activeadmin-graphql 0.2.1 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '00998f8445b9a5f9a7d4a939029d6e6460527432d658711b713df1ad293abc9e'
-  data.tar.gz: fd5f948edd2277b99e68ee384ccf7d31c8ffa8c890bf2f277837106213498652
+  metadata.gz: 5fc45489403fdf5c4d16bd66966cc4c7c5641440663d3f5b229b0d627a0d0978
+  data.tar.gz: '04786131baffbec749af13c347660836c1ca31efa074c73eddfc49c5fbfb588e'
 SHA512:
-  metadata.gz: fb9a627765be0dfb70171b6c2b9be70828e35a86fb0be2c79df237b0dbadc0559376e176b04ab6a2de49d22404c9773a4f9bee1427d1007b139dc71114afb991
-  data.tar.gz: 7c2d075e817702fd05648cf0f6dee228938d7d09400be066f99d4d50b23eb4d301f8ee0ac1632974ea57317f8a2ee7bcee81f5282481e9c477c9e8fd312e5db1
+  metadata.gz: 1c93c24f91a208c8eb00076d1fd3d8b398c99d155a8ce92f4aaa075b6615ea321a3303b2186e85fa32178a4e8ad158fb4ab1f081752993c6a44e5466fad1ac83
+  data.tar.gz: f5c1acc62e5f1aa0cd925234c4df76d9870dd592cb97aeae7927df578340d70936e02bcf727635a8f07d7caacfb84316e037383c7666b35cb472d11b8776240e

data/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## 0.3.1 (2026-10-10)
+
+- Fix GraphQL identity handling for database views and nonconventional primary keys: keep one `id` field, support inferred `id` lookups, reject ambiguous identifiers, and honor attribute filters.
+
+## 0.3.0 (2026-09-21)
+
+- BREAKING: omit `created_at` and `updated_at` from default create and update inputs. List them on `permit_params` to keep them writable.
+- BREAKING: require graphql-ruby 2.6.9 or newer (parser cache Marshal fix).
+- Add `permit_params` on the per-resource `graphql` block, with nested `create` / `update` `permit_params` and `resolve` (RFC 0006).
+- Seed GraphQL mutation inputs from a static HTML `permit_params` list when graphql `permit_params` is unset.
+- Add `destroy_*` as an alias of `delete_*`.
+- Add `graphql_name` as an alias of `type_name`.
+- Put ActiveRecord validation messages on GraphQL error `extensions.errors` when create or update fails.
+- Log GraphQL execute with namespace, operation name, and error count.
+- Test ActiveAdmin 4.0.0.beta23 on Rails 8. Keep ActiveAdmin 3.5 on Rails 7.2.
+- Add `rfcs/` starter pack: process (RFC 0001), positioning (RFC 0002), and Standards Track design RFCs 0003–0005 for HTTP endpoint, schema DSL, and authorization.
+
 ## 0.2.1 (2026-07-14)
 
 - Add RBS type signatures to the published gem for Steep and other Ruby type checkers

data/CODE_OF_CONDUCT.md

@@ -1,31 +1,26 @@
 # Code of Conduct
 
-## Our Pledge
+## Pledge
 
-We pledge to make participation in the activeadmin-graphql community a harassment-free experience for everyone. We operate on principles of mutual respect, privacy, and authentic engagement. We value substantive contributions and clarity on intentions.
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
 
-## Our Standards
+## Expected behavior
 
-Examples of behavior that contributes to a positive environment include:
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
 
-- Authenticity: Engaging with genuine curiosity and admitting uncertainty rather than feigning knowledge.
-- Responsible innovation: Taking full responsibility for any content or code contributed, whether manually written or generated by automation tools.
-- Gentle correction: Responding politely to errors. We view mistakes as opportunities for learning, provided they are addressed with humility.
-- Inclusive language: Using language that welcomes diverse perspectives and respects the privacy and identity of all participants.
+## Unacceptable behavior
 
-Examples of unacceptable behavior include:
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
 
-- Harassment: Public or private harassment, trolling, or insulting comments.
-- Weaponized complexity: Using jargon or overwhelming volume (including automated spam) to silence others.
-- Publishing private information: Sharing others' data or personal context without explicit permission.
+## Automation
 
-## Artificial Intelligence & Automation
-
-In accordance with our commitment to collective awareness:
-
-- Contributors are responsible for the accuracy and security of any AI-generated artifacts they submit.
-- "The AI wrote it" is not a valid excuse for introducing bugs, security vulnerabilities, or bias.
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at contact@kiskolabs.com. All complaints will be reviewed and investigated promptly and fairly.
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -1,27 +1,23 @@
 # Contributing Guidelines
 
-Thank you for your interest in contributing to activeadmin-graphql.
+## Automation authorship
 
-## How to Contribute
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
 
-### 1. Reporting Issues
+Keep pull requests small enough to review. Annotate non-obvious logic.
 
-- Verify accuracy: Before posting, verify your information. Avoid generalizations.
-- Use structured inputs: Provide clear goals, constraints, and reproduction steps.
+Never send project secrets or private context to public models.
 
-### 2. Pull Request Process
+## How to contribute
 
-- Scope: Keep PRs focused on a single goal.
-- Context: Explain why the change is necessary.
-- Testing: Run the RSpec suite (see the README for Appraisal and parallel test commands).
+### Reporting issues
 
-### 3. Review Process
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
 
-- We encourage productive friction. Expect questions about your approach.
-- If a reviewer suggests a change, view it as mutual aid, not criticism.
+### Pull requests
 
-### Artificial Intelligence & Automation
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
 
-1. You are the author: You act as the responsible agent for any code you submit. You must review, debug, and understand every line.
-2. Manage cognitive load: Do not submit massive, unreviewed automated dumps.
-3. Security: Never feed project secrets or private context into public AI models.
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/README.md

@@ -2,14 +2,18 @@
 
 GraphQL HTTP API for [ActiveAdmin](https://activeadmin.info), built with [graphql-ruby](https://graphql-ruby.org). Register resources as usual, optionally add a `graphql do ... end` block, enable the endpoint per namespace, and get a schema with queries and mutations aligned with ActiveAdmin authorization and filters.
 
+Design changes go through `rfcs/` (RFC 0001).
+
 ## Setup
 
 ```ruby
 # Gemfile (graphql-ruby is pulled in by activeadmin-graphql)
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it explicitly, for example `gem "activeadmin", "4.0.0.beta23"`. Bundler will not select a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 ```ruby
 # config/initializers/active_admin.rb
 ActiveAdmin.setup do |config|
@@ -38,12 +42,25 @@ rake rubocop
 rake spec
 ```
 
-Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile`, `rails8ruby34.gemfile`, and `rails8truffleruby.gemfile` pin Rails 7.2 / 8.1 (integration tests follow the `spec/dummy` app, which is tested from 7.2 upward). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
+Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile` pins Rails 7.2 with ActiveAdmin 3.5; `rails8ruby34.gemfile` and `rails8ruby4.gemfile` pin Rails 8.1 with ActiveAdmin 4.0.0.beta23 (integration tests follow the `spec/dummy` app). Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context, or `bundle exec parallel_rspec spec` locally for faster multi-process runs on the current bundle.
 
 [Trunk](https://docs.trunk.io) config lives in `.trunk/`; CI runs `trunk` via `.github/workflows/trunk.yml`. Releases: `usr/bin/release.rb` (RuboCop, Appraisal RSpec across gemfiles, `gem build` / `gem push`, git tag, `gh release`).
 
 No local ActiveAdmin checkout is required; the dummy app depends on the published `activeadmin` gem like a normal host app.
 
+## Links
+
+- [GitHub](https://github.com/amkisko/activeadmin-graphql.rb)
+- [GitLab](https://gitlab.com/amkisko/activeadmin-graphql.rb)
+- [RubyGems](https://rubygems.org/gems/activeadmin-graphql)
+- [Versions Atom](https://rubygems.org/gems/activeadmin-graphql/versions.atom) (feed id `10803975489574`)
+- [libraries.io](https://libraries.io/rubygems/activeadmin-graphql)
+- [Deps.dev](https://deps.dev/rubygems/activeadmin-graphql)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_activeadmin-graphql.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/activeadmin-graphql.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/activeadmin-graphql.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/activeadmin-graphql.rb)
+
 ## License
 
 MIT — see [LICENSE.md](LICENSE.md).

data/activeadmin-graphql.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
   spec.description = "Exposes ActiveAdmin resources and pages as a graphql-ruby schema with an HTTP endpoint per namespace."
   spec.license = "MIT"
   spec.platform = Gem::Platform::RUBY
-  spec.required_ruby_version = ">= 3.2"
+  spec.required_ruby_version = ">= 3.4"
 
   repository_url = "https://github.com/amkisko/activeadmin-graphql.rb"
 
@@ -43,27 +43,28 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_runtime_dependency "activeadmin", ">= 3.2"
-  spec.add_runtime_dependency "graphql", ">= 2.3"
+  spec.add_runtime_dependency "graphql", ">= 2.6.9"
 
   spec.add_development_dependency "appraisal", "~> 2"
   spec.add_development_dependency "bigdecimal"
   spec.add_development_dependency "bundler", ">= 2"
   spec.add_development_dependency "devise", ">= 4.9"
-  spec.add_development_dependency "parallel_tests", "~> 4.7"
+  spec.add_development_dependency "json", ">= 2.21.2", "< 3"
+  spec.add_development_dependency "parallel_tests", "~> 5.7"
   spec.add_development_dependency "rails", ">= 6.1"
   spec.add_development_dependency "rspec", "~> 3"
   spec.add_development_dependency "polyrun", ">= 2.2.0"
   spec.add_development_dependency "prosopite", "~> 2.0"
   spec.add_development_dependency "rspec-rails", ">= 6"
+  spec.add_development_dependency "rubocop", "~> 1.91"
   spec.add_development_dependency "rubocop-rails", "~> 2.34"
   spec.add_development_dependency "rubocop-rspec", "~> 3.8"
   spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
   spec.add_development_dependency "sprockets-rails", ">= 3.4"
-  spec.add_development_dependency "sqlite3", ">= 1"
-  spec.add_development_dependency "standard", "~> 1.52"
+  spec.add_development_dependency "sqlite3", ">= 2.9.6"
   spec.add_development_dependency "standard-custom", "~> 1.0"
   spec.add_development_dependency "standard-performance", "~> 1.8"
   spec.add_development_dependency "standard-rails", "~> 1.5"
   spec.add_development_dependency "standard-rspec", "~> 0.3"
-  spec.add_development_dependency "rbs", "~> 3"
+  spec.add_development_dependency "rbs", "~> 4"
 end

data/app/controllers/active_admin/graphql_controller.rb

@@ -167,6 +167,7 @@ module ActiveAdmin
       return if performed?
 
       results = schema.multiplex(payloads)
+      log_graphql_result(operation_name: "multiplex", error_count: results.count { |result| Array(result.to_h["errors"]).any? })
       render json: results.map(&:to_h), status: :ok
     end
 
@@ -182,6 +183,7 @@ module ActiveAdmin
         operation_name: operation_name,
         context: graphql_context
       )
+      log_graphql_result(operation_name: operation_name, error_count: Array(result.to_h["errors"]).size)
       render json: result.to_h, status: :ok
     end
 
@@ -216,5 +218,12 @@ module ActiveAdmin
         }
       end
     end
+
+    def log_graphql_result(operation_name:, error_count:)
+      Rails.logger.info(
+        "[activeadmin-graphql] namespace=#{active_admin_namespace.name} " \
+        "operation=#{operation_name.presence || "anonymous"} error_count=#{error_count}"
+      )
+    end
   end
 end

data/docs/changelogs/20260818111600_rfc-0002-problems.md

@@ -0,0 +1,25 @@
+# RFC 0002 problems and process motivation
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0002 is the as-built problem statement: concrete operator or implementer failures, the shipped solution, rejected alternatives, and which surfaces still need a later Standards Track RFC.
+
+RFC 0001 Motivation names those same surfaces as the reason a numbered process exists here.
+
+## Effects
+
+rfcs/0002-problem-and-positioning.md rewritten. rfcs/0001-rfc-process.md Motivation updated. Unreleased changelog line expanded.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: README, CHANGELOG, and (where present) SPEC.md or docs/graphql-api.md in this tree.
+
+Downstream: rfcs/0001-rfc-process.md, rfcs/0002-problem-and-positioning.md.

data/docs/changelogs/20260818114000_rfc-as-built-coverage.md

@@ -0,0 +1,27 @@
+# As-built RFC coverage
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Starter pack RFC 0001 and RFC 0002 is not enough. Each public contract named in RFC 0002 gets its own Informational Stable RFC with Describes pinned to the current version.
+
+As-built Informational RFCs are Stable. A later change to those contracts is a new Standards Track RFC.
+
+## Effects
+
+Wrote RFC 0003 HTTP endpoint, RFC 0004 schema and DSL, RFC 0005 authorization and filters. Claimed ids/0003 through ids/0005. Updated rfcs/README.md Current set, RFC 0002 Relates and Unresolved, and CHANGELOG Unreleased.
+
+Later pass 2026-08-18: RFC 0003 and later rewritten as Standards Track design specifications. Describes dropped. Version numbers belong in changelogs. The Informational Describes dump from this file is reversed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked. Schema layout and cap registrar remain later Standards Track candidates.
+
+## Source
+
+Upstream: docs/graphql-api.md, CHANGELOG 0.2.1, lib/active_admin/graphql/integration.rb.
+
+Downstream: rfcs/0003-http-endpoint.md, rfcs/0004-schema-and-dsl.md, rfcs/0005-authorization-and-filters.md.

data/docs/changelogs/20260818114700_rfc-design-not-version.md

@@ -0,0 +1,27 @@
+# RFCs specify design
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+An RFC proposes a design: suggestion, motivation, specification, effects, alternatives, and prior art. Version numbers belong in changelogs. Implementation notes stay optional evidence.
+
+RFC 0002 stays Informational positioning. RFC 0003 and later are Standards Track. Shipped design specified after the fact is Stable.
+
+## Effects
+
+Rewrote product RFCs 0002 and later, RFC 0001 process text, rfcs/README.md, and the template. Dropped Describes. Updated CHANGELOG Unreleased.
+
+Later pass 2026-08-18: dropped fence tags that only blocked a misreading in process text. Contract negation stayed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: conversation on RFC shape for product libraries.
+
+Downstream: rfcs/.

data/docs/changelogs/20260907141000_advisory-lockfile-refresh.md

@@ -0,0 +1,21 @@
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Relock json to 2.21.2 in Gemfile.lock and appraisal lockfiles that still carried a vulnerable pin.
+- Relock sqlite3 to 2.9.6 where the test graph still pinned an affected line, and raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Keep json on the 2.x line in library and appraisal locks because rubocop declares json ~> 2.3.
+- Leave Dependabot bundler at directory /. Appraisal lockfiles stay on the CI security matrix.
+
+## Effects
+
+- CI bundler-audit jobs that failed on CVE-2026-71847 and GHSA-mwm8-39rw-8826 now have patched pins in the lockfiles touched this pass.
+- CHANGELOG.md was not given an Unreleased bullet. This is a lockfile and development-graph refresh, not a public gem contract change.
+
+## Source
+
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

data/docs/changelogs/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,24 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Ship RFC 0006 as Proposed with running request specs. CHANGELOG Unreleased names the four graphql DSL methods and the RFC number.
+
+## Effects
+
+Consumers can keep query fields such as timestamps and derived columns while listing authored keys on create and update inputs. Default schema is unchanged.
+
+Later pass 2026-09-21: CHANGELOG Unreleased names permit_params and nested create / update, not create_only.
+
+## Next
+
+0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix. Downstream apps replace initializer patches with graphql permit_params and keep their introspection regression spec after the gem is tagged.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+rfcs/0006-mutation-permit-params.md

data/docs/changelogs/20260921111000_release-0-3-0.md

@@ -0,0 +1,42 @@
+# Release 0.3.0 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.0, not 0.2.2. Default create and update inputs omit created_at and updated_at unless listed on permit_params. That is a GraphQL schema break for clients that sent those fields on 0.2.1.
+
+CHANGELOG 0.3.0 dated 2026-09-21. Version constant is 0.3.0. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+RFC 0006 stays Proposed until 2026-10-05 lazy consensus. Shipping the implementation does not close that window.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.0.
+
+CHANGELOG Unreleased bullets moved under 0.3.0. BREAKING line names the timestamp omission.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.0.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.0.
+
+## Later pass 2026-09-21
+
+0.3.0 is still unpublished. RubyGems latest is 0.2.1. Git tags stop at 0.2.1. Fold the post-cut Unreleased work into 0.3.0 instead of cutting 0.3.1.
+
+CHANGELOG 0.3.0 now also names BREAKING graphql-ruby 2.6.9 and the ActiveAdmin 4.0.0.beta23 Rails 8 test matrix. Lockfile graphql is 2.6.10. Gemspec floor is graphql >= 2.6.9. Development lint (drop standard, Metrics/FileLength) stays out of CHANGELOG.md.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+usr/docs/issues/20260921104400_convention-alignment-audit.md
+usr/docs/changelogs/20260921103000_mutation-attribute-allowlists.md
+usr/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+rfcs/0006-mutation-permit-params.md
+usr/bin/release.rb

data/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md

@@ -0,0 +1,35 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Drop the standard gem. Lint stays on rubocop with a snapshot of standard 1.56.0 config/base.yml plus standard-custom, standard-performance, and standard-rails.
+
+Raise the development rubocop floor to ~> 1.91. That gem allows json >= 2.3.
+
+Keep json on 2.21.2. Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode still pass a positional options hash to JSON.parse, which json 3 rejects. Pin development json >= 2.21.2, < 3 until a Rails release includes rails/rails#58601.
+
+## Effects
+
+make lint: bundle exec rubocop, 86 files inspected, 5 Metrics/FileLength info offenses, no failing offenses. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 106 examples, 0 failures on json 2.21.2.
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+json 3.0.2 in the same graphs made GraphQL request specs fail with Invalid JSON (ParseError wrapping ArgumentError given 2, expected 1). Relocked 2.21.2.
+
+CHANGELOG.md Unreleased was not given a bullet. This is development lint and lockfile work.
+
+## Next
+
+Drop the json < 3 development pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Source
+
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+usr/docs/issues/20260921114500_dependency-audit.md
+https://github.com/standardrb/standard/blob/v1.56.0/config/base.yml
+https://github.com/rails/rails/pull/58601

data/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md

@@ -0,0 +1,41 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Raise the published graphql-ruby floor from >= 2.3 to >= 2.6.9 so consumers cannot resolve GHSA-rmxg-5p3r-j6hh. Lock graphql 2.6.10.
+
+Pin ActiveAdmin 4.0.0.beta23 on the Rails 8 appraisal gemfiles. Keep ActiveAdmin 3.5.2 on Rails 7.2 and on the root Gemfile.lock. Hosts must pin the ActiveAdmin 4 prerelease themselves.
+
+Apply patch-level lockfile updates: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, net-protocol 0.4.0 (with net-imap), bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0, sprockets 4.4.1, rbs 4.2.0, parallel 2.2.0, io-console 0.9.4, reline 0.7.0.
+
+Leave json 2.21.2. Standard 1.56.0 still pins rubocop ~> 1.88.0, which pins json ~> 2.3.
+
+## Effects
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+make lint: bundle exec rubocop, 84 files inspected, no offenses detected. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 3.5.2). BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23). BUNDLE_GEMFILE=gemfiles/rails8ruby4.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23).
+
+CHANGELOG Unreleased names the graphql floor and the ActiveAdmin 4 test matrix. Lockfile-only patches stay out of CHANGELOG.md.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601 before json 3. The standard gem is no longer in the graph.
+
+Folded into unpublished 0.3.0. Tag and gem push wait on make release.
+
+## Later pass 2026-09-21
+
+Dropped standard. Locked rubocop 1.91.0. json stayed 2.21.2 because Rails decode still uses positional JSON.parse options. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md.
+
+## Source
+
+usr/docs/issues/20260921114500_dependency-audit.md
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://github.com/activeadmin/activeadmin/blob/master/UPGRADING.md
+https://github.com/standardrb/standard/blob/main/standard.gemspec

data/docs/changelogs/20261010101500_nonconventional-id-fields.md

@@ -0,0 +1,34 @@
+# Nonconventional id fields
+
+## Effects
+
+Schema build no longer raises `GraphQL::Schema::DuplicateNamesError` when a
+registered model has an `id` column that is not the ActiveRecord primary key
+(`self.primary_key = nil`) or uses a non-`id` primary key.
+
+`ActiveAdmin::PrimaryKey` falls back to an `id` column when the declared
+primary key is blank. Object types skip emitting a column field named `id`
+(interface owns GraphQL `id`) and expose a single non-`id` primary-key column
+as a readable scalar unless the resource's attribute configuration omits it.
+Models with neither a primary key nor an `id` column fail schema build with an
+`ArgumentError` that asks for `self.primary_key`. Inferred `id` values must be
+unique and non-null; ambiguous member and batched lookups fail closed.
+
+Member lookup uses the inferred column while preserving an explicitly
+configured ActiveAdmin finder. Request-local policy caching keeps separate
+entries for distinct records when ActiveRecord has no declared primary key.
+
+Dummy coverage includes SQLite views that project `code AS id` and
+`id AS row_key`, plus a table with an `id` column and no primary key.
+
+## Next
+
+Folded into 0.3.1 release metadata. Tag and gem push wait on make release.
+
+## Source
+
+- Specs: `spec/requests/graphql_identity_columns_spec.rb`,
+  `spec/unit/primary_key_identity_spec.rb`,
+  `spec/unit/resource_query_proxy_identity_spec.rb`,
+  `spec/unit/policy_set_cache_spec.rb`
+- Views: `spec/dummy/db/schema.rb` (`string_id_records`, `alternate_key_records`)

data/docs/changelogs/20261010103800_release-0-3-1.md

@@ -0,0 +1,32 @@
+# Release 0.3.1 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.1 after published 0.3.0. One user-visible fix: GraphQL identity for database views and nonconventional primary keys.
+
+CHANGELOG 0.3.1 dated 2026-10-10. Version constant is 0.3.1. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+Docs-only and pray-tooling commits since 0.3.0 stay out of CHANGELOG.md.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.1.
+
+CHANGELOG Unreleased bullet moved under 0.3.1.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.1.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.1.
+
+## Source
+
+docs/changelogs/20261010101500_nonconventional-id-fields.md
+usr/bin/release.rb

data/docs/dependencies/20260907141000_json-cve-2026-71847.md

@@ -0,0 +1,68 @@
+## Dependency
+
+- json (was below 2.21.2 on the 2.x line, now 2.21.2 in library and appraisal locks)
+- Constraint in this repo: development gemspec json >= 2.21.2, < 3. Transitive via activesupport. rubocop 1.91 allows json >= 2.3.
+- Lockfiles: Gemfile.lock and gemfiles/*.gemfile.lock where present
+
+## Symptom
+
+bundler-audit matches json 2.20.0 through 2.21.1 against CVE-2026-71847 / GHSA-9hj4-r449-hfvc. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: JSON::ResumableParser#partial_value use-after-free on truncated duplicate-key streams. Affected 2.20.0 through 2.21.1. Patched >= 2.21.2.
+- This library does not call JSON::ResumableParser or partial_value.
+
+## Suggested fix
+
+Upgrade lockfiles to json 2.21.2. Stay on 2.x while Rails ActiveSupport::JSON.decode still calls JSON.parse with a positional options hash.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem runtime: json is not a runtime gemspec dependency.
+
+## Advisory
+
+- CVE-2026-71847
+- GHSA-9hj4-r449-hfvc
+- CVSS 8.7 availability (CVSS:4.0). CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin json 2.21.2.
+- Published gem execute path: not_affected. The advisory names ResumableParser#partial_value.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix lockfiles below 2.21.2.
+- Exploit conditions require streaming parse through ResumableParser#partial_value on truncated duplicate-key input.
+
+## Priority
+
+- CI graph: high because bundler-audit fails the security job on version match.
+- Published gem execute path: low. Exploit conditions do not hold on JSON.parse paths.
+
+## Disposition
+
+- Upgrade to 2.21.2. Pin development json < 3 until Rails decode accepts json 3 keyword options.
+
+## Next
+
+- Keep the runtime gemspec free of json unless a later feature streams JSON through ResumableParser.
+- json 3.0.2 is blocked by Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode (positional JSON.parse options). Drop the development json < 3 pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Later pass 2026-09-21
+
+Dropped the standard gem so rubocop 1.91 can resolve. That unblocked json 3 at the Bundler level. Dummy GraphQL request specs then failed: ActionDispatch::Http::Parameters::ParseError wrapping ArgumentError wrong number of arguments (given 2, expected 1). Relocked json 2.21.2 and added development gemspec json >= 2.21.2, < 3. See usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://www.cve.org/CVERecord?id=CVE-2026-71847
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md