Guren DocsGuren Docs
Guide/guides

Upgrading Guren

Use this guide for minor-to-minor upgrades.

Upgrading Guren

Use this guide for minor-to-minor upgrades.

Upgrade Workflow (Required)

  1. Read CHANGELOG.md and release notes.
  2. Check docs/en/guides/release-policy.md compatibility matrix.
  3. Update dependencies and regenerate artifacts:
bun install
bunx guren codegen
  1. Run validations:
bun run build
bun run typecheck
bun run test
  1. Apply migration notes for your source/target versions.

Migration Notes

rc → 1.0.0

Strict mass assignment

  • What changed: Models that define fillable now throw a MassAssignmentException when create() / update() receives a field outside the allowlist. Previously, extra fields were silently discarded.
  • Who is affected: Any code that passes unfiltered objects (spread request bodies, merged defaults) to create() / update().
  • How to migrate: Pass only allowlisted fields, or use forceCreate() / forceUpdate() for trusted server-side data such as seeders and system records. To restore the old discard behavior on a specific model, set static strictFillable = false.
// Before: authorId silently dropped when not in fillable
await Post.create({ ...data, authorId: user.id })

// After: either add authorId to fillable, or use forceCreate for trusted data
await Post.forceCreate({ ...validated, authorId: user.id })

Sanitized auth user records

  • What changed: auth.user() no longer contains the password column, the remember-token column, or fields listed in the model's static hidden.
  • Who is affected: Code that read those fields off the authenticated user object.
  • How to migrate: Load the model explicitly (e.g. User.findOrFail(user.id)) in the rare server-side flows that need the raw record.

SSE broadcasting

  • What changed: private- / presence- channels without a registered authorizer are now denied by default, and subscribing requires the clientId delivered in the SSE connected event.
  • Who is affected: Apps using the SSE broadcasting endpoints.
  • How to migrate: Register authorizers with broadcast.privateChannel() / broadcast.presenceChannel(), capture the clientId from the connected event, and send it in POST /broadcasting/auth to authorize and subscribe in one call. See the Broadcasting guide.

Verify the upgrade:

bun run typecheck && bun run test

Breaking Change Template (for future releases)

For each breaking item, document:

  • What changed
  • Why
  • Who is affected
  • Before/After code examples
  • One-command verification