diesel-rs/diesel v2.3.13

Diesel 2.3.13

on GitHub

Fixed

• Fixed interaction between then_order_by and distinct_on to reject otherwise broken SQL queries
• Fix a clippy::redundant_field_names lint warning generated by #[derive(QueryableByName)]
• MySQL and MariaDB now decode a value according to the signedness the server reports for its column, so a SMALLINT UNSIGNED holding 40000 read as Integer returns 40000 rather than -25536
• Potential stackoverflow on deeply nested JSONB values for the SQLite backend
• Fixed a possible null pointer dereference in the custom SQLite aggregate function support when SQLite fails to allocate the aggregate state
• Fixed undefined behavior in SqliteConnection::serialize_database_to_buffer when SQLite returns a null buffer for an empty deserialized database or an allocation failure. SerializedDatabase::as_slice is deprecated in favor of the new SerializedDatabase::try_as_slice, which reports the allocation failure as an error instead of panicking.
• Fixed SQLite value reads to panic instead of creating invalid slices or returning incorrect data when SQLite allocation fails. Row iteration reports a failed value duplication as an error instead.
• Fixed a use after free where reading a SQLite value in a second representation, for example a blob as text, invalidated slices another SqliteValue of the same field had returned. Such a read now works on a copy of the value.
• Fixed broken prepared statement caching for queries using positional ordering and window functions with frame offset clauses
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed encoding floating point values without a decimal part in a roundtrip safe way in SQLite's jsonb encoding
• Fixed a potential panic while deserializing a PgInterval type from a too short buffer
• Fixed potential code injections in the generated schema.rs file caused by malicious database identifiers

I would like to thank @LucaCappelletti94 , @Eh2406 (as @rustfoundation AI security engineer) and @weareaisle for reporting issues covered in this release.

Full Changelog: v2.3.12...v2.3.13

You can support the development of Diesel by:

• Contributing Code, Documentation or Guides. Checkout the planing for Diesel 2.4 for open tasks.
• Providing knowledge and help to maintain the MySQL/MariaDB backend. This is currently the only in-tree backend that is not used by any maintainers, so having someone around that actually uses this backend would be very helpful for the Diesel project.
• Answering questions in our discussion forum
• Reporting bugs in our issue tracker
• Helping triaging issues in our issue tracker
• Sponsoring the maintainers.