Model.update options.fields support and a test.

lib/model.js

@@ -1586,6 +1586,7 @@ module.exports = (function() {
    * @param  {Object}       values
    * @param  {Object}       options
    * @param  {Object        options.where                   Options to describe the scope of the search.
+   * @param  {Array}        [options.fields]                Fields to update (defaults to all fields)
    * @param  {Boolean}      [options.validate=true]         Should each row be subject to validation before it is inserted. The whole insert will fail if one row fails validation
    * @param  {Boolean}      [options.hooks=true]            Run before / after bulk update hooks?
    * @param  {Boolean}      [options.individualHooks=false] Run before / after update hooks?. If true, this will execute a SELECT followed by individual UPDATEs. A select is needed, because the row data needs to be passed to the hooks
@@ -1612,6 +1613,15 @@ module.exports = (function() {
 
     options.type = QueryTypes.BULKUPDATE;
 
+    // Remove values that are not in the options.fields
+    if (options.fields && options.fields instanceof Array) {
+      Object.keys(values).forEach(function(key) {
+        if (options.fields.indexOf(key) < 0) {
+          delete values[key];
+        }
+      });
+    }
+
     if (this._timestampAttributes.updatedAt) {
       values[this._timestampAttributes.updatedAt] = this.__getTimestamp(this._timestampAttributes.updatedAt);
     }

test/integration/model.test.js

@@ -923,6 +923,23 @@ describe(Support.getTestDialectTeaser('Model'), function() {
       });
     });
 
+    it('updates only values that match the allowed fields', function() {
+      var self = this
+        , data = [{ username: 'Peter', secretValue: '42' }];
+
+      return this.User.bulkCreate(data).then(function() {
+        return self.User.update({username: 'Bill', secretValue: '43'}, {where: {secretValue: '42'}, fields: ['username']}).then(function() {
+          return self.User.findAll({order: 'id'}).then(function(users) {
+            expect(users.length).to.equal(1);
+
+            var user = users[0];
+            expect(user.username).to.equal('Bill');
+            expect(user.secretValue).to.equal('42');
+          });
+        });
+      });
+    });
+
     it('updates with casting', function() {
       var self = this;
       return this.User.create({