Merge branch 'master' into selective-includes

.travis.yml

@@ -15,7 +15,7 @@ node_js:
   - "10"
   - "12"
   - "14"
-  - "node"
+  - "16"
 
 branches:
   only:

README.md

@@ -91,7 +91,7 @@ Please read the [submission guidelines](http://sailsjs.com/documentation/contrib
 ## Contribute
 There are many different ways you can contribute to Sails:
 - answering questions on [StackOverflow](http://stackoverflow.com/questions/tagged/sails.js), [Gitter](https://gitter.im/balderdashy/sails), [Facebook](https://www.facebook.com/sailsjs), or [Twitter](https://twitter.com/search?f=tweets&vertical=default&q=%40sailsjs%20OR%20%23sailsjs%20OR%20sails.js%20OR%20sailsjs&src=typd)
-- improving the [documentation](https://github.com/balderdashy/sails-docs#contributing-to-the-docs) or [website](https://github.com/balderdashy/www.sailsjs.com/issues)
+- improving the [documentation](https://github.com/balderdashy/sails-docs#contributing-to-the-docs)
 - translating the [documentation](https://github.com/balderdashy/sails-docs/issues/580) to your native language
 - writing [tests](https://github.com/balderdashy/sails/blob/master/test/README.md)
 - writing a [tutorial](https://github.com/sails101/contribute-to-sails101), giving a [talk](https://speakerdeck.com/mikermcneil), or supporting [your local Sails meetup](https://www.meetup.com/find/?allMeetups=false&keywords=node.js&radius=Infinity&sort=default)

docs/concepts/Helpers/Helpers.md

@@ -9,7 +9,7 @@ In Sails, helpers are the recommended approach for pulling repeated code into a
 For example, in the course of creating the actions that your Node.js/Sails app uses to respond to client requests, you will sometimes find yourself repeating code in several places.  That can be pretty bug-prone, of course, not to mention annoying.  Fortunately, there's a neat solution: replace the duplicate code with a call to a custom helper:
 
 ```javascript
-var greeting = await sails.helpers.formatWelcomeMessage('Bubba');
+const greeting = await sails.helpers.formatWelcomeMessage('Bubba');
 sails.log(greeting);
 // => "Hello, Bubba!"
 ```
@@ -44,7 +44,7 @@ module.exports = {
 
 
   fn: async function (inputs, exits) {
-    var result = `Hello, ${inputs.name}!`;
+    const result = `Hello, ${inputs.name}!`;
     return exits.success(result);
   }
 
@@ -77,7 +77,7 @@ So, as you might expect, you can provide a default value for an input by setting
 The arguments you pass in when calling a helper correspond with the order of keys in that helper's declared `inputs`.  Alternatively, if you'd rather pass in argins by name, use `.with()`:
 
 ```javascript
-var greeting = await sails.helpers.formatWelcomeMessage.with({ name: 'Bubba' });
+const greeting = await sails.helpers.formatWelcomeMessage.with({ name: 'Bubba' });
 ```
 
 ##### Exits
@@ -96,7 +96,7 @@ Imagine a helper called “inviteNewUser” which exposes a custom `emai
 For example, if this helper was called from within an action that has its own "badRequest" exit:
 
 ```javascript
-var newUserId = sails.helpers.inviteNewUser('bubba@hawtmail.com')
+const newUserId = sails.helpers.inviteNewUser('bubba@hawtmail.com')
 .intercept('emailAddressInUse', 'badRequest');
 ```
 
@@ -141,7 +141,7 @@ inputs: {
 Then, to use your helper in your actions, you might write code like this:
 
 ```javascript
-var headers = await sails.helpers.parseMyHeaders(req);
+const headers = await sails.helpers.parseMyHeaders(req);
 ```
 
 ### Generating a helper
@@ -159,7 +159,7 @@ This will create a file `api/helpers/foo-bar.js` that can be accessed in your co
 Whenever a Sails app loads, it finds all of the files in `api/helpers/`, compiles them into functions, and stores them in the `sails.helpers` dictionary using the camel-cased version of the filename.  Any helper can then be invoked from your code, simply by calling it with `await`, and providing some argin values:
 
 ```javascript
-var result = await sails.helpers.formatWelcomeMessage('Dolly');
+const result = await sails.helpers.formatWelcomeMessage('Dolly');
 sails.log('Ok it worked!  The result is:', result);
 ```
 
@@ -170,11 +170,28 @@ sails.log('Ok it worked!  The result is:', result);
 If a helper declares the `sync` property, you can also call it without `await`:
 
 ```javascript
-var greeting = sails.helpers.formatWelcomeMessage('Timothy');
+const greeting = sails.helpers.formatWelcomeMessage('Timothy');
 ```
 
 But before you remove `await`, make sure the helper is actually synchronous. Without `await` an asynchronous helper will never execute!
 
+##### Organizing helpers
+If your application uses many helpers, you might find it helpful to group related helpers into subdirectories. For example, imagine you had a number of `user` helpers and several `item` helpers, organized in the following directory structure
+
+```
+api/
+ helpers/
+  user/
+   find-by-username.js
+   toggle-admin-role.js
+   validate-username.js
+  item/
+   set-price.js
+   apply-coupon.js
+```
+When calling these helpers, each subfolder name (e.g. `user` and `item`) becomes an additional property layer in the `sails.helpers` object, so you can call `find-by-username.js` using `sails.helpers.user.findByUsername()` and you can call `set-price.js` with `sails.helpers.item.setPrice()`.
+
+> For more information, you can read a [conversation between Ryan Emberling and Mike McNeil](https://www.linkedin.com/feed/update/urn:li:activity:6998946887701565440?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A6998946887701565440%2C7000154787505668096%29) which goes into more detail about this use case, including some general tips and tricks for working with custom helpers and organics.
 
 ### Handling exceptions
 

docs/concepts/ORM/Attributes.md

@@ -296,6 +296,8 @@ attributes: {
 Depending on your database, when using `unique: true`, you may also need set `required: true`. 
 
 > When using `unique: true` on an attribute with the `utf8mb4` character set in a MySQL database, you will need to set the column size manually via the [`columnType` property](https://sailsjs.com/documentation/concepts/models-and-orm/attributes#?columntype) to avoid a possible 'index too long' error.  For example: `columnType: varchar(100) CHARACTER SET utf8mb4`.
+
+
 <!--
 
 commented-out content at: https://gist.github.com/rachaelshaw/f10d70c73780d5087d4c936cdefd5648#2

docs/concepts/Policies/Permissions.md

@@ -86,7 +86,7 @@ return exits.success();
 
 
 > ### Note
-> Remember that, while we used `checkPermissions.with(…,…)` here, we could have
+> Remember that, while we used `checkPermissions(…,…)` here, we could have
 > also used `.with()` and switched to named parameters:
 >
 > ```js

docs/reference/sails.config/sails.config.session.md

@@ -51,6 +51,23 @@ The recommended production session store for Sails.js is Redis... but we realize
 
 The built-in session integration in Sails works by using a session ID cookie.  This cookie is [HTTP-only](https://www.owasp.org/index.php/HttpOnly) (as safeguard against [XSS exploits](https://sailsjs.com/documentation/concepts/security/xss)), and by default, is set with the name "sails.sid".
 
+
+##### The "__Host-" prefix.
+
+By default, cookies have no integrity against same-site attackers.
+
+In production enviroments, we recommend that you prefix the "name" of your cookie (`sails.config.session.name`) with "__Host-" to limit the scope of your cookie to a single origin.
+
+You can read more about the "__Host-" prefix [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#attributes).
+
+```js
+session: {
+  name: '__Host-sails.sid'
+}
+```
+
+> Note: Adding this prefix requires the ["secure" flag](#the-secure-flag) to be set to `true`.
+
 ##### Expiration
 
 The maximum age / expiration of your app's session ID cookie can be set as a number of milliseconds.

docs/reference/waterline/models/update.md

@@ -19,6 +19,8 @@ or
 | 1 | criteria            | ((dictionary))    | The [Waterline criteria](https://sailsjs.com/documentation/concepts/models-and-orm/query-language) to use for matching records in the database. `update` queries do not support pagination using `skip` and `limit`, or projections using `select`.
 | 2 | valuesToSet         | ((dictionary))    | A dictionary (plain JavaScript object) of values that all matching records should be updated to have.  _(Note that, if this model is in ["schemaful" mode](https://sailsjs.com/documentation/concepts/models-and-orm/model-settings#?schema), then any extraneous keys will be silently omitted.)_
 
+> **Note**: For performance reasons, as of Sails v1.0 / Waterline 0.13, the `valuesToSet` object passed into this model method will be mutated in-place in most situations (whereas in Sails/Waterline v0.12, this was not necessarily the case).
+
 ##### Result
 
 | Type                | Description      |

docs/reference/waterline/models/updateOne.md

@@ -17,6 +17,8 @@ var updatedRecord = await Something.updateOne(criteria)
 | 1 | criteria            | ((dictionary))    | The [Waterline criteria](https://sailsjs.com/documentation/concepts/models-and-orm/query-language) to use for matching the record in the database.
 | 2 | valuesToSet         | ((dictionary))    | A dictionary (plain JavaScript object) of values that all matching records should be updated to have.  _(Note that if this model is in ["schemaful" mode](https://sailsjs.com/documentation/concepts/models-and-orm/model-settings#?schema), then any extraneous keys will be silently omitted.)_
 
+> **Note**: For performance reasons, as of Sails v1.0 / Waterline 0.13, the `valuesToSet` object passed into this model method will be mutated in-place in most situations (whereas in Sails/Waterline v0.12, this was not necessarily the case).
+
 ##### Result
 
 | Type                | Description      |

docs/reference/waterline/queries/populate.md

@@ -17,6 +17,7 @@ Modify a [query instance](https://sailsjs.com/documentation/reference/waterline-
 
 > **Important:** Both the basic join polyfill (cross-datastore populate, or populate between models whose configured adapter does not provide a `.join()` implementation) and the subcriteria argument to `.populate()` are fully supported in Sails **individually**. However, using the subcriteria argument to `.populate()` at the same time as the join polyfill is experimental. This means that, if an association spans multiple datastores or its datastore's configured adapter does not support a physical layer join, then you should not rely on the subcriteria argument to `.populate()`. If you try that in production, you will see a warning logged to the console. SQL adapters such as [sails-postgresql](https://github.com/balderdashy/sails-postgresql) and [sails-mysql](https://github.com/balderdashy/sails-mysql) support native joins and should be okay to use the subcriteria argument.
 
+> **Note:** If you are using `schema: false`, only defined attributes will be populated.
 
 ### Example
 

docs/tutorials/full-stack-javascript.md

@@ -4,7 +4,7 @@ This video tutorial is an in-depth guide to building your first Node.js/Sails.js
 
 
 #### Links
-+ [Take the course](https://courses.platzi.com/classes/sails-js/)
++ [Take the course](https://platzi.com/cursos/sails-js/)
 + [Try out the demo app (Ration)](https://ration.io)
 + [Download the source code](https://github.com/mikermcneil/ration) for the demo app
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "sails",
   "author": "Mike McNeil <@mikermcneil>",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "description": "API-driven framework for building realtime apps, using MVC conventions (based on Express and Socket.io)",
   "license": "MIT",
   "homepage": "https://sailsjs.com",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@sailshq/lodash": "^3.10.2",
-    "async": "2.5.0",
+    "async": "2.6.4",
     "captains-log": "^2.0.0",
     "chalk": "2.3.0",
     "commander": "2.11.0",
@@ -36,8 +36,8 @@
     "cookie-parser": "1.4.4",
     "cookie-signature": "1.1.0",
     "csurf": "1.10.0",
-    "ejs": "2.5.7",
-    "express": "4.17.1",
+    "ejs": "3.1.7",
+    "express": "4.17.3",
     "express-session": "1.17.0",
     "flaverr": "^1.10.0",
     "glob": "7.1.2",
@@ -49,7 +49,7 @@
     "machinepack-redis": "^2.0.2",
     "merge-defaults": "0.2.2",
     "merge-dictionaries": "1.0.0",
-    "minimist": "1.2.5",
+    "minimist": "1.2.6",
     "parley": "^3.3.4",
     "parseurl": "1.3.2",
     "path-to-regexp": "1.5.3",