chore(deps): bump @neondatabase/serverless from 0.9.5 to 1.0.0

[dependabot]

Bumps @neondatabase/serverless from 0.9.5 to 1.0.0.

Changelog

Sourced from @​neondatabase/serverless's changelog.

1.0.0 (2025-03-25)

Breaking change: the HTTP query template function can now only be called as a template function, not as a conventional function. This improves safety from accidental SQL-injection vulnerabilities. For example:

import{neon}from'@neondatabase/serverless';constsql=neon(process.env.DATABASE_URL);constid=1;// this is safe and convenient, as beforeconstresult=awaitsqlSELECT*FROMtableWHEREid=${id};// this looks very similar and was previously allowed, but was open to SQL// injection attacks because it uses ordinary string interpolation -- it's now// both a TypeScript type error and a runtime errorconstthrows=awaitsql(SELECT*FROMtableWHEREid=${id});

To fill the gap left by this change, the template function has two new properties: a query() function that allows manually parameterized queries, and an unsafe() function that lets you interpolate trusted arbitrary string values. For example:

// this was previously allowed, and was safe, but is now also an error so as to// prevent the vulnerability seen aboveconstthrows=awaitsql('SELECT * FROM table WHERE id = $1',[id]);// the query() function is the new way to manually specify placeholders and// values (the same way it's done by client.query() and pool.query())constresult=awaitsql.query('SELECT * FROM table WHERE id = $1',[id]);// to interpolate strings like column or table names, only if you know// they're safe, use the unsafe() functionconsttable=condition ? 'table1' : 'table2';// known-safe string valuesconstresult=awaitsqlSELECT*FROM${sql.unsafe(table)}WHEREid=${id};// but in the above case, you might prefer to do this insteadconsttable=condition ? sqltable1 : sqltable2;constresult=awaitsqlSELECT*FROM${table}WHEREid=${id};

In addition, HTTP template queries are now fully composable, including those with parameters. For example:

constname='Olivia';constlimit=1;constwhereClause=sql`WHERE name = ${name}`;constlimitClause=sql`LIMIT ${limit}`;// compilation to raw SQL now happens lazily, at query time, so that parameter// placeholders can be numbered appropriatelyconstresult=awaitsqlSELECT*FROMtable ${whereClause} ${limitClause};</tr></table>

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: automerge. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.