Docs / Changelog

Changelog

Release history for Hopak packages, with links to each upgrade guide.

Release notes for Hopak packages. Each section links to the relevant upgrade guide.

Current versions

New primitive: db.sql — tagged-template SQL for the ~5% of queries .model() doesn’t cover. Interpolations become driver-native placeholders (? / $N); values never reach the SQL text, so ${attacker} is safe by construction.
Driver-native on every dialect: SQLite routes through bun:sqlite.prepare().all(), Postgres through postgres.js sql.unsafe(), MySQL through mysql2 pool.execute(). No Drizzle on the raw-SQL read path.
db.raw() → db.builder(). Same return type (the dialect’s Drizzle client), clearer name. Breaking rename, mechanical search-and-replace.
db.execute(sql, params?) is @deprecated — kept as a thin forwarder so existing migration files keep compiling. New code should use db.sql. Removed in 0.6.0.
MigrationContext gets ctx.sql alongside ctx.execute (also deprecated). hopak migrate new scaffolds ctx.sql by default.
Framework internals (tracker.ts, introspect.ts) migrated off the db.raw() as { all?, execute? } cast hack onto db.sql.

deepMerge in @hopak/common drops __proto__, constructor, and prototype keys from merged sources, so a JSON-parsed payload can no longer swap the result’s prototype chain. First regression tests for the common package.
Algorithm pinning on JWT verification in @hopak/auth: the verifier no longer accepts a token signed with a different algorithm from the one configured — closes the algorithm-confusion attack.
Static-file handler re-uses a cached canonical root path (realpath) per handler instance; a symlink that resolves outside the public root still fails cleanly.
FileField.maxSize(n) now actually constrains the Valibot schema at validation time, not just at config-write time.

Validation runtime swapped from Zod to Valibot: ~10× smaller bundle, ~2–3× faster parse.
validate() and buildModelSchema() keep the same API; model-driven validation is untouched.
RouteSchemas.body | query | params are now v.GenericSchema instead of z.ZodType.
@hopak/core no longer depends on zod.
ZodFieldSchema type export renamed to FieldSchema.

New hopak migrate subcommands: init, new, up, down, status.
hopak sync becomes the dev-bootstrap path; it refuses to run once app/migrations/ has files.
hopak dev skips boot-time db.sync() when migrations exist — the runtime never alters the schema on its own.
hopak sync now prints a drift warning when models declare columns the live DB doesn’t have.
.index() on a field now actually creates CREATE INDEX IF NOT EXISTS during sync (previously silently ignored).
New public API: ctx.db.execute(sql, params?) for raw SQL.

CRUD endpoints move from runtime generation to CLI scaffolding via hopak generate crud <model>.
{ crud: true } on models is removed; route files become real .ts you can read and edit.
Dev HTTPS certs require hopak generate cert — boot no longer invokes openssl behind your back.
@hopak/testing drops withCrud: true; wire routes via the new crud.* helpers or pass rootDir for end-to-end tests.
Removed unused model options: owner, publicRead, auth, softDelete.

Models, relations, query ergonomics, validation, serialization, typed errors.
Runtime-generated CRUD via { crud: true }, runtime-generated dev certs for server.https.enabled.
First pass at the CLI: hopak new, hopak use, hopak sync, hopak check, hopak dev.