Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: feathersjs/feathers
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v5.0.48
Choose a base ref
...
head repository: feathersjs/feathers
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v5.0.49
Choose a head ref
  • 2 commits
  • 71 files changed
  • 1 contributor

Commits on Aug 14, 2026

  1. fix(adapter-commons): validate query operators nested in arrays (#3700) 

    * fix(adapter-commons): validate query operators nested in arrays

validateQueryProperty skipped array values because isPlainObject
excludes arrays. That let unknown $ operators through when wrapped
in an extra array level, e.g. $or: [[{ $where: '1==1' }]]. Recurse
into arrays so the operator allow-list applies at every level.

* fix: validate filter values and tighten ObjectIdSchema

filterQuery left $select, $or, $and, and $sort object values
unvalidated, so unknown $ operators could ride through those
filters. ObjectIdSchema accepted any object, which let operator
documents pass querySyntax on generated MongoDB services.

Validate those filter values with validateQueryProperty. The
objectid keyword now accepts ObjectId instances and rejects
other objects, and ObjectIdSchema uses that for its object branch.

* fix(schema): allow $exists on queryProperty after ObjectIdSchema tighten

Tightening ObjectIdSchema dropped { _id: { $exists: true } }, which
only passed because the old any-object branch treated the operator
document as an id. Add $exists as a boolean operator on queryProperty
so it is allowed on every querySyntax field, including ObjectIds.

* fix(schema): allow null in $ne, $in, and $nin query operators

{ userId: { $ne: null } } is the usual Mongo and SQL "field is set"
query. After tightening ObjectIdSchema it only passed when the field
type already included null. Accept null on $ne/$in/$nin in
queryProperty so ObjectId, number, and string fields all allow it.

* docs: show querySyntax extensions for adapter-specific queries

The default syntax already covers $ne/$in/$nin null and $exists.
Document how to add $like/$regex/array operators, how to allow
{ userId: null } on ObjectId query fields, and how $meta/$slice
map to service operators rather than querySyntax.

* fix: allow null equality, projection ops, and Mongo $regex

{ userId: null } is a real IS NULL query; accept null on the
queryProperty equality branch the same way as $ne/$in/$nin.

Allow $meta/$slice/$elemMatch inside object $select and $sort
(not as field operators). Add more with projectionOperators.

@feathersjs/mongodb defaults operators to include $regex and
$options. Generated Mongo query schemas do the same on the
primary string field.

* revert: drop new query syntax obligations

Keep the allow-list tightenings. Remove $exists, implicit null
equality, default Mongo $regex, and projectionOperators so those
stay app-level extensions via querySyntax or operators, not new
supported syntax.

* test: cover typical querySyntax and operators extensions

Assert $regex/$options, $like, $exists, $meta, and nullable
ObjectId fields still work when the app opts in, and that
unlisted operators such as $where stay rejected.

* fix: reject spoofed ObjectId JSON and correct querySyntax example

isObjectId now requires instanceof ObjectId, or _bsontype plus a
non-Object constructor and toHexString, so `{ _bsontype: 'ObjectId' }`
does not pass ObjectIdSchema. Attach $regex/$options to text in the
TypeBox Pick example.

* test(mongodb): isolate validated $regex find from service create

CI failed because people.create() returned no _id after earlier
aggregation tests mutated the shared service. Insert the fixture
through the collection so the test only covers validateQuery + $regex.
    @marshallswain
    marshallswain authored Aug 14, 2026
    Configuration menu
    Copy the full SHA
    304a1aa View commit details
    Browse the repository at this point in the history

  2. chore(release): publish v5.0.49

    @marshallswain
    marshallswain committed Aug 14, 2026
    Configuration menu
    Copy the full SHA
    cc972d0 View commit details
    Browse the repository at this point in the history
Loading