npm / knex

knex

What changed in knex 3, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

1 security6 new APIs and options13 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

knex 320 changes

PostgreSQL searchPath values escape double quotes to prevent SQL injection.
3.2.9release notes

Preserves binding order in PostgreSQL and MSSQL delete and update queries.
3.3.0release notes
Fixes SQLite conditional insert/merge when inserting multiple rows.
3.3.0release notes
Sets error.cause for Tarn acquire connection errors.
3.3.0release notes
Fixes FOR UPDATE OF when used with an explicit schema.
3.3.0release notes
Fixes _setNullableState so it respects the schema.
3.3.0release notes
Makes stream postProcessResponse errors catchable with .on('error').
3.3.0release notes
Fixes an unhandled error on connection timeout with stream.
3.3.0release notes
Preserves PostgreSQL updateFrom binding order.
3.3.0release notes
Fixes the .where type regression for invalid types.
3.3.0release notes
Aliases in analytic functions are now properly escaped.
3.2.10release notes
Type definitions now support Array<Buffer>, which was already supported in code.
3.2.9release notes
DELETE queries support LIMIT in dialects that support it, such as MySQL, while remaining disallowed in dialects that do not.
3.2.9release notes
SQLite appends a RETURNING statement when inserting an empty row.
3.2.9release notes