search

envato / event_sourcery

A library for building event sourced applications in Ruby
MIT License
84 stars 10 forks source link

Resolve Sequel deprecation notice #119

Closed orien closed 7 years ago

orien commented 7 years ago

Sequel 4.46.0 has deprecated the automatic treating of plain strings passed to where as literal SQL.

SEQUEL DEPRECATION WARNING: Calling a dataset filtering method with multiple
arguments or an array where the first argument/element is a string is deprecated
and will be removed in Sequel 5. Use Sequel.lit("id >= :from_id", {:from_id=>0})
to create an SQL fragment expression and pass that to the dataset filtering
method, or use the auto_literal_strings extension.

Apparently this is to reduce the number of SQL injection bugs in the wild. A good thing. https://github.com/jeremyevans/sequel/commit/e795175e0d5a3063a815c771152e5f5cb05cf592

This proposed change resolves the issue in the recommended way: generate a LiteralString instance via an explicit call to Sequel.lit and pass that to where.