npm package bug let LLM-approved DB updates silently overwrite unreviewed columns

A developer building a tool to let language models propose and human-approve SQL UPDATE statements discovered a critical verification flaw in version 0.4.0 of the open-source npm package @hyuga/llm-safe-sql. The approval card correctly showed only the column being changed, but the underlying apply logic used that same display-only list to verify row state before writing — meaning columns written by the SQL statement but absent from the display were never checked. In a test scenario, a postcode column was altered by a separate query between approval and execution, yet the apply step proceeded silently with no warning, effectively overwriting the intervening change. The root cause was conflating two distinct sets: columns whose values change versus all columns the SQL statement touches. Version 0.4.2 fixes the issue by introducing a separate 'covered' set for verification, causing the apply step to refuse execution and prompt a fresh plan when any written column has changed since approval.