# What changed in knex

> 20 changes in knex 3 from its official release notes, upgrade guides and advisories: 1 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/knex/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## knex 3

### Security

- PostgreSQL searchPath values escape double quotes to prevent SQL injection. (3.2.9) — [release notes](https://github.com/knex/knex/releases/tag/3.2.9)

### New APIs and options

- Adds a connectionPool option for using an external pool. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Adds knex.migrate.before for migration operations. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Adds knex.migrate.to for migration operations. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Adds MariaDB driver support. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Adds support for returning in MariaDB. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Adds support for token-credential in MSSQL authentication. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)

### Fixes and other changes

- Preserves binding order in PostgreSQL and MSSQL delete and update queries. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Fixes SQLite conditional insert/merge when inserting multiple rows. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Sets error.cause for Tarn acquire connection errors. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Fixes FOR UPDATE OF when used with an explicit schema. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Fixes _setNullableState so it respects the schema. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Makes stream postProcessResponse errors catchable with .on('error'). (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Fixes an unhandled error on connection timeout with stream. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Preserves PostgreSQL updateFrom binding order. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Fixes the .where type regression for invalid types. (3.3.0) — [release notes](https://github.com/knex/knex/releases/tag/3.3.0)
- Aliases in analytic functions are now properly escaped. (3.2.10) — [release notes](https://github.com/knex/knex/releases/tag/3.2.10)
- Type definitions now support Array<Buffer>, which was already supported in code. (3.2.9) — [release notes](https://github.com/knex/knex/releases/tag/3.2.9)
- DELETE queries support LIMIT in dialects that support it, such as MySQL, while remaining disallowed in dialects that do not. (3.2.9) — [release notes](https://github.com/knex/knex/releases/tag/3.2.9)
- SQLite appends a RETURNING statement when inserting an empty row. (3.2.9) — [release notes](https://github.com/knex/knex/releases/tag/3.2.9)