npm / kysely

kysely

What changed in kysely 0.28 to 0.29, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

2 breaking6 security1 performance1 behavior and defaults9 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

kysely 0.298 changes

MSSQL now escapes keys passed to jsonBuildObject.
0.28.18, 0.29.7release notes release notes
MSSQL now escapes JSON in jsonBuildObject.
0.28.18, 0.29.7release notes release notes

Commit, rollback, and savepoint commands wait for ongoing queries and streams to finish, preventing commands from racing with them.
0.29.7release notes
Transaction handles now share completion state.
0.28.18, 0.29.7release notes release notes
A failed begin now releases the transaction connection.
0.28.18, 0.29.7release notes release notes
A failed rollback releases the connection and marks the transaction as rolled back.
0.28.18, 0.29.7release notes release notes
The client is released if it is destroyed while acquiring a connection.
0.28.18, 0.29.7release notes release notes
The where clause in doUpdateSet now allows immutable columns.
0.29.6release notes

Commit, rollback, and savepoint commands wait for ongoing queries and streams to finish; active streams must be closed or exhausted before awaiting these commands.
0.28.18release notes
PostgreSQL and MSSQL migrations use session-level locks, including when disableTransactions is true. PostgreSQL migrations through PgBouncer transaction pooling need a direct connection, session pooling, or custom migration locking.
0.28.18release notes

Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in JSONPathBuilder.key() / .at()
0.28.17security advisory
Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys.
0.28.14security advisory
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in sql.lit(string) usage or similar methods that append string literal values into the compiled SQL strings
0.28.14security advisory
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using Kysely<any>.
0.28.12security advisory

The where predicate now allows immutable columns and uses column select types, including for columns that cannot be updated.
0.28.18release notes

SQLite DELETE queries now output RETURNING before ORDER BY and LIMIT.
0.28.18release notes
Fixes infinite type-check recursion.
0.28.18release notes
Explicit undefined is now allowed in Updateable when exactOptionalPropertyTypes is enabled.
0.28.18release notes