jOOQ 3.19

Apply the Java 17 prompt first. These rules cover jOOQ 3.19 on Java 17 or later with the org.jooq Open Source or org.jooq.pro commercial artifacts, and were checked against 3.19.37. The commercial Java 11 distribution and Enterprise Java 8 distribution require their corresponding runtime baselines. Apply commercial-only controls only when the deployed edition provides them.

Building statements safely

• Use generated fields and tables with value-accepting DSL overloads or DSL.val(value) so external values enter the query as data.
• Restrict the @PlainSQL API surface, including DSL.sql, DSL.condition(String), DSL.field(String), DSL.table(String), and DSLContext.fetch(String), to a small audited set of classes.
• Activate org.jooq.checker.PlainSQLChecker in the compiler and keep @Allow.PlainSQL exceptions narrow; adding jooq-checker as a dependency alone does not enforce the check.
• Keep plain SQL templates constant. Use the String, Object... overload with JDBC ? markers for values, or the String, QueryPart... overload with {0} placeholders and DSL.val(value) arguments. A QueryPart can contain SQL structure and is not automatically a safe value.
• Keep placeholders outside string literals, quoted identifiers, and comments, where the template engine does not substitute them. Never concatenate external text into those regions.
• Keep renderPlainSQLTemplatesAsRaw=false; reserve DSL.raw(String) for reviewed constant SQL that deliberately bypasses template processing.
• Map requested identifiers, sort directions, and functions to