# What changed in kysely

> 19 changes in kysely 0.28 to 0.29 from its official release notes, upgrade guides and advisories: 2 breaking, 6 security. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/kysely/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## kysely 0.29

### Security

- MSSQL now escapes keys passed to jsonBuildObject. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- MSSQL now escapes JSON in jsonBuildObject. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)

### Fixes and other changes

- Commit, rollback, and savepoint commands wait for ongoing queries and streams to finish, preventing commands from racing with them. (0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7)
- Transaction handles now share completion state. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- A failed begin now releases the transaction connection. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- A failed rollback releases the connection and marks the transaction as rolled back. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- The client is released if it is destroyed while acquiring a connection. (0.28.18, 0.29.7) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.7), [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- The where clause in doUpdateSet now allows immutable columns. (0.29.6) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.29.6)

## kysely 0.28

### Breaking changes

- Commit, rollback, and savepoint commands wait for ongoing queries and streams to finish; active streams must be closed or exhausted before awaiting these commands. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- PostgreSQL and MSSQL migrations use session-level locks, including when disableTransactions is true. PostgreSQL migrations through PgBouncer transaction pooling need a direct connection, session pooling, or custom migration locking. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)

### Security

- Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` (0.28.17) — [security advisory](https://github.com/advisories/GHSA-PV5W-4P9Q-P3V2)
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. (0.28.14) — [security advisory](https://github.com/advisories/GHSA-FR9J-6MVQ-FRCV)
- Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings (0.28.14) — [security advisory](https://github.com/advisories/GHSA-8CPQ-38P9-67GX)
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. (0.28.12) — [security advisory](https://github.com/advisories/GHSA-WMRF-HV6W-MR66)

### Performance

- Table metadata parsing is optimized. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)

### Behavior and default changes

- The where predicate now allows immutable columns and uses column select types, including for columns that cannot be updated. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)

### Fixes and other changes

- SQLite DELETE queries now output RETURNING before ORDER BY and LIMIT. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- Fixes infinite type-check recursion. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)
- Explicit undefined is now allowed in Updateable when exactOptionalPropertyTypes is enabled. (0.28.18) — [release notes](https://github.com/kysely-org/kysely/releases/tag/v0.28.18)