SeaORM 2.0

Apply the Rust 1.98 baseline first. These rules cover SeaORM 2.0 with its SQLx backends, entities, query builders, optional RBAC, nested persistence, and migrations, and were checked against 2.0.2. SeaORM requires Rust 1.94.0 or newer; take the toolchain from the baseline's version rule.

Select only the needed sqlx-postgres, sqlx-mysql, or sqlx-sqlite features. Use runtime-tokio-rustls or runtime-tokio-native-tls for network databases; runtime-tokio alone is appropriate for SQLite. The async-std runtime is deprecated. Treat sea-orm-sync, SeaORM X, Seaography, and SeaORM Pro as separate integrations requiring their own review.

Query construction and injection

• Use SeaORM/SeaQuery expressions with bound values; prefer the generated type-aware COLUMN accessors where available. Type checking does not establish authorization or validate business constraints.
• Use raw_sql! value placeholders or Statement::from_sql_and_values for fixed SQL templates. Keep SQL text trusted, match placeholders to the selected backend, and bound expansions such as {..ids} before constructing the statement.
• Treat Statement::from_string, execute_unprepared, custom SQL expressions, and custom StatementBuilder implementations as escape hatches. Never interpolate request data into their SQL text; bindings represent values, not table names, operators, or clauses.
• Map caller-selected sort keys, projections, relations, and other query structure to an explicit allowlist of columns and operations. Identifier quoting alone does not authorize access to a column or table.