Ecto 3.14

Apply the Elixir 1.20 and Erlang/OTP 29 prompts first. These rules cover Ecto schemas, changesets, queries, repositories, transactions, migrations, and tenancy.

Changesets and mass assignment

• Pass an explicit field allowlist to cast/4; never derive permitted fields from request keys or schema metadata.
• Keep ownership, tenant, role, balance, approval, and other authority fields out of public changesets.
• Reserve change/2, put_change/3, and put_assoc/4 for trusted internal data; they do not cast and validate external parameters.
• Use validate_required/3, length, format, inclusion, number, and custom validations before persistence, while treating validations as separate from authorization.
• Use cast_assoc/3 and cast_embed/3 with explicit child changesets and limits instead of accepting arbitrary nested structures.
• Preload only authorized children before cast_assoc/3; review :on_replace because permitting deletion lets omitted children be deleted.

Queries and injection

• Keep attacker values in pinned query parameters, including fragment/1 placeholders, and never concatenate them into fragment SQL text, identifiers, order clauses, prefixes, or raw SQL.
• Map user-selectable fields, directions, aggregates, preload paths, and fragments through fixed server-side allowlists.
• Treat Repo.query/3, fragment/1, unsafe_fragment/1, {:unsafe_fragment, ...} repository options, dynamic sources, and adapter-specific SQL as injection-sensitive escape hatches requiring focused review.
• When using PostgreSQL, treat driver options that are not