[ruby] Update mongoid 9.1.0 → 9.1.1 (patch)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ mongoid (9.1.0 → 9.1.1) · Repo · Changelog

Release Notes

9.1.1

The MongoDB Ruby team is pleased to announce version 9.1.1 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 9.1.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 9.1.1 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '9.1.1'

Have any feedback? Click on through to MongoDB's Jira and open a new ticket to let us know what's on your mind.

Bug Fixes

Bound regular-expression execution time in in-memory queries (MONGOID-5981)

Queries evaluated in memory, such as those against embedded associations, run in the calling thread and can spend an unbounded amount of CPU matching regular expressions. A single in-memory query is now limited by Mongoid.in_memory_regexp_time_limit (default 5.0 seconds); exceeding the limit raises Mongoid::Errors::InMemoryRegexpTimeout.

Fix encryption schema generation for automatic encryption (MONGOID-5984) (MONGOID-5989)

Automatic encryption schema generation no longer loops on models that embed themselves, and it now handles polymorphic embeds_one relations and embedded schemas that carry their own encryptMetadata correctly. A model whose collection has no entry in the generated schema is no longer written without encryption: such a write raises Mongoid::Errors::NoEncryptionSchema instead of storing the field in plaintext.

Resolve nested attribute ids within the caller's association (MONGOID-5992)

An id given in nested attributes is now resolved within the association the attributes are being applied to, rather than falling back to a collection-wide lookup that ignored default scopes. A document that is not part of that association raises Mongoid::Errors::DocumentNotFound, and a request to destroy a document that is not in the association is ignored. The Mongoid.allow_reparenting_via_nested_attributes option now defaults to false; set it to true to restore the previous reparenting behavior.

Reject the string form of where under the query operator guard (MONGOID-5993)

A String passed to #where is sent to MongoDB as a $where expression. This now raises Mongoid::Errors::InvalidQuery when Mongoid.allow_unsafe_query_operators is false (the default); the string form is allowed only when that option is enabled.

Reject JavaScript query operators at any depth (MONGOID-5994)

Mongoid.allow_unsafe_query_operators now defaults to false. When it is false, the $where, $function, and $accumulator operators are rejected anywhere in a query selector. The guard covers every criterion-building method (where, find_by, or, and, nor, not, any_of, none_of, and elem_match) and inspects nested expressions such as {'$expr' => {'$function' => ...}} in full.

Other Bug Fixes

• In-memory queries, such as those executed against embedded associations, now read field names from the query as data rather than dispatching them as method calls on the document (MONGOID-5973)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

• Release Candidate: 9.1.1 (#6177)
• Merge commit from fork
• MONGOID-5991 Filter nil keys out of association membership queries (#6169)
• MONGOID-5996 Test against 9.0 builds (#6168)
• MONGOID-5916 Deprecate the parameterless-`not` syntax (#6167)
• MONGOID-5908 Run upcoming Ruby and Rails builds on a bi-weekly schedule (#6166)
• MONGOID-5782 Add block-based Timeless API to fix cascaded timestamp leak (#6165)
• MONGOID-5931 Remove obsolete driver-version guard and document DeprecatedOptions (#6164)
• Benchmarks for `eager_load` functionality (#6163)
• MONGOID-5918 Support BSON::Vector field type (#6162)
• MONGOID-5939 Guard against NoSQL operator injection in where/find_by (#6161)
• Enhancements to the aggregation-based eager load mechanism (#6158)
• MONGOID-5934 Fix NoMethodError in nested attributes when raise_not_found_error is false (#6156)
• Fix installed i18n version for Ruby < 3.2 (#6159)
• MONGOID-5881 Persist empty array set via raw attribute write in before_save (#6157)
• New :fallback option to handle nil for singular associations (#6149)
• MONGOID-5937 redact credentials from client config error messages (#6147)
• MONGOID-5936 Resolve polymorphic *_type via the association resolver in eager loader (#6146)
• MONGOID-5057 Add support for `has_many :through` (#6151)
• MONGOID-5924 Add support for flat indexing method in vector search (#6152)
• MONGOID-5945 don't try to valid destroyed children (#6154)
• MONGOID-5935 Fixed UnknownAttribute error with nested attributes (#6155)
• Fix search (and vector search) index errors (#6153)
• MONGOID-5944 merge $set when inserting embeds_one with touch (#6150)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)