activeadmin-graphql 0.3.0 → 0.3.2

data/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md

@@ -0,0 +1,69 @@
+## Dependency
+
+- graphql (was 2.6.7, now 2.6.10 in Gemfile.lock and gemfiles/*.gemfile.lock; latest on RubyGems 2.6.10, published 2026-08-27)
+- Constraint in this repo: gemspec add_runtime_dependency graphql >= 2.6.9
+- Lockfiles: Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock
+
+## Symptom
+
+bundle-audit matches graphql 2.6.7 against GHSA-rmxg-5p3r-j6hh on every lockfile. Solution text: update to >= 2.6.9.
+
+## Evidence
+
+- Advisory: GraphQL::Language::Cache#fetch reads parser cache files and passes contents to Marshal.load without authenticating payloads. If an attacker can place a crafted file on the expected path and the process calls GraphQL::Language::Parser.parse_file, attacker-controlled marshal_load or _load runs in the process.
+- Affected versions: >= 1.12.6. Patched: 2.6.9. Latest registry version 2.6.10 is a later 2.6 patch (dataloader, parser, Execution::Next fixes). No CVE id on the GitHub advisory page as of 2026-09-21.
+- This tree has no parse_file, parser_cache, or GraphQL::Language::Cache callers. Schema cache in ActiveAdmin::GraphQL is an in-process class cache, not the parser cache.
+- Related older advisory GHSA-j7xr-4g94-r9h3 (Execution::Next authorization bypass) is patched in >= 2.6.6. Lockfiles already sit above that floor. The gemspec floor >= 2.3 still allows those versions for downstream resolvers.
+
+## Suggested fix
+
+Upgrade every lockfile to graphql 2.6.10. Raise the gemspec runtime floor to >= 2.6.9 so consumers cannot resolve the Marshal cache versions. Stay on 2.6; 2.6.10 changelog has no breaking-change heading.
+
+## Trigger
+
+- bundle-audit check against ruby-advisory-db commit 44784c295391577f25d198a9205eae4ba73ec4da (last updated 2026-09-16) during the 2026-09-21 dependency audit.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem execute path: graphql is a direct runtime dependency. Exploit conditions require Parser.parse_file plus a writable parser cache path.
+- Downstream products that resolve this gemspec: unassessed as unnamed consumers.
+
+## Advisory
+
+- GHSA-rmxg-5p3r-j6hh
+- CWE-502
+- Vendor severity High. bundler-audit criticality Unknown. No CVE. CISA KEV: not listed (no CVE id).
+- Related: GHSA-j7xr-4g94-r9h3, patched >= 2.6.6, lockfiles already 2.6.7.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin graphql 2.6.10 and the gemspec floor is >= 2.6.9.
+- Published gem execute path: not_affected. Vulnerable code not in the execute path of this library or dummy app.
+
+## Applicability
+
+- Vulnerable component present: graphql 2.6.7 is a direct runtime gem.
+- Exploit conditions: attacker-controlled parser cache file plus Parser.parse_file. Those APIs are absent from lib/ and spec/.
+
+## Priority
+
+- CI graph: high because bundle-audit fails on every lockfile.
+- Published gem execute path: low. This library does not enable the parser cache.
+- Downstream resolvers: medium until the gemspec floor moves. Consumers who set config.graphql.parser_cache = true on graphql < 2.6.9 meet the advisory conditions.
+
+## Disposition
+
+- Upgrade. bundle lock --update=graphql on the root Gemfile and each appraisal gemfile. Raise spec.add_runtime_dependency graphql to >= 2.6.9.
+
+## Next
+
+- Keep the gemspec floor at graphql >= 2.6.9. Do not drop it back to 2.3.
+
+## Source
+
+- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+- https://rubysec.com/advisories/GHSA-rmxg-5p3r-j6hh/
+- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md (2.6.9 security note, 2.6.10 patch notes)
+- https://rubysec.com/advisories/GHSA-j7xr-4g94-r9h3/
+- usr/docs/issues/20260921114500_dependency-audit.md

data/docs/dependencies/20261007161308_association-list-combobox.md

@@ -0,0 +1,23 @@
+## Dependency
+
+activeadmin-graphql (this gem). List queries already expose paginated Ransack q, order, and first or last.
+
+## Symptom
+
+The gem has no Formtastic or Stimulus association picker that queries those lists as the person types. Hosts that need searchable associations either embed full catalogs in select or datalist, or keep a local combobox.
+
+## Evidence
+
+Schema and docs describe list fields with the same filter contract as the JSON index. There is no shipped input or controller that posts first and q, keeps a label plus hidden id, and replaces a bounded page on further typing.
+
+## Suggested fix
+
+When a second host needs the same control, or when packaging is requested, ship a Formtastic input and Stimulus controller that take GraphQL field name, node selection fields, search key, order, first, and optional extra q. Do not bake product model names into the gem. Keep host field maps and labels in the host. Until then, leave pickers host-local. Do not publish a third gem only for this picker.
+
+## Next
+
+Open an issue or pull request for the generic picker when packaging is requested. Index filter sidebars and multi-select include or exclude catalogs are out of scope for that first slice. Loading and error states, multi-select, and filter-sidebar wiring remain open after a first single-select page.
+
+## Source
+
+- docs/graphql-api.md list query contract

data/docs/graphql-api.md

@@ -223,14 +223,45 @@ mutation keys. `permit_params` and nested `create` / `update` blocks narrow
 create and update inputs without hiding query fields. Default mutation inputs
 omit `created_at` and `updated_at`.
 
+### Nonconventional primary keys
+
+GraphQL `id` always comes from `ActiveAdminResource` (`ID!`). An ActiveRecord
+`id` column is never added as a second field. When `self.primary_key` is blank
+but the model still has an `id` column (common for database views that project
+`… AS id`), that column supplies the GraphQL `id` value. When the model has
+neither a primary key nor an `id` column, declare GraphQL identity on the
+resource (RFC 0007), set `self.primary_key` on the model, or omit the resource
+with `graphql { disable! }`. A single-column primary key named something other
+than `id` is also exposed as its own readable field beside `id`, unless `only`
+or `exclude` omits it. An inferred `id` column must contain a unique, non-null
+value for every row; ambiguous member and batched lookups fail instead of
+selecting one row.
+
+```ruby
+# View with no PK and no id column; virtual identity matches HTML admin.
+ActiveAdmin.register AlertEvent do
+  graphql do
+    identity :entry_type, :entry_id, :event_type, separator: ":"
+    # optional: encode: ->(record) { record.id }, decode: ->(id) { ... }
+  end
+end
+```
+
+With `separator: ":"`, GraphQL `id` is `entry_type:entry_id:event_type`. Keep
+the model’s `def id` (if any) in the same shape so HTML and GraphQL share
+member ids. Without `separator`, multi-column identity uses the same JSON
+object string as composite ActiveRecord primary keys.
+
 ### Composite primary keys (Rails 7.1+)
 
 For models with `self.primary_key = [:book_code, :seq]` (and no separate `id`
 column), Active Admin treats GraphQL as follows:
 
 * `id` on the object type — JSON object string with all key columns in
-  model order (same format Rails uses when casting composite ids), for example
-  `{"book_code":"CPK","seq":7}`.
+  model order, for example `{"book_code":"CPK","seq":7}`. This is the GraphQL
+  wire format. It is not the Rails form/URL underscore packing described in
+  the Composite Primary Keys guide (`/books/2_25` with
+  `params.extract_value(:id)`).
 * Readable fields — each primary-key column is also exposed as its own field
   (in addition to `id`) so clients can load scalars without parsing JSON.
 * `LibraryEditionWhereInput` (and similar) — either optional `id` (that JSON
@@ -242,12 +273,20 @@ column), Active Admin treats GraphQL as follows:
   inputs (unlike single `id` tables, where the key is omitted from assignable
   attributes).
 
-For REST/HTML member routes, `ResourceController#find_resource` must resolve composite ids from `params[:id]` (JSON string) or from individual primary-key params. Stock ActiveAdmin 3.x only passes a single `params[:id]` into `find`; an ActiveAdmin fork (or patch) that implements composite-aware `find_resource` keeps the admin UI aligned with GraphQL. The GraphQL layer also works with `ActiveAdmin::GraphQL::ResourceQueryProxy` using Rails’ tuple id convention for `Relation#find`.
+For REST/HTML member routes, `ResourceController#find_resource` must resolve
+composite ids from `params[:id]` or from individual primary-key params. Stock
+ActiveAdmin 3.x only passes a single `params[:id]` into `find`; an ActiveAdmin
+fork (or patch) that implements composite-aware `find_resource` keeps the
+admin UI aligned with GraphQL. After decoding the GraphQL JSON `id`, the gem
+uses Rails’ array/tuple conventions for `Relation#find` and
+`where(primary_key => [tuple, …])` as in the guide.
 
-The gem ships `ActiveAdmin::PrimaryKey` when the core constant is missing (upstream). A fork may define `PrimaryKey` and extended `find_resource` in `ResourceController` instead.
+The gem ships `ActiveAdmin::PrimaryKey` when the core constant is missing
+(upstream). A fork may define `PrimaryKey` and extended `find_resource` in
+`ResourceController` instead.
 
-`ActiveAdmin::GraphQL::RecordSource` batch-loads composite associations using
-Rails `where(primary_key => [tuple, …])`.
+Alignment notes versus the Rails guide:
+`docs/issues/20261010111159_rails-composite-primary-keys-alignment.md`.
 
 ### Collection query arguments
 
@@ -346,6 +385,7 @@ Inside `ActiveAdmin.register` you can narrow the GraphQL surface:
 ActiveAdmin.register Post do
   graphql do
     disable!                          # omit this resource from the schema
+    # identity :entry_type, :entry_id, :event_type, separator: ":"  # RFC 0007
     type_name "BlogPost"              # GraphQL object / mutation type basename (`graphql_name` alias)
     only :title, :body, :published_at # expose only these attributes on queries
     exclude :internal_score           # or `except` / `exclude`
@@ -366,6 +406,9 @@ end
 ```
 
 * `disable!` — resource is not included in Query or Mutation.
+* `identity` — declare GraphQL id columns (and optional `separator`, `encode`,
+  `decode`) when the model has no ActiveRecord primary key and no `id` column
+  (RFC 0007).
 * `type_name` (or `graphql_name`) — overrides the default GraphQL type name
   derived from the model (object types, mutations, and Rails enum GraphQL
   types use this basename).

data/docs/issues/20260907141000_engineering-and-dependency-audit.md

@@ -0,0 +1,30 @@
+Recorded 2026-09-07. Library gem. Scheduled CI bundler-audit failed on json CVE-2026-71847 and, where present, sqlite3 GHSA-mwm8-39rw-8826.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Bump json to 2.21.2 in Gemfile.lock and appraisal lockfiles. Keep json on 2.x because rubocop declares json ~> 2.3.
+- Bump sqlite3 to 2.9.6 in the test graph where the pin was still affected. Raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Treat CVE-2026-71847 as not_affected for this gem execute path. The advisory names JSON::ResumableParser#partial_value.
+- Treat GHSA-mwm8-39rw-8826 as not_affected for the published gem runtime when sqlite3 is development-only. Still bump the test graph so bundler-audit can pass.
+- Leave Dependabot bundler at directory /. Appraisal *.gemfile names are not a working Dependabot directory.
+
+## Effects
+
+- Root and appraisal lockfiles pin json 2.21.2. sqlite3 pins 2.9.6 where that gem was in the graph.
+- Dependency records live under usr/docs/dependencies.
+
+## Next
+
+- Appraisal lockfiles stay outside Dependabot directory /. Keep CI bundler-audit as the gate unless a later pass finds a supported Dependabot layout for those files.
+
+## Source
+
+- usr/docs/changelogs/20260907141000_advisory-lockfile-refresh.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826

data/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md

@@ -0,0 +1,29 @@
+CI quality failed on a trailing blank line in spec/support/junit_formatter.rb. Test CI also ran bundler-audit or osv-scanner, which fail whenever an advisory lands even when a separate dependency audit already exists.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Drop bundler-audit and security jobs from test.yml so tests no longer wait on advisory freshness.
+- Drop the advisory osv-scanner job from test.yml.
+- Add dependency-audit.yml with workflow_dispatch only. Do not run it on push, pull request, or schedule.
+- Disable osv-scanner in Trunk Check.
+- Disable markdownlint MD013 in .markdownlint.yaml. Keep AGENTS.md in Trunk so other markdownlint rules still run.
+- Keep lockfile and spec fixes that were already blocking quality or tests.
+
+## Effects
+
+- Test CI runs lint and specs without an advisory gate.
+- Trunk Check no longer treats dependency CVEs as a required check.
+- On-demand bundler-audit of every Gemfile.lock is available through workflow_dispatch.
+
+## Next
+
+- Run dependency audit on demand when a release or a known advisory needs it.
+- Do not reintroduce advisory scanners into test.yml.
+
+## Source
+
+- GitHub Actions test and Trunk Check failures on 2026-09-17

data/docs/issues/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,40 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0006 Proposed adds assignable, create_only, update_only, and except_assignable (alias unassignable) on the per-resource graphql block.
+
+only and except stay the readable ceiling. Mutation lists intersect that set and cannot widen it.
+
+Default create and update inputs stay the current assignable column set, including timestamps. Changing that default would break clients.
+
+ResourceQueryProxy#build_new still permits graphql_assignable_attribute_names so a resolve_create hook can set server-owned readable columns. The GraphQL input type and the mutation resolver slice use the mutation lists.
+
+## Effects
+
+Request spec spec/requests/graphql_mutation_allowlists_spec.rb failed first: six examples raised NoMethodError on the new DSL. Default examples passed and showed PostCreateInput includes created_at, updated_at, and starred, and that create_post persists a client-supplied created_at of 2020-01-02T03:04:05Z.
+
+After the implementation that spec file: 8 examples, 0 failures (bundle exec rspec spec/requests/graphql_mutation_allowlists_spec.rb).
+
+Claims from the downstream dependency note, checked in this tree at version 0.2.1:
+
+1. Gem version is 0.2.1. Source: lib/active_admin/graphql/version.rb VERSION = "0.2.1". Outcome: supported.
+2. Generated create and update inputs expose every assignable database column. Source: ActiveAdmin::Resource#default_attributes walks resource_class.columns minus primary key, STI, counter cache, and application filter_attributes (encrypted_password, password, password_confirmation). SchemaBuilder TypesInputs used graphql_assignable_attribute_names for both input types. Dummy PostCreateInput in the new spec includes title, body, starred, created_at, updated_at. Outcome: supported for ActiveAdmin resource_attributes, not every SQL column in the abstract (filtered password columns stay out).
+3. The package mutations therefore accepted calculated values and internal timestamps that the server owns. Source: the same spec persisted created_at on create. Package column names (budget status, velocity, usage totals) are not in this repository. Outcome: supported for timestamps on Post; unverifiable for named Package columns.
+4. only limits output fields, so it cannot express a mutation-only allowlist without hiding fields from queries. Source: attributes_for_graphql applies only_attributes and exclude_attributes; types_object and graphql_assignable_attribute_names both use that list. Outcome: supported.
+5. The schema builder derives both mutation inputs from graphql_assignable_attribute_names and provides no separate create or update configuration. Source: types_inputs.rb before this change; ResourceConfig had only_attributes and exclude_attributes only. Outcome: supported for 0.2.1; outdated after RFC 0006 ships.
+6. The application resolves the gem from its published package and records it in Gemfile.lock. Source: not this repository. Outcome: unverifiable here.
+
+## Next
+
+Keep RFC 0006 Proposed until 2026-10-05 lazy consensus. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+Later pass 2026-09-21: DSL renamed to ActiveAdmin permit_params with nested create and update blocks. create_only, update_only, assignable, and except_assignable were dropped before release. Spec path is spec/requests/graphql_mutation_permit_params_spec.rb. RFC file is rfcs/0006-mutation-permit-params.md. Default mutation inputs omit created_at and updated_at.
+
+## Source
+
+Downstream dependency note that described PackageCreateInput. RFC 0004. lib/active_admin/graphql/integration.rb. lib/active_admin/graphql/schema_builder/types_inputs.rb. vendor activeadmin-3.5.2 lib/active_admin/resource/attributes.rb and application_settings.rb filter_attributes. spec/requests/graphql_mutation_allowlists_spec.rb.

data/docs/issues/20260921104400_convention-alignment-audit.md

@@ -0,0 +1,60 @@
+# Convention alignment engineering audit
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Mutation write lists use ActiveAdmin permit_params. Per-operation lists live in nested create and update blocks with graphql-ruby resolve pairing, matching member_action_mutation. create_only, update_only, assignable, except_assignable, and unassignable are not in the public DSL.
+
+Empty GraphQL input objects call has_no_arguments(true) so graphql-ruby 2.6 does not warn toward a future raise.
+
+HTML permit_params is copied when the HTML call is a static argument list. A request-time block is not copied.
+
+Default mutation inputs omit created_at and updated_at unless listed on permit_params.
+
+destroy_post is registered as an alias of delete_post. graphql_name is an alias of type_name.
+
+Failed save and update raise GraphQL::ExecutionError with extensions.errors. CRUD fields still return the resource object.
+
+GraphqlController logs namespace, operation name, and error_count without the query body or current user.
+
+ResourceMethods lives in lib/active_admin/graphql/resource_methods.rb.
+
+## Effects
+
+First pass used create_only. Second pass replaced it after a convention check against graphql-ruby 2.6.7, Rails 8.1 nested_attributes update_only, upsert_all update_only, and ActiveAdmin 3.5.2 permit_params.
+
+bundle exec rspec spec/requests/graphql_mutation_permit_params_spec.rb: 8 examples, 0 failures after the rename.
+
+## Findings
+
+Severity high. Confidence high. Location SchemaBuilder TypesInputs default create and update inputs. Why it matters: extra-field write of created_at on create, observed in spec/requests/graphql_mutation_permit_params_spec.rb. Evidence kind observed. Security disposition confirmed. Smallest credible fix: graphql { permit_params :title, :body } in the host app. Deeper fix: omit created_at and updated_at from default mutation inputs in a later RFC, matching ActiveAdmin generators/boilerplate.rb assignable_attributes.
+
+Severity medium. Confidence high. Location ResourceDefinitionDSL versus ActiveAdmin::ResourceDSL#permit_params. Why it matters: HTML and GraphQL write lists can drift. Evidence kind observed that GraphQL never calls HTML permit_params. Inference that a static argument list could be copied; confirming check is to parse the controller permitted_params method or store the original args on the resource. Smallest credible fix: document that graphql permit_params should match HTML. Deeper fix: seed GraphQL from a static HTML list when graphql permit_params is unset.
+
+Severity medium. Confidence high. Location mutation_update_destroy.rb delete_ prefix versus actions.include?(:destroy). Why it matters: Rails and ActiveAdmin name the action destroy; GraphQL field is delete_post. Evidence kind observed. Smallest credible fix: none in this RFC; shipped client contract. Deeper fix: RFC to add destroy_* alias or rename.
+
+Severity medium. Confidence high. Location mutation_create.rb returning the record and raising GraphQL::ExecutionError. Why it matters: graphql-ruby Schema::Mutation example returns hash with errors array. Evidence kind observed in graphql-2.6.7 lib/graphql/schema/mutation.rb. Smallest credible fix: none in this RFC. Deeper fix: payload type RFC.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#type_name versus graphql-ruby graphql_name. Why it matters: two names for the same idea. Evidence kind observed. Smallest credible fix: alias graphql_name. Deeper fix: deprecate type_name after a release.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#only versus ActiveAdmin action_item only: for controller actions. Why it matters: only already means attribute list in this gem since 0.2.1. Evidence kind observed. Smallest credible fix: keep only; document the split from ActiveAdmin action only.
+
+Severity low. Confidence high. Location GraphqlController, no request correlation log. Why it matters: host logs may not show which GraphQL operation failed. Evidence kind observed absence of log calls in graphql_controller.rb. Smallest credible fix: none required of a library; host can log. Deeper fix: optional around_action.
+
+Severity low. Confidence high. Location lib/active_admin/graphql/integration.rb line count 176. Why it matters: file is above the 150 line preference. Evidence kind observed. Smallest credible fix: extract ResourceMethods. Not done this pass.
+
+## Next
+
+Findings from the 2026-09-21 audit pass are addressed except replacing CRUD return types with graphql-ruby payload objects, which would break RFC 0004 field types. Keep RFC 0006 Proposed. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+## Source
+
+rfcs/0006-mutation-permit-params.md
+spec/requests/graphql_mutation_permit_params_spec.rb
+vendor activeadmin-3.5.2 lib/active_admin/resource_dsl.rb permit_params
+vendor activerecord-8.1.3.1 lib/active_record/nested_attributes.rb update_only
+vendor graphql-2.6.7 lib/graphql/schema/mutation.rb
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md

data/docs/issues/20260921114500_dependency-audit.md

@@ -0,0 +1,90 @@
+# Dependency audit 2026-09-21
+
+Full audit: recon, security, freshness, ecosystem. Depth reached: full for hot-path direct packages; GitHub REST rate-limited after activeadmin, graphql-ruby, and ransack so remaining repo strain counts use registry dates, release pages, and fetched repo summaries.
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Do not bump the whole graph to every registry latest. Hot-path and advisory matches first. Skip ActiveAdmin 4.0.0.beta23, json 3, arbre 2, inherited_resources 2, marcel 2, diff-lcs 2, and net-protocol 0.4. Those majors are either prerelease, pinned by ActiveAdmin 3.5.2, or required by rubocop json ~> 2.3.
+
+Upgrade graphql to 2.6.10 and raise the gemspec floor to >= 2.6.9. That is the only security-driven change from this pass.
+
+Optional same-pass lockfile patches with no major jump: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0. rbs 4.2.0, io-console 0.9.4, reline 0.7.0, parallel 2.2.0, sprockets 4.4.1, and rubocop 1.91 sit behind Standard and Rails pins; bump only if those parents allow it.
+
+Keep sqlite3 2.9.6 and json 2.21.2. Those pins already match the 2026-09-07 advisory records.
+
+Stay on ActiveAdmin 3.5.2. It is the latest stable on RubyGems. 4.0.0.beta23 (2026-09-20) is prerelease and pulls arbre ~> 2.0 and inherited_resources ~> 2.0.
+
+Do not reverse the 2026-09-17 choice to keep bundle-audit off test.yml. The on-demand workflow remains the gate. Makefile still has no audit target that mirrors that workflow.
+
+## Effects
+
+ruby-advisory-db update: 1245 advisories, last updated 2026-09-16 10:35:37 -0400, commit 44784c295391577f25d198a9205eae4ba73ec4da.
+
+bundle-audit check failed on all four lockfiles with GHSA-rmxg-5p3r-j6hh (graphql 2.6.7, solution >= 2.6.9). No other scanner matches.
+
+bundle outdated --strict on the root Gemfile listed 16 outdated specs. graphql 2.6.7 vs 2.6.10 is the only outdated hot-path direct runtime gem.
+
+Libyears from Gemfile.lock vs RubyGems stable (compact-graph band: about 10 low, about 100 medium): 124 locked packages, 27 outdated, total lag 17.94 years, average 0.145 years per package, 6 packages one major behind (arbre, inherited_resources, json, marcel, diff-lcs, rubocop-capybara). Coverage floor in config/polyrun_coverage.yml is 85 percent line. No upgrade spike was run this pass.
+
+No person-facing surface in this pass.
+
+## Findings
+
+Tier hot path direct. Kind security. Severity high. Confidence high. Package graphql 2.6.7. Why it matters: Marshal.load of unauthenticated parser cache files is RCE when parse_file runs. Evidence kind observed (bundle-audit, GHSA text, repo grep with no parse_file). Sources: GHSA-rmxg-5p3r-j6hh, ruby-advisory-db. Smallest fix: lock 2.6.10 and gemspec >= 2.6.9. Deeper fix: none. Status: CI graphs affected; this library execute path not_affected. Disposition: upgrade. Next: apply when confirmed.
+
+Tier hot path direct. Kind freshness. Severity low. Confidence high. Package activeadmin 3.5.2 equals RubyGems stable latest (2026-07-13). Why it matters: 4.0.0.beta23 is a different major with arbre 2 and inherited_resources 2. Evidence kind observed (rubygems.org/gems/activeadmin). Watch: stay on 3.5.2 until a stable 4.0. Recon: github.com/activeadmin/activeadmin last push 2026-09-21, 9709 stars, 30 open issues, MIT, not archived.
+
+Tier hot path direct. Kind recon. Severity low. Confidence high. Package graphql locked 2.6.7, latest 2.6.10. Upstream rmosolgo/graphql-ruby last push 2026-09-17, 5445 stars, 63 open issues, MIT. Maintainer cluster: rmosolgo, protocol family graphql-ruby, already the runtime schema engine. Classification healthy. 2.6.10 changelog is patch-level after the 2.6.9 security fix.
+
+Tier hot path transitive. Kind ecosystem. Severity low. Confidence medium. Package kaminari 1.2.2. Why it matters: latest gem is still 1.2.2 from 2021-12-25 while GitHub last push is 2026-02-20 and several June 2026 PRs sit open. ActiveAdmin 3.5.2 and 4.0.0.beta23 still depend on kaminari >= 1.2.1. Evidence kind observed (rubygems version date, github.com/kaminari/kaminari). Watch, not a CVE. Cannot upgrade independently of ActiveAdmin.
+
+Tier hot path transitive. Kind freshness. Severity low. Confidence high. Packages arbre 1.7.0 (latest 2.2.1) and inherited_resources 1.14.0 (latest 2.1.0). Why it matters: ActiveAdmin 3.5.2 pins arbre ~> 1.2 and inherited_resources ~> 1.7. Evidence kind observed (Gemfile.lock activeadmin 3.5.2 dependencies). Do not force majors.
+
+Tier hot path transitive. Kind recon. Severity low. Confidence medium. Package ransack 4.4.1 equals latest (2025-09-29). github.com/activerecord-hackery/ransack last push 2026-05-31, 5860 stars, 156 open issues (about 2.7 percent). Classification healthy. formtastic 6.0.0 equals latest (2026-02-20). has_scope 0.9.0 and jquery-rails 4.6.1 equal latest.
+
+Tier hot path transitive. Kind security. Severity low. Confidence high. Package rack 3.2.6 vs latest 3.2.7. Why it matters: April 2026 Rack CVEs (including GHSA-g2pf-xv49-m2h5 / CVE-2026-34835 and GHSA-h2jq-g4cq-5ppq / CVE-2026-34785) are patched in 3.2.6. 3.2.7 restores Ruby 2.4/2.5 compatibility only. Evidence kind observed (rack changelog 3.2.6 security section, 3.2.7 note). Status: not_affected for those CVEs at 3.2.6. Optional patch bump.
+
+Tier dev/test. Kind freshness. Severity low. Confidence high. json 2.21.2 vs 3.0.2 blocked by rubocop json ~> 2.3. sqlite3 2.9.6 is latest and matches GHSA-mwm8-39rw-8826. rails 8.1.3.1 and 7.2.3.2 match appraisal floors and are current on those lines. appraisal 2.5.0 equals latest (2023-07-14); stale but current.
+
+Tier automation. Kind automation gap. Severity low. Confidence high. Why it matters: Dependabot bundler directory / does not refresh gemfiles/*.gemfile.lock. scorecard.yml still pins actions/checkout 9c091bb (v7.0.0) while test.yml uses 3d3c42e5 (v7.0.1). ossf/scorecard-action 4eaacf05 is v2.4.3; v2.4.4 exists. mschilde/auto-label-merge-conflicts is commented as master. Makefile has no audit target. Evidence kind observed (workflow files, dependabot.yml). Smallest fix: optional action SHA refresh via Dependabot; keep appraisal locks in the on-demand audit. Do not put advisory scanners back on test.yml.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601. Then drop the development json < 3 pin and bundle update json. Leave marcel 2 and diff-lcs 2 alone until those parents move.
+
+The standard gem is gone. Lint uses rubocop plus a snapshot of standard 1.56.0 rules.
+
+Optional: align scorecard.yml checkout SHA with v7.0.1.
+
+## Later pass 2026-09-21
+
+This gem is supposed to support ActiveAdmin 4. The first pass skipped the beta. That decision is reversed for the Rails 8 appraisals only.
+
+Decisions: pin ActiveAdmin 4.0.0.beta23 in gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile. Keep ActiveAdmin ~> 3.5, >= 3.5.2 on rails72. Raise graphql gemspec floor to >= 2.6.9 and lock 2.6.10. Apply the optional patch set. net-protocol 0.4.0 came in with net-imap 0.6.7. json stays 2.21.2.
+
+Rubocop and json 3 path: Standard 1.56.0 (latest, 2026-07-15) depends on rubocop ~> 1.88.0. Locked rubocop 1.88.2 depends on json ~> 2.3, which rejects json 3. RuboCop 1.91.0 depends on json >= 2.3, which allows json 3.0.2. graphql 2.6.8 already dropped quirks_mode for JSON 3. This library uses JSON.parse, JSON.generate, and JSON.dump(hash, buffer). json 3.0.1 restored the dump positional limit argument. Do not add a Gemfile rubocop override that fights Standard.
+
+Effects: bundle-audit check on all four lockfiles: No vulnerabilities found. make lint: 84 files, no offenses, rbs validate ok. bundle exec rspec: 102 examples, 0 failures on the root ActiveAdmin 3.5.2 bundle. BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile: 102 examples, 0 failures each on ActiveAdmin 4.0.0.beta23. Dummy GraphQL request specs did not need cssbundling-rails or importmap-rails. AA4 HTML asset install is still a host-app concern.
+
+## Later pass 2026-09-21 drop standard
+
+Dropped the standard gem. Locked rubocop 1.91.0. json 3.0.2 failed dummy GraphQL POSTs through Rails JSON.decode. Kept json 2.21.2 with development gemspec json >= 2.21.2, < 3. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md and usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+Commands: bundle-audit update; bundle-audit check --gemfile-lock on Gemfile.lock and gemfiles/*.gemfile.lock; bundle outdated --strict; RubyGems /api/v1/gems and /api/v1/versions for locked-vs-latest lag; GitHub REST /repos for activeadmin/activeadmin, rmosolgo/graphql-ruby, activerecord-hackery/ransack.
+
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://rubygems.org/gems/activeadmin
+https://rubygems.org/gems/graphql
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+https://github.com/rails/rails/pull/58601
+usr/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
+usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/issues/20260921115500_file-length-metrics.md

@@ -0,0 +1,31 @@
+# File length metrics
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Per-file line count is Metrics/FileLength. RuboCop core does not ship that cop. The local cop counts physical source lines, including blanks and comments.
+
+WarnMax is 150 and reports as info. Max is 300 and reports as error. RuboCop fail-level is refactor, so a warning offense would fail make lint the same as an error. Info is the non-failing warning band. Error is the alert that fails the run.
+
+Class and module length stay at 200 with CountAsOne for array, hash, heredoc, and method_call. That sits between the preferred file size and the file alert. Complexity cops stay at cyclomatic 18, perceived 18, and AbcSize 35.
+
+spec/requests/graphql_spec.rb is over 300 lines. It has a file-level disable until that request matrix is split.
+
+## Effects
+
+bundle exec rspec spec/unit/file_length_cop_spec.rb: 4 examples, 0 failures.
+
+make lint: bundle exec rubocop, 86 files inspected, 5 info Metrics/FileLength offenses, exit 0. bundle exec rbs validate succeeded.
+
+## Next
+
+Split spec/requests/graphql_spec.rb so the disable can drop. Files in the info band at this pass: app/controllers/active_admin/graphql_controller.rb, lib/active_admin/graphql/integration.rb, lib/active_admin/graphql/resource_query_proxy/controller.rb, lib/active_admin/graphql/schema_builder/query_type_policies.rb, spec/requests/graphql_mutation_permit_params_spec.rb.
+
+## Source
+
+.rubocop.yml Metrics/FileLength, Metrics/ClassLength, Metrics/ModuleLength
+rubocop/cop/metrics/file_length.rb
+spec/unit/file_length_cop_spec.rb

data/docs/issues/20261010111159_rails-composite-primary-keys-alignment.md

@@ -0,0 +1,81 @@
+# Rails composite primary keys alignment
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Treat ActiveRecord composite primary keys and GraphQL `identity` as related but
+not identical contracts. Keep GraphQL `id` as a single `ID!` string. Do not
+adopt Rails form URL underscore packing as the default GraphQL id encoding.
+
+Record alignment against the Rails guide Composite Primary Keys
+(https://guides.rubyonrails.org/active_record_composite_primary_keys.html)
+after shipping inferred id columns and RFC 0007 identity DSL.
+
+## Effects
+
+Compared gem behavior to the guide’s model, query, form, and parameter rules.
+
+ActiveRecord composite primary key (self.primary_key = array):
+
+- Aligns: model declares composite key the same way as the guide’s
+  `self.primary_key = [:store_id, :sku]` style. Dummy `LibraryEdition` uses
+  `[:book_code, :seq]`.
+- Aligns: internal batch and find paths convert that string id into an ordered
+  value list and use Rails tuple/`Relation#find` style lookups
+  (`ActiveAdmin::PrimaryKey.dataloader_tuple`, `ResourceQueryProxy` composite
+  branch). That matches the guide’s `Product.find([3, "XYZ12345"])` and
+  `where(primary_key => [[...], [...]])` idea at the Ruby API layer.
+- Diverges: GraphQL and the published docs encode composite `id` as a JSON
+  object string (`{"book_code":"CPK","seq":7}`), not as the guide’s form/URL
+  underscore packing (`/books/2_25` with `params.extract_value(:id)`). JSON
+  keeps column names explicit and avoids ambiguity when a key value contains
+  `_`. Underscore packing is not accepted as GraphQL `id` today.
+- Diverges: GraphQL also accepts per-key arguments and `WhereInput` fields for
+  composite models. The guide’s controller example extracts one `:id` param
+  into an array; we keep named keys as a GraphQL-friendly alternate.
+- Aligns with guide caution: `where(id: ...)` / `find_by(id:)` on composite
+  models can mean an `:id` attribute, not the full primary key. The gem’s
+  GraphQL `id` field is the ActiveAdminResource identity string, not
+  necessarily an ActiveRecord `:id` column. Member lookup uses primary-key
+  columns (or configured identity), not a bare `where(id: graphql_id)` on
+  composite models.
+
+Keyless views and RFC 0007 `graphql { identity ... }`:
+
+- Outside the guide’s scope. The guide assumes a declared composite primary
+  key on the table/model. AlertEvent-style views with `primary_key = nil` and
+  a virtual Ruby `id` are not Rails composite primary keys.
+- `identity :a, :b, :c, separator: ":"` is an application-level encoding so
+  GraphQL can share the same string as a hand-rolled `def id; [...].join(":")`.
+  That separator form is closer in spirit to Rails’ delimited URL id than our
+  JSON composite encoding, but the delimiter and segment rules are app-chosen,
+  not `extract_value`’s underscore default.
+- Without `separator`, configured multi-column identity reuses the gem’s JSON
+  object string so keyless and AR-composite GraphQL ids stay one family.
+
+Stock ActiveAdmin HTML member routes still need a composite-aware
+`find_resource` (or custom finder) for AR composite keys; GraphQL does not
+make Rails form URLs use JSON.
+
+## Next
+
+Leave GraphQL composite `id` as JSON for AR composite primary keys unless a
+later RFC deliberately adds underscore (or `extract_value`-compatible) accept
+and emit. Document that choice next to the Rails guide, not as “the same
+format Rails uses for casting composite ids” without qualification.
+
+No change required for RFC 0007 separator identity; it is the escape hatch
+when the model is not a Rails composite primary key.
+
+## Source
+
+https://guides.rubyonrails.org/active_record_composite_primary_keys.html
+docs/graphql-api.md (Nonconventional primary keys, Composite primary keys)
+rfcs/0007-graphql-identity.md
+lib/active_admin/primary_key.rb
+lib/active_admin/graphql/resource_identity.rb
+spec/dummy/app/models/library_edition.rb
+spec/dummy/app/models/alert_event.rb

data/docs/issues/20261010111300_partitions-and-shards-support.md

@@ -0,0 +1,55 @@
+# Table partitions and database shards support
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+activeadmin-graphql does not treat database table partitions or Rails
+database shards as a GraphQL configuration surface. Identity DSL (RFC 0007)
+and ActiveRecord composite primary keys only encode lookup columns into
+GraphQL `id`. They do not select a shard, connection role, or physical
+partition.
+
+App-level Rails multi-database setup (`connects_to`, `connected_to`,
+horizontal shards, tenant middleware) may still apply implicitly: GraphQL
+resolvers reuse ActiveAdmin `scoped_collection` / `find_resource` on whatever
+connection the request process already has. That inheritance is undocumented
+as a product feature and untested in this gem.
+
+## Effects
+
+Searched lib, docs, rfcs, and spec for partition, shard, connects_to,
+multiple database, tenant routing, writing_role, and reading_role.
+
+Product code has no shard or partition API. Hits for “shard” and “partition”
+are Polyrun/CI test parallelism and agent IO-fault vocabulary, not databases.
+
+Dummy app uses one SQLite database (`spec/dummy/config/database.yml`). No
+multi-DB, no partitioned table fixtures, no `connected_to` specs.
+
+`RecordSource`, `PrimaryKey`, and `ResourceIdentity` run `where` / encode on
+the current model class only. A partition-key column can appear in
+`graphql { identity ... }` as part of the id string; that still queries the
+already-selected connection and does not prune or route partitions.
+
+## Next
+
+If a host needs GraphQL across shards or partitioned tables, keep routing in
+the Rails/ActiveAdmin request boundary (middleware, `connected_to`, custom
+finder). Do not invent gem DSL until a concrete host failure and RFC name the
+contract (shard key in GraphQL args, role switching, cross-shard batch limits).
+
+Optional later: document “unsupported / inherited only” next to identity in
+`docs/graphql-api.md` when a reader asks again.
+
+## Source
+
+lib/active_admin/graphql/resource_identity.rb
+lib/active_admin/graphql/record_source.rb
+lib/active_admin/graphql/resource_query_proxy.rb
+spec/dummy/config/database.yml
+rfcs/0007-graphql-identity.md
+docs/issues/20261010111159_rails-composite-primary-keys-alignment.md
+polyrun.yml (test shards only)