Skip to content

fix: adjust with/whereHas options leak#231

Merged
jlenon7 merged 3 commits intomainfrom
develop
May 3, 2026
Merged

fix: adjust with/whereHas options leak#231
jlenon7 merged 3 commits intomainfrom
develop

Conversation

@jlenon7
Copy link
Copy Markdown
Member

@jlenon7 jlenon7 commented May 3, 2026

Proposed changes

Describe the big picture of your changes here to communicate to the
maintainers why we should accept this pull request. If it fixes a bug
or resolves a feature request, be sure to link to that issue.

Types of changes

What types of changes does your code introduce?

Put an x in the boxes that apply

  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

Put an x in the boxes that apply. You can also fill these out after
creating the PR. If you're unsure about any of them, don't hesitate to ask.
We're here to help! This is simply a reminder of what we are going to look
for before merging your code.

  • I have read the CONTRIBUTING documentation
  • Lint and unit tests pass locally with my changes
  • I have added tests that prove my fix is effective or that my feature works.
  • I have added necessary documentation (if appropriate)

Further comments

If this is a relatively large or complex change, kick off the discussion by
explaining why you chose the solution you did and what alternatives you
considered, etc...

jlenon7 and others added 3 commits May 3, 2026 17:17
…E EXISTS

When whereHas(relation, cb) and with(relation) are called on the same
relation in any order, the shared options.closure field was overwritten
by whichever ran last. This silently dropped the WHERE condition inside
the EXISTS subquery, causing queries to ignore the relation filter.

Fix: spread options inside each switch case (after TypeScript narrows
the type) to capture closure at call time, making whereHas immune to
any subsequent with() call on the same relation.

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@jlenon7 jlenon7 merged commit 68e099a into main May 3, 2026
0 of 2 checks passed
@jlenon7
Copy link
Copy Markdown
Member Author

jlenon7 commented May 3, 2026

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant