Hidden Assumptions in sequelize

14 assumptions this code never checks · 5 critical · spanning Contract, Ordering, Resource, Shape, Temporal, Environment, Scale, Domain

Every codebase relies on things it never checks. Most of them are routine. CodeSea looked at sequelize/sequelize and picked out the few most likely to cause trouble. The full list is just below.

Most of what this code assumes is routine. These 3 are the ones most likely to cause trouble here. The rest are minor; they're under "Show everything".

Worth your attention first

If a dialect's QueryGenerator lacks a method or returns differently shaped objects, queries will fail with cryptic method-not-found or property access errors instead of clear dialect compatibility warnings

Worth your attention first

Accessing associations on stale model instances can trigger queries that reference invalid primary keys or attempt to populate destroyed objects, causing memory leaks or incorrect data binding

Worth your attention first

Under high load, connection pool exhaustion causes queries to hang indefinitely without timeouts, leading to cascading failures as more operations pile up waiting for connections that never become available

Show everything (11 more)
Shape

Input data objects for model creation contain only scalar values or nested objects that match the expected attribute structure defined in the model schema

If this fails: Passing functions, circular references, or deeply nested objects causes silent data corruption during serialization to SQL or crashes during database operations when unexpected types reach the query generator

packages/core/src/model:Model.build
Temporal

Migration files are executed in lexicographic order based on filename timestamps, and no migrations are added with earlier timestamps after later ones have been applied

If this fails: Adding migrations with earlier timestamps than already-applied migrations causes schema inconsistencies where the database schema doesn't match the expected state, potentially corrupting data or breaking foreign key constraints

packages/cli/src/api/run-migrations.js:MigrationRunner.up
Environment

Database server versions support all SQL features used by the query generator, including JOIN syntax, subqueries, and data types specific to each dialect

If this fails: Using advanced SQL features on older database versions results in cryptic SQL syntax errors that don't clearly indicate version incompatibility, making debugging difficult for developers

packages/*/src/dialect.js:Dialect.initialize
Scale

Query result sets fit in memory as JavaScript arrays, with no consideration for result set size limits or streaming for large datasets

If this fails: Queries returning millions of rows cause out-of-memory crashes or extreme performance degradation as the entire result set is loaded into memory and converted to model instances

packages/core/src/model:Model.findAll
Contract

All database connections support nested transactions and savepoints in the same way, allowing the same transaction management code to work across all dialects

If this fails: Databases with limited savepoint support or different transaction isolation behaviors cause transactions to fail unexpectedly or produce different results across database types, breaking application consistency guarantees

packages/core/src/transaction.js:Transaction.commit
Domain

JavaScript Date objects represent UTC timestamps that can be directly converted to database datetime formats without timezone conversion logic

If this fails: Date values are stored in the database with incorrect timezone information, causing date arithmetic and comparisons to produce wrong results when the application and database server are in different timezones

packages/core/src/data-types:DataType.stringify
Temporal

Database connections remain valid between health checks and don't expire due to idle timeouts or network interruptions

If this fails: Queries executed on expired connections fail with connection errors that aren't automatically retried, forcing applications to implement their own connection retry logic or face intermittent failures

packages/*/src/connection-manager.js:ConnectionManager.validate
Ordering

Model attributes are defined and associations are configured before any queries are executed, with no dynamic schema changes after initialization

If this fails: Adding attributes or associations to models after queries have been cached causes query generators to use stale schema information, resulting in missing columns in SELECT statements or invalid JOIN conditions

packages/core/src/model:Model.init
Resource

SQL query strings and parameter arrays don't exceed database-specific limits for query length or parameter count

If this fails: Large queries with many parameters fail with database-specific errors about query complexity or parameter limits, with no clear indication of which limits were exceeded or how to restructure the query

packages/core/src/sequelize.js:Sequelize.query
Domain

Many-to-many junction tables follow the naming convention of combining source and target table names, and contain only foreign key columns plus optional timestamps

If this fails: Junction tables with custom schemas or additional business logic columns aren't properly handled by association queries, causing missing data or failed joins when the table structure doesn't match expectations

packages/core/src/associations/belongs-to-many:BelongsToMany.through
Environment

Database user permissions allow CREATE, DROP, and ALTER operations for schema management, with no restrictions on DDL operations

If this fails: Migration and sync operations fail with permission denied errors when database users lack schema modification privileges, providing unclear error messages about which specific operations are restricted

packages/*/src/query-interface.js:QueryInterface.createTable

See the full structural analysis of sequelize: the pipeline, data models, and system behavior that put these assumptions in context.

Full analysis of sequelize/sequelize →

Frequently Asked Questions

What does sequelize assume that could break in production?

The one most likely to cause trouble: All dialect-specific QueryGenerator implementations have identical method signatures and return the same SQLQuery structure, allowing the core to treat them polymorphically without checking capabilities If this fails, If a dialect's QueryGenerator lacks a method or returns differently shaped objects, queries will fail with cryptic method-not-found or property access errors instead of clear dialect compatibility warnings

How many hidden assumptions does sequelize have?

CodeSea found 14 assumptions sequelize relies on but never validates, 5 of them critical, spanning Contract, Ordering, Resource, Shape, Temporal, Environment, Scale, Domain. Most are routine — the analysis flags the two or three most likely to actually bite.

What is a hidden assumption?

Something the code depends on but never checks: a data shape, an ordering, an environment condition, a scale limit, or a contract with another service. It holds until the world it runs in changes, then fails silently.