activeadmin-graphql 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3347160c32fcf8dea19214ff0bdac83b9c9650855dd58de9035b153c37e0b708
-  data.tar.gz: 757c6bcf6d659569aee20ec9a54f094795c4c0cee4700db967a294a26779ea1b
+  metadata.gz: 95e56a00a0c78ea55f44c186012af72c1ba6ff80ada2adbf905ce9b2d190c47d
+  data.tar.gz: 1e1dc89e1ffd41d05c6f2962a83857188a239ba677e6f492dbc304a09bb123b9
 SHA512:
-  metadata.gz: 383ff1b8d22b9ee6e6f70aa60284ac9c832d69436bf5ee10bfa9b25ce17089aad965481f0ca7149b3742e26aef24e0b2f1b24bb9b84ab26b1076b6c4d39e855a
-  data.tar.gz: 8f6b647f0201d15d2dfe4e23befad9b9c05a22b226cd9d6257678eeb36d4ef39a53de4372961e6b765fe2acc2e4bc0475f835015f24bb867a0564e58b17b4824
+  metadata.gz: 02533503de4c86355e28bc7212115b043a9d7da293db40d1134251f7892539fca8257d6c03140c110d12da8e4de1b4112668c7e6fc2d721273c990d9fff930e3
+  data.tar.gz: 6e13f9a69b6cc7df900cf9883ab60600be21bfea50196209c7324306030d74784cb3e66082ffc3ec225192c3c0c385fffb3f24840061e9f12415b60479de9d3c

data/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## 0.3.2 (2026-10-10)
+
+- Add `graphql { identity ... }` so keyless views can declare GraphQL id columns, optional `separator`, and `encode` / `decode` (RFC 0007).
+- Fail schema build when a registered model has neither a primary key nor an `id` column and no `identity` declaration; set `self.primary_key`, use `identity`, or `graphql { disable! }`.
+
+## 0.3.1 (2026-10-10)
+
+- Fix GraphQL identity handling for database views and nonconventional primary keys: keep one `id` field, support inferred `id` lookups, reject ambiguous identifiers, and honor attribute filters.
+
 ## 0.3.0 (2026-09-21)
 
 - BREAKING: omit `created_at` and `updated_at` from default create and update inputs. List them on `permit_params` to keep them writable.

data/docs/changelogs/20260818111600_rfc-0002-problems.md

@@ -0,0 +1,25 @@
+# RFC 0002 problems and process motivation
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0002 is the as-built problem statement: concrete operator or implementer failures, the shipped solution, rejected alternatives, and which surfaces still need a later Standards Track RFC.
+
+RFC 0001 Motivation names those same surfaces as the reason a numbered process exists here.
+
+## Effects
+
+rfcs/0002-problem-and-positioning.md rewritten. rfcs/0001-rfc-process.md Motivation updated. Unreleased changelog line expanded.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: README, CHANGELOG, and (where present) SPEC.md or docs/graphql-api.md in this tree.
+
+Downstream: rfcs/0001-rfc-process.md, rfcs/0002-problem-and-positioning.md.

data/docs/changelogs/20260818114000_rfc-as-built-coverage.md

@@ -0,0 +1,27 @@
+# As-built RFC coverage
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Starter pack RFC 0001 and RFC 0002 is not enough. Each public contract named in RFC 0002 gets its own Informational Stable RFC with Describes pinned to the current version.
+
+As-built Informational RFCs are Stable. A later change to those contracts is a new Standards Track RFC.
+
+## Effects
+
+Wrote RFC 0003 HTTP endpoint, RFC 0004 schema and DSL, RFC 0005 authorization and filters. Claimed ids/0003 through ids/0005. Updated rfcs/README.md Current set, RFC 0002 Relates and Unresolved, and CHANGELOG Unreleased.
+
+Later pass 2026-08-18: RFC 0003 and later rewritten as Standards Track design specifications. Describes dropped. Version numbers belong in changelogs. The Informational Describes dump from this file is reversed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked. Schema layout and cap registrar remain later Standards Track candidates.
+
+## Source
+
+Upstream: docs/graphql-api.md, CHANGELOG 0.2.1, lib/active_admin/graphql/integration.rb.
+
+Downstream: rfcs/0003-http-endpoint.md, rfcs/0004-schema-and-dsl.md, rfcs/0005-authorization-and-filters.md.

data/docs/changelogs/20260818114700_rfc-design-not-version.md

@@ -0,0 +1,27 @@
+# RFCs specify design
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+An RFC proposes a design: suggestion, motivation, specification, effects, alternatives, and prior art. Version numbers belong in changelogs. Implementation notes stay optional evidence.
+
+RFC 0002 stays Informational positioning. RFC 0003 and later are Standards Track. Shipped design specified after the fact is Stable.
+
+## Effects
+
+Rewrote product RFCs 0002 and later, RFC 0001 process text, rfcs/README.md, and the template. Dropped Describes. Updated CHANGELOG Unreleased.
+
+Later pass 2026-08-18: dropped fence tags that only blocked a misreading in process text. Contract negation stayed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: conversation on RFC shape for product libraries.
+
+Downstream: rfcs/.

data/docs/changelogs/20260907141000_advisory-lockfile-refresh.md

@@ -0,0 +1,21 @@
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Relock json to 2.21.2 in Gemfile.lock and appraisal lockfiles that still carried a vulnerable pin.
+- Relock sqlite3 to 2.9.6 where the test graph still pinned an affected line, and raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Keep json on the 2.x line in library and appraisal locks because rubocop declares json ~> 2.3.
+- Leave Dependabot bundler at directory /. Appraisal lockfiles stay on the CI security matrix.
+
+## Effects
+
+- CI bundler-audit jobs that failed on CVE-2026-71847 and GHSA-mwm8-39rw-8826 now have patched pins in the lockfiles touched this pass.
+- CHANGELOG.md was not given an Unreleased bullet. This is a lockfile and development-graph refresh, not a public gem contract change.
+
+## Source
+
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

data/docs/changelogs/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,24 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Ship RFC 0006 as Proposed with running request specs. CHANGELOG Unreleased names the four graphql DSL methods and the RFC number.
+
+## Effects
+
+Consumers can keep query fields such as timestamps and derived columns while listing authored keys on create and update inputs. Default schema is unchanged.
+
+Later pass 2026-09-21: CHANGELOG Unreleased names permit_params and nested create / update, not create_only.
+
+## Next
+
+0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix. Downstream apps replace initializer patches with graphql permit_params and keep their introspection regression spec after the gem is tagged.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+rfcs/0006-mutation-permit-params.md

data/docs/changelogs/20260921111000_release-0-3-0.md

@@ -0,0 +1,42 @@
+# Release 0.3.0 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.0, not 0.2.2. Default create and update inputs omit created_at and updated_at unless listed on permit_params. That is a GraphQL schema break for clients that sent those fields on 0.2.1.
+
+CHANGELOG 0.3.0 dated 2026-09-21. Version constant is 0.3.0. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+RFC 0006 stays Proposed until 2026-10-05 lazy consensus. Shipping the implementation does not close that window.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.0.
+
+CHANGELOG Unreleased bullets moved under 0.3.0. BREAKING line names the timestamp omission.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.0.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.0.
+
+## Later pass 2026-09-21
+
+0.3.0 is still unpublished. RubyGems latest is 0.2.1. Git tags stop at 0.2.1. Fold the post-cut Unreleased work into 0.3.0 instead of cutting 0.3.1.
+
+CHANGELOG 0.3.0 now also names BREAKING graphql-ruby 2.6.9 and the ActiveAdmin 4.0.0.beta23 Rails 8 test matrix. Lockfile graphql is 2.6.10. Gemspec floor is graphql >= 2.6.9. Development lint (drop standard, Metrics/FileLength) stays out of CHANGELOG.md.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+usr/docs/issues/20260921104400_convention-alignment-audit.md
+usr/docs/changelogs/20260921103000_mutation-attribute-allowlists.md
+usr/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+rfcs/0006-mutation-permit-params.md
+usr/bin/release.rb

data/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md

@@ -0,0 +1,35 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Drop the standard gem. Lint stays on rubocop with a snapshot of standard 1.56.0 config/base.yml plus standard-custom, standard-performance, and standard-rails.
+
+Raise the development rubocop floor to ~> 1.91. That gem allows json >= 2.3.
+
+Keep json on 2.21.2. Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode still pass a positional options hash to JSON.parse, which json 3 rejects. Pin development json >= 2.21.2, < 3 until a Rails release includes rails/rails#58601.
+
+## Effects
+
+make lint: bundle exec rubocop, 86 files inspected, 5 Metrics/FileLength info offenses, no failing offenses. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 106 examples, 0 failures on json 2.21.2.
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+json 3.0.2 in the same graphs made GraphQL request specs fail with Invalid JSON (ParseError wrapping ArgumentError given 2, expected 1). Relocked 2.21.2.
+
+CHANGELOG.md Unreleased was not given a bullet. This is development lint and lockfile work.
+
+## Next
+
+Drop the json < 3 development pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Source
+
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+usr/docs/issues/20260921114500_dependency-audit.md
+https://github.com/standardrb/standard/blob/v1.56.0/config/base.yml
+https://github.com/rails/rails/pull/58601

data/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md

@@ -0,0 +1,41 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Raise the published graphql-ruby floor from >= 2.3 to >= 2.6.9 so consumers cannot resolve GHSA-rmxg-5p3r-j6hh. Lock graphql 2.6.10.
+
+Pin ActiveAdmin 4.0.0.beta23 on the Rails 8 appraisal gemfiles. Keep ActiveAdmin 3.5.2 on Rails 7.2 and on the root Gemfile.lock. Hosts must pin the ActiveAdmin 4 prerelease themselves.
+
+Apply patch-level lockfile updates: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, net-protocol 0.4.0 (with net-imap), bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0, sprockets 4.4.1, rbs 4.2.0, parallel 2.2.0, io-console 0.9.4, reline 0.7.0.
+
+Leave json 2.21.2. Standard 1.56.0 still pins rubocop ~> 1.88.0, which pins json ~> 2.3.
+
+## Effects
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+make lint: bundle exec rubocop, 84 files inspected, no offenses detected. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 3.5.2). BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23). BUNDLE_GEMFILE=gemfiles/rails8ruby4.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23).
+
+CHANGELOG Unreleased names the graphql floor and the ActiveAdmin 4 test matrix. Lockfile-only patches stay out of CHANGELOG.md.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601 before json 3. The standard gem is no longer in the graph.
+
+Folded into unpublished 0.3.0. Tag and gem push wait on make release.
+
+## Later pass 2026-09-21
+
+Dropped standard. Locked rubocop 1.91.0. json stayed 2.21.2 because Rails decode still uses positional JSON.parse options. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md.
+
+## Source
+
+usr/docs/issues/20260921114500_dependency-audit.md
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://github.com/activeadmin/activeadmin/blob/master/UPGRADING.md
+https://github.com/standardrb/standard/blob/main/standard.gemspec

data/docs/changelogs/20261010101500_nonconventional-id-fields.md

@@ -0,0 +1,48 @@
+# Nonconventional id fields
+
+## Effects
+
+Schema build no longer raises `GraphQL::Schema::DuplicateNamesError` when a
+registered model has an `id` column that is not the ActiveRecord primary key
+(`self.primary_key = nil`) or uses a non-`id` primary key.
+
+`ActiveAdmin::PrimaryKey` falls back to an `id` column when the declared
+primary key is blank. Object types skip emitting a column field named `id`
+(interface owns GraphQL `id`) and expose a single non-`id` primary-key column
+as a readable scalar unless the resource's attribute configuration omits it.
+Models with neither a primary key nor an `id` column fail schema build with an
+`ArgumentError` that asks for `self.primary_key`. On 0.3.0 those models could
+still enter the schema with a broken GraphQL `id`. Apps that keep such a
+resource registered must set `self.primary_key` or use `graphql { disable! }`
+so the rest of the namespace schema still builds. Inferred `id` values must be
+unique and non-null; ambiguous member and batched lookups fail closed.
+
+Member lookup uses the inferred column while preserving an explicitly
+configured ActiveAdmin finder. Request-local policy caching keeps separate
+entries for distinct records when ActiveRecord has no declared primary key.
+
+Dummy coverage includes SQLite views that project `code AS id` and
+`id AS row_key`, plus a table with an `id` column and no primary key.
+
+## Later pass 2026-10-10
+
+Downstream check: a database view with neither primary key nor `id` column
+could stay GraphQL-disabled via `graphql { disable! }`. Spec covers that
+escape hatch next to the ArgumentError path.
+
+Later the same day: RFC 0007 adds `graphql { identity ... }` so those views
+can stay enabled when columns (and optional separator) are declared. See
+docs/changelogs/20261010110600_graphql-identity-dsl.md.
+
+## Next
+
+Core fix shipped in 0.3.1. Identity DSL follow-on is 0.3.2.
+
+## Source
+
+- Specs: `spec/requests/graphql_identity_columns_spec.rb`,
+  `spec/unit/primary_key_identity_spec.rb`,
+  `spec/unit/resource_query_proxy_identity_spec.rb`,
+  `spec/unit/policy_set_cache_spec.rb`
+- Views: `spec/dummy/db/schema.rb` (`string_id_records`, `alternate_key_records`)
+- Follow-on: docs/changelogs/20261010110600_graphql-identity-dsl.md

data/docs/changelogs/20261010103800_release-0-3-1.md

@@ -0,0 +1,39 @@
+# Release 0.3.1 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.1 after published 0.3.0. User-visible work: GraphQL identity for
+database views and nonconventional primary keys; fail-closed when a model has
+neither a primary key nor an `id` column without configuration; and
+`graphql { identity ... }` (RFC 0007) for keyless views with a virtual
+composite id.
+
+CHANGELOG 0.3.1 dated 2026-10-10. Version constant is 0.3.1. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+Docs-only and pray-tooling commits since 0.3.0 stay out of CHANGELOG.md.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.1.
+
+CHANGELOG Unreleased bullet moved under 0.3.1.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.1.
+
+## Next
+
+0.3.1 tagged and published on RubyGems. Post-tag identity DSL work ships in
+0.3.2; see docs/changelogs/20261010111800_release-0-3-2.md.
+
+## Source
+
+docs/changelogs/20261010101500_nonconventional-id-fields.md
+docs/changelogs/20261010110600_graphql-identity-dsl.md
+rfcs/0007-graphql-identity.md
+usr/bin/release.rb

data/docs/changelogs/20261010110600_graphql-identity-dsl.md

@@ -0,0 +1,34 @@
+# GraphQL identity DSL (RFC 0007)
+
+## Decisions
+
+Ship `graphql { identity *columns, separator:, encode:, decode: }` so resources
+without an ActiveRecord primary key and without an `id` column can stay in the
+schema. Prefer resource configuration over forcing `self.primary_key`.
+
+Separator form matches HTML admins that use a virtual `id` method such as
+`[entry_type, entry_id, event_type].join(":")`. Without separator, multi-column
+identity keeps the existing composite JSON string.
+
+## Effects
+
+Schema build, member lookup, mutations that resolve by where/id, and policy
+cache keys go through `ActiveAdmin::GraphQL::ResourceIdentity` when identity is
+configured. Ambiguous matches still fail closed.
+
+Dummy coverage: view `alert_events` / model `AlertEvent` with virtual composite
+`id`.
+
+## Next
+
+Folded into 0.3.2 release metadata (0.3.1 already published without this DSL).
+Tag and gem push wait on make release.
+
+## Source
+
+rfcs/0007-graphql-identity.md
+docs/changelogs/20261010101500_nonconventional-id-fields.md
+docs/issues/20261010111159_rails-composite-primary-keys-alignment.md
+https://guides.rubyonrails.org/active_record_composite_primary_keys.html
+spec/unit/resource_identity_spec.rb
+spec/requests/graphql_identity_dsl_spec.rb

data/docs/changelogs/20261010111800_release-0-3-2.md

@@ -0,0 +1,46 @@
+# Release 0.3.2 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.2 after published 0.3.1. User-visible work since the 0.3.1 tag:
+`graphql { identity ... }` (RFC 0007) for keyless views, and schema-build
+error text that names `identity` alongside `self.primary_key` and `disable!`.
+
+CHANGELOG 0.3.1 restored to the published one-bullet text. Identity DSL bullets
+live under 0.3.2 dated 2026-10-10.
+
+Version constant is 0.3.2. Path gem pins in Gemfile.lock and appraisal
+lockfiles match.
+
+Docs-only notes (Rails composite PK alignment, partitions/shards unsupported,
+federation unsupported) stay out of CHANGELOG.md.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and
+GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.2.
+
+CHANGELOG identity DSL bullets moved from the post-tag 0.3.1 draft under 0.3.2.
+
+PATH specs for activeadmin-graphql in Gemfile.lock,
+gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and
+gemfiles/rails8ruby34.gemfile.lock are 0.3.2.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.2.
+
+## Source
+
+docs/changelogs/20261010110600_graphql-identity-dsl.md
+rfcs/0007-graphql-identity.md
+docs/issues/20261010111159_rails-composite-primary-keys-alignment.md
+docs/issues/20261010111300_partitions-and-shards-support.md
+docs/issues/20261010111500_graphql-federation-support.md
+usr/bin/release.rb

data/docs/dependencies/20260907141000_json-cve-2026-71847.md

@@ -0,0 +1,68 @@
+## Dependency
+
+- json (was below 2.21.2 on the 2.x line, now 2.21.2 in library and appraisal locks)
+- Constraint in this repo: development gemspec json >= 2.21.2, < 3. Transitive via activesupport. rubocop 1.91 allows json >= 2.3.
+- Lockfiles: Gemfile.lock and gemfiles/*.gemfile.lock where present
+
+## Symptom
+
+bundler-audit matches json 2.20.0 through 2.21.1 against CVE-2026-71847 / GHSA-9hj4-r449-hfvc. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: JSON::ResumableParser#partial_value use-after-free on truncated duplicate-key streams. Affected 2.20.0 through 2.21.1. Patched >= 2.21.2.
+- This library does not call JSON::ResumableParser or partial_value.
+
+## Suggested fix
+
+Upgrade lockfiles to json 2.21.2. Stay on 2.x while Rails ActiveSupport::JSON.decode still calls JSON.parse with a positional options hash.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem runtime: json is not a runtime gemspec dependency.
+
+## Advisory
+
+- CVE-2026-71847
+- GHSA-9hj4-r449-hfvc
+- CVSS 8.7 availability (CVSS:4.0). CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin json 2.21.2.
+- Published gem execute path: not_affected. The advisory names ResumableParser#partial_value.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix lockfiles below 2.21.2.
+- Exploit conditions require streaming parse through ResumableParser#partial_value on truncated duplicate-key input.
+
+## Priority
+
+- CI graph: high because bundler-audit fails the security job on version match.
+- Published gem execute path: low. Exploit conditions do not hold on JSON.parse paths.
+
+## Disposition
+
+- Upgrade to 2.21.2. Pin development json < 3 until Rails decode accepts json 3 keyword options.
+
+## Next
+
+- Keep the runtime gemspec free of json unless a later feature streams JSON through ResumableParser.
+- json 3.0.2 is blocked by Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode (positional JSON.parse options). Drop the development json < 3 pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Later pass 2026-09-21
+
+Dropped the standard gem so rubocop 1.91 can resolve. That unblocked json 3 at the Bundler level. Dummy GraphQL request specs then failed: ActionDispatch::Http::Parameters::ParseError wrapping ArgumentError wrong number of arguments (given 2, expected 1). Relocked json 2.21.2 and added development gemspec json >= 2.21.2, < 3. See usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://www.cve.org/CVERecord?id=CVE-2026-71847
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md

data/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

@@ -0,0 +1,62 @@
+## Dependency
+
+- sqlite3 (was at or below 2.9.5, now 2.9.6)
+- Development gemspec floor now >= 2.9.6 where this gemspec declared sqlite3
+- Dummy-app and test graph only. The published gem does not require sqlite3 at runtime.
+
+## Symptom
+
+bundler-audit matches sqlite3 <= 2.9.5 against GHSA-mwm8-39rw-8826. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: use-after-free in custom aggregate arguments when Database#create_aggregate, #create_aggregate_handler, or #define_aggregator takes two or more arguments over TEXT or BLOB values. Affected >= 1.4.0, <= 2.9.5. Patched 2.9.6.
+- This repository has no create_aggregate, create_aggregate_handler, or define_aggregator callers.
+
+## Suggested fix
+
+Upgrade lockfiles to sqlite3 2.9.6 and raise the development gemspec floor so later resolves stay on the patched line.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: dummy SQLite used by specs and appraisal.
+- Published gem runtime: sqlite3 is a development dependency only.
+
+## Advisory
+
+- GHSA-mwm8-39rw-8826
+- Maintainers: Medium, CVSS 4.0 score 6.3
+- CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin sqlite3 2.9.6.
+- Published gem runtime: not_affected. Component not present in the published gem runtime.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix development lockfiles at or below 2.9.5.
+- Exploit conditions require custom multi-arg aggregates. Those APIs are absent from this tree.
+
+## Priority
+
+- CI graph: medium because bundler-audit fails the security job on version match.
+- Published gem runtime: none. sqlite3 is not shipped to consumers of the gem.
+
+## Disposition
+
+- Upgrade. Prefer bundle lock --update=sqlite3 --conservative. Raise the development gemspec floor to >= 2.9.6 when sqlite3 is declared there.
+
+## Next
+
+- Keep sqlite3 as a development dependency.
+
+## Source
+
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
+- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/dependencies/20260921114000_rails-json-parse-kwargs.md

@@ -0,0 +1,61 @@
+## Dependency
+
+- activesupport / rails (locked 8.1.3.1 on Rails 8 appraisals and the root Gemfile.lock; 7.2.3.2 on rails72)
+- json 3.0.2 (RubyGems latest as of 2026-09-09) versus development pin json >= 2.21.2, < 3
+- Constraint in this repo: development gemspec only. json is not a runtime gemspec dependency.
+
+## Symptom
+
+With json 3.0.2, dummy GraphQL request specs that POST application/json fail with HTTP 400 and body errors message Invalid JSON. Rails raises ActionDispatch::Http::Parameters::ParseError. The cause is ArgumentError: wrong number of arguments (given 2, expected 1) from JSON.parse.
+
+## Evidence
+
+- json 3.0.0.rc1 (2026-08-11): JSON methods take keyword options, or options checked like keywords. A positional second Hash is no longer accepted by JSON.parse.
+- ActiveSupport::JSON.decode in Rails 8.1.3.1 and 7.2.3.2 still calls JSON.parse(json, options) with a positional Hash. ActionDispatch JSON parameter parsing uses that decoder.
+- This library's controller uses JSON.parse(body) with one argument. That call works on json 3. The dummy app fails before execute because Rails parses the request first.
+- rails/rails#58601 merged 2026-08-28 (commit 0ca2c2c4cfbe7f0a709bca0589d2d74c1853ef27). It is not in 8.1.3.1 or 7.2.3.2.
+
+## Suggested fix
+
+Keep json on 2.21.2 in this repo's lockfiles until a Rails release includes the decode kwargs change. Then drop the development json < 3 pin and bundle update json.
+
+Do not monkeypatch JSON.parse or ActiveSupport::JSON.decode in this library.
+
+## Trigger
+
+- bundle exec rspec after dropping the standard gem and resolving json 3.0.2. 71 request examples failed with Invalid JSON.
+
+## Assessment target
+
+- CI and test graphs: dummy Rails app used by spec/requests.
+- Published gem execute path: JSON.parse of the request body with one argument.
+
+## Status
+
+- CI and test graphs: affected on json 3 with Rails 8.1.3.1 and 7.2.3.2. fixed after the development pin json < 3 and lockfiles at 2.21.2.
+- Published gem execute path: not_affected for this ArgumentError. The one-argument JSON.parse path does not pass a positional options hash.
+
+## Applicability
+
+- Vulnerable component present: json 3 plus unreleased Rails decode.
+- Exploit conditions: not a security advisory. Dummy JSON POST cannot complete parameter parsing.
+
+## Priority
+
+- CI graph: high because request specs fail on every GraphQL POST.
+- Published gem execute path: low until a host on json 3 and unpatched Rails hits the same decoder.
+
+## Disposition
+
+- Pin. development gemspec json >= 2.21.2, < 3. Wait for a Rails patch release that includes rails/rails#58601.
+
+## Next
+
+- Watch Rails 8.1 / 7.2 patch notes for the json 3 decode kwargs fix. Then drop the json < 3 development pin and lock json 3.0.2 or newer.
+
+## Source
+
+- https://github.com/rails/rails/pull/58601
+- https://github.com/ruby/json/blob/v3.0.2/CHANGES.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/issues/20260921114500_dependency-audit.md