cutoff 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62b041df9110341cc0f55dc67e59098c03caa41f96661bd95a73689e0e508606
-  data.tar.gz: c61f6dd25c2781924d9f98bf20ca1deedc701f2d4aae143dad97eae987006a47
+  metadata.gz: 8e267a7090c7eee2e054ccc060c18a38a4f6d27277477d7fcfc3263b7f16091a
+  data.tar.gz: f7a34c730fe930080da8a539b5c864b4b4af467a042c7ddf075ba7df7242da79
 SHA512:
-  metadata.gz: 853b7822a150ea5c55b345694919299a839f06d8f414dde5fd285d30789a3a6f4e3da234dc32fafd6411b358827ee0f25184da28fff1140d5d86aca4df7f286c
-  data.tar.gz: df37414f0271365e2fdb0adfe5e8a20e805b353f6c37d8b391271edc1ddf4f96a82cf7c340d59ca56c56b722a9873f5031d84f5b6eba5e532a54baa363da1dbd
+  metadata.gz: 1853882757fc2da5bae7c836423893dcd2b673f09ff4ebb191dcababd8b44fbf114617664a7974bf67b2a615dbb2fb2f8c2da31876bf5a580d47f9b908d9af79
+  data.tar.gz: 75eec1648d14ac62203989bb51ab2b4e3e6710006c0c072d4e98933c367ebd96fde88b7a33705983f1ba09cc44b5e486dacde80e06b9e47291a804883c16872b

data/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-08-07
+
+### Fixed
+
+- The Mysql2 patch now finds the first `SELECT` when a statement begins with a
+  parenthesized query block, as in `(SELECT ...) UNION (SELECT ...)`.
+  Previously the leading `(` was treated as an unrecognized token and the
+  parser bailed out, so `MAX_EXECUTION_TIME` was silently never inserted and
+  the query ran with no server-side ceiling. MySQL applies a hint in the first
+  query block to the whole statement, so these queries are now capped
+  correctly.
+- Fixed a check in the Mysql2 patch that used `String#casecmp` where a boolean
+  was expected. Because `casecmp` returns `0` for a match (which is truthy in
+  Ruby), the guard never fired and any leading token merely *starting with*
+  `select` (such as `selections`) had a hint comment spliced into it,
+  producing invalid SQL. It now uses `casecmp?`.
+
+### Upgrading
+
+Queries beginning with a parenthesized query block were previously never given
+a `MAX_EXECUTION_TIME` hint, so they ran unbounded on the server even with an
+active cutoff. They are now capped, which means a query that used to slowly
+succeed may instead raise `Mysql2::Error`. That is the intended behavior of the
+patch, but it can surface as new errors on upgrade. If you have queries in this
+shape, check that their callers handle the error, or give them a longer cutoff.
+
+Statements beginning with `WITH` (common table expressions) are still not
+given a hint.
+
 ## [1.1.0] - 2026-05-12
 
 ### Fixed
@@ -107,7 +136,8 @@ to `Timeout::Error`. `CutoffError` changes from a class to a module.
 - Cutoff class
 - Mysql2 patch
 
-[Unreleased]: https://github.com/justinhoward/cutoff/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/justinhoward/cutoff/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/justinhoward/cutoff/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/justinhoward/cutoff/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/justinhoward/cutoff/compare/v0.5.2...v1.0.0
 [0.5.2]: https://github.com/justinhoward/cutoff/compare/v0.5.1...v0.5.2

data/lib/cutoff/patch/mysql2.rb

@@ -69,6 +69,8 @@ class Cutoff
             hint_comment
           elsif token.start_with?('/*')
             block_comment
+          elsif !@found_select && token.start_with?('(')
+            open_paren
           elsif token.match?(/^select/i)
             select
           else
@@ -133,6 +135,21 @@ class Cutoff
           @scanner.terminate
         end
 
+        def open_paren
+          # A statement can begin with a parenthesized query block, as in
+          # `(SELECT ...) UNION (SELECT ...)`. MySQL accepts an optimizer hint
+          # at the start of the first block and applies MAX_EXECUTION_TIME to
+          # the whole statement, so consume the parentheses and keep looking
+          # for the select.
+          #
+          # Go back to the beginning of the token and skip only the parens
+          # (and any whitespace after them) so the rest of the token is
+          # re-examined as its own token. This always advances the scanner by
+          # at least one character, so the token loop can't spin.
+          @scanner.unscan
+          @scanner.skip(/\(+\s*/)
+        end
+
         def select
           # If we encounter a select, we're ready to place our hint comment
           @scanner.unscan
@@ -140,7 +157,7 @@ class Cutoff
 
           # Make sure our word is actually select
           # We only checked that it starts with select before
-          return other unless word.casecmp('select')
+          return other unless word.casecmp?('select')
 
           @found_select = true
           @hint_pos = @scanner.pos

data/lib/cutoff/version.rb

@@ -3,6 +3,6 @@
 class Cutoff
   # @return [Gem::Version] The current version of the cutoff gem
   def self.version
-    Gem::Version.new('1.1.0')
+    Gem::Version.new('1.2.0')
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cutoff
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Justin Howard
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-12 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -84,7 +84,7 @@ licenses:
 - MIT
 metadata:
   changelog_uri: https://github.com/justinhoward/cutoff/blob/master/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/cutoff/1.1.0
+  documentation_uri: https://www.rubydoc.info/gems/cutoff/1.2.0
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []