ccd2a4065d
Add column whitelists to prevent SQL injection via kwargs keys in dynamic UPDATE queries. Values were already parameterized but column names were string-interpolated directly from kwargs. Fixes #90