Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: feathersjs/feathers
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v5.0.46
Choose a base ref
...
head repository: feathersjs/feathers
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.0.47
Choose a head ref
  • 2 commits
  • 48 files changed
  • 1 contributor

Commits on Aug 10, 2026

  1. docs+feat: query schema sanitization contract and skipSanitize option (… 

    …#3696)

* docs: document query schema vs adapter sanitization contract

Clarify that validateQuery and the built-in adapter operator allowlist
are alternative paths: a validated query schema is the full allowlist
and skips sanitizeQuery. Point this out from validators, adapter common
API, querying, schema helpers, and the security guide.

* feat(schema): add replaceSanitization option to validateQuery

Allow opting into defense in depth: with replaceSanitization: false,
schema validation still runs but the query is not marked VALIDATED, so
adapters continue to enforce their built-in operator and filter allowlist.
Default remains true for backward compatibility.

* test(mongodb): stabilize validated query sanitization test

Reset shared service options (multi, disableObjectify, paginate) so
earlier suite mutations cannot leave create/find in a bad state, and
assert create actually returned a document before checking $regex.

* refactor(schema): rename replaceSanitization to skipSanitize

Shorter option name that matches the behavior: when true (default),
adapter sanitizeQuery is skipped after validateQuery succeeds.

* docs: warn that TypeBox Type.Object is permissive under Ajv by default

Plain Type.Object without additionalProperties: false omits the keyword,
so Ajv accepts unknown query keys. Call that out for validateQuery
allowlists, querySyntax guidance, and the security guide.

* fix: address PR review feedback for skipSanitize docs and tests

Soften dual-path wording so skipSanitize: false is not contradictory,
clarify validateQuery default options, fix the TypeBox docs link label,
and add adapter-level coverage that skipSanitize: false still rejects
non-allowlisted operators.
    @marshallswain
    marshallswain authored Aug 10, 2026
    Configuration menu
    Copy the full SHA
    775ed00 View commit details
    Browse the repository at this point in the history

  2. chore(release): publish v5.0.47

    @marshallswain
    marshallswain committed Aug 10, 2026
    Configuration menu
    Copy the full SHA
    e02a580 View commit details
    Browse the repository at this point in the history
Loading