Releases: adonisjs/lucid
Add toAttributes method to convert model to a type-safe object with only the attributes
22.0.0-next.9 (2026-02-10)
Features
- add toAttributes method to BaseModel and LucidRow (2d9d1f0)
Full Changelog: v22.0.0-next.8...v22.0.0-next.9
Extend BaseTransformer method Lucid specific aggregate methods
22.0.0-next.8 (2026-02-04)
Bug Fixes
Features
- extend BaseTransformer method Lucid specific aggregate methods (16ff8d2)
What's Changed
- fix: prevent redundant loadOnce on null 1:1 preloads by @Julien-R44 in #1142
Full Changelog: v22.0.0-next.7...v22.0.0-next.8
Contributors
Assets 2
Fix schema import path in stub and auto-detect migration intent from name
22.0.0-next.7 (2026-01-15)
Bug Fixes
- import path of schemas file from database/schema (88747d4)
Features
- auto-detect migration intent from name patterns (59afd84)
Full Changelog: v22.0.0-next.6...v22.0.0-next.7
Prevent mass assignment vulnerability
Security update for CVE-2026-22814.
This release fixes a mass assignment vulnerability in Lucid that could allow user input to override internal ORM state properties.
The issue was caused by relying on hasOwnProperty checks during model assignments, which unintentionally allowed setting internal properties like $attributes, $original, or $isPersisted when passing untrusted input to methods such as fill, merge, or create.
Applications that already properly validate and whitelist input data before passing it to Lucid models are not affected.
Prevent mass assignment vulnerability
Security update for CVE-2026-22814.
This release fixes a mass assignment vulnerability in Lucid that could allow user input to override internal ORM state properties.
The issue was caused by relying on hasOwnProperty checks during model assignments, which unintentionally allowed setting internal properties like $attributes, $original, or $isPersisted when passing untrusted input to methods such as fill, merge, or create.
Applications that already properly validate and whitelist input data before passing it to Lucid models are not affected.
Allow disabling schema generation via config
22.0.0-next.5 (2026-01-09)
Features
- allow disabling schema generation via config (880cf96)
- do not generate schema classes when using test utils (1b36725)
Full Changelog: v22.0.0-next.4...v22.0.0-next.5
Map UUID type to a string column and skip schema generation in production
22.0.0-next.4 (2026-01-03)
Bug Fixes
- map UUID type to string for id column in schema generation (17ede4b)
- skip schema generation in production environment (cc6f740)
Full Changelog: v22.0.0-next.3...v22.0.0-next.4
Auto-boot models and make model stub must use the Schema class
22.0.0-next.3 (2026-01-02)
Features
- add auto-booting to BaseModel for models without decorators (b650cca)
- change make:model stub to use Schema class (166859a)
- exclude migrations table from schema generation (6a107e7)
Full Changelog: v22.0.0-next.2...v22.0.0-next.3
Add support for generating schema classes, truncateAll method on dialects and bug fixes
22.0.0-next.2 (2026-01-02)
Bug Fixes
- broken types (d7ada34)
- handle Database.raw in prepare method for update operations (17aa2bf), closes #1079
- properly quote column names in groupLimit window functions (5922062), closes #1110
- truncateAll implementation of sqlite and MSSQL (f559bf7)
- types generation when same data type varies among dialects (f1e62f7)
Features
- add AI reference docs (8d4e1b5)
- add support for generating schema classes (d71bedb)
- add support for table-qualified column aliases in models (e9dcde4)
- add truncateAllTables method to dialects and query client (ddd7e74)
Full Changelog: v22.0.0-next.1...v22.0.0-next.2
