Releases: adonisjs/lucid
Fix schema import path in stub and auto-detect migration intent from name
22.0.0-next.7 (2026-01-15)
Bug Fixes
- import path of schemas file from database/schema (88747d4)
Features
- auto-detect migration intent from name patterns (59afd84)
Full Changelog: v22.0.0-next.6...v22.0.0-next.7
Prevent mass assignment vulnerability
Security update for CVE-2026-22814.
This release fixes a mass assignment vulnerability in Lucid that could allow user input to override internal ORM state properties.
The issue was caused by relying on hasOwnProperty checks during model assignments, which unintentionally allowed setting internal properties like $attributes, $original, or $isPersisted when passing untrusted input to methods such as fill, merge, or create.
Applications that already properly validate and whitelist input data before passing it to Lucid models are not affected.
Prevent mass assignment vulnerability
Security update for CVE-2026-22814.
This release fixes a mass assignment vulnerability in Lucid that could allow user input to override internal ORM state properties.
The issue was caused by relying on hasOwnProperty checks during model assignments, which unintentionally allowed setting internal properties like $attributes, $original, or $isPersisted when passing untrusted input to methods such as fill, merge, or create.
Applications that already properly validate and whitelist input data before passing it to Lucid models are not affected.
Allow disabling schema generation via config
22.0.0-next.5 (2026-01-09)
Features
- allow disabling schema generation via config (880cf96)
- do not generate schema classes when using test utils (1b36725)
Full Changelog: v22.0.0-next.4...v22.0.0-next.5
Map UUID type to a string column and skip schema generation in production
22.0.0-next.4 (2026-01-03)
Bug Fixes
- map UUID type to string for id column in schema generation (17ede4b)
- skip schema generation in production environment (cc6f740)
Full Changelog: v22.0.0-next.3...v22.0.0-next.4
Auto-boot models and make model stub must use the Schema class
22.0.0-next.3 (2026-01-02)
Features
- add auto-booting to BaseModel for models without decorators (b650cca)
- change make:model stub to use Schema class (166859a)
- exclude migrations table from schema generation (6a107e7)
Full Changelog: v22.0.0-next.2...v22.0.0-next.3
Add support for generating schema classes, truncateAll method on dialects and bug fixes
22.0.0-next.2 (2026-01-02)
Bug Fixes
- broken types (d7ada34)
- handle Database.raw in prepare method for update operations (17aa2bf), closes #1079
- properly quote column names in groupLimit window functions (5922062), closes #1110
- truncateAll implementation of sqlite and MSSQL (f559bf7)
- types generation when same data type varies among dialects (f1e62f7)
Features
- add AI reference docs (8d4e1b5)
- add support for generating schema classes (d71bedb)
- add support for table-qualified column aliases in models (e9dcde4)
- add truncateAllTables method to dialects and query client (ddd7e74)
Full Changelog: v22.0.0-next.1...v22.0.0-next.2
Support VineJS v4
Contributors
Assets 2
Support VineJS v4 and allow column name to be optional
22.0.0-next.1 (2025-10-19)
Features
- allow column name to be optional in unique and exists rule (f6e41c1)
Full Changelog: v22.0.0-next.0...v22.0.0-next.1
Target v7
22.0.0-next.0 (2025-09-22)
Bug Fixes
What's Changed
- fix: nullable relation types by @adamcikado in #1130
Full Changelog: v21.8.0...v22.0.0-next.0