add tests for trigger function name format_identifier - Add tests for stored procedure names (CREATE/DROP/CALL) - Add tests for extended statistics names - Add tests for partial index WHERE clause ToSQLProtocol support Resolves: Test coverage for SQL injection fixes in PostgreSQL backend * test: fix and enhance PostgreSQL security tests - Fix method name: format_create_type_enum_statement - Fix method name: format_call_statement - Add all_params initialization in format_create_index_pg_statement - Add tests for ENUM escaping, stored procedures, and partial index WHERE clause * chore: use git source for rhosocial-activerecord at release/v1.0.0.dev26 * test: update test assertions for quoted identifiers * chore: add changelog fragment for PR #35
…onment variables - Add cli/bash/ directory with per-command bash scripts: - info.sh, query.sh, introspect.sh, status.sh - named_query.sh, named_procedure.sh, named_connection.sh - Update all example files to use POSTGRES_HOST/PORT/DATABASE/USER/PASSWORD instead of PG_* variables for consistency with CLI - Each bash script covers all CLI options with self-contained test data
…ate test.yml - pyproject.toml: add requires_functions marker, remove deprecated requires_capability - test.yml: use git+https for testsuite at release/v1.0.0.dev13
- Replace table_name= with table= for CreateTableExpression, DropTableExpression - Replace table= with table_name= for CreateIndexExpression (PostgreSQL-specific) - Apply across all 20 extension integration tests and create_table_like tests
…ecution Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
coverage run does not collect data from xdist worker subprocesses. pytest-cov with --cov flag natively supports parallel worker coverage merging. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Change rhosocial-activerecord-testsuite installation source from git+https://github.com/... to PyPI, pinned to version 1.0.0.dev13. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Changed installation source from git+https to PyPI, pinned to version 1.0.0.dev26. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #36 +/- ##
==========================================
+ Coverage 68.66% 68.72% +0.06%
==========================================
Files 230 230
Lines 10049 10054 +5
Branches 1598 1599 +1
==========================================
+ Hits 6900 6910 +10
+ Misses 2628 2621 -7
- Partials 521 523 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v1.0.0.dev13
Summary
Release v1.0.0.dev13 for rhosocial-activerecord-postgres, including a critical security fix, CI improvements, and test refinements.
Changes
Security
CI/CD
Testing
Refactoring
Build
Changelog Fragment
35.security.md— SECURITY: Resolved SQL injection risks in PostgreSQL backendTest Plan