noDrizzleUpdateWithoutWhere

JavaScript (and super languages)

Summary

Rule available since: v2.4.8
Diagnostic Category: lint/nursery/noDrizzleUpdateWithoutWhere
This rule doesn’t have a fix.
The default severity of this rule is information.
This rule belongs to the following domains:
- drizzle
Sources:
- Same as drizzle/enforce-update-with-where

How to configure

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noDrizzleUpdateWithoutWhere": "error"
6
      }
7
    }
8
  }
9
}

Description

Require .where() to be called when using .update() with Drizzle ORM.

Without a .where() clause, an update statement will update all rows in the table. This rule requires explicitly calling .where() to prevent accidental mass updates.

Options

Use the drizzleObjectName option to specify the variable names that represent Drizzle ORM instances.

1
{
2
  "linter": {
3
    "rules": {
4
      "nursery": {
5
        "noDrizzleUpdateWithoutWhere": {
6
          "options": {
7
            "drizzleObjectName": [
8
              "db"
9
            ]
10
          }
11
        }
12
      }
13
    }
14
  }
15
}

Examples

Invalid

1
await db.update(users).set({ name: "John" });

code-block.js:1:7 lint/nursery/noDrizzleUpdateWithoutWhere ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ℹ .update() is used without .where(). This will update all rows in the table.
  
  > 1 │ await db.update(users).set({ name: “John” });
      │       ^^^^^^^^^^^^^^^^
    2 │ 
  
  ℹ Add a .where() clause to update only the intended rows, or use .where(sql`1=1`) to explicitly update all rows.
  
  ℹ This rule belongs to the nursery group, which means it is not yet stable and may change in the future. Visit https://biomejs.dev/linter/#nursery for more information.

Valid

1
await db.update(users).set({ name: "John" }).where(eq(users.id, 1));