graphiti 2.0.0.beta.9 → 2.0.0.beta.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a61d00c6968d2dc24afb8986d7b3b6051394ea73ac5d5a8104f1296f650fef47
-  data.tar.gz: bf367c2e3ff33e4240a3f11e3fbae780c75b7f727863e61fc0c546ae9cdfb5fe
+  metadata.gz: a639e421891e5d5e650d2d8131a75905cb9ffd0fb40cdfd15239ca5caf29d12f
+  data.tar.gz: 95172bbff224d598c959d5acc93c30861e01c50540fdea871ea5029473bf5259
 SHA512:
-  metadata.gz: 4bb22545b0a2b590fb07a237857407a5a50ac2423dd33a5621af164d93b4d36237f54339fb083895e6d349ae64da3cf9cc2e24c363f63478cea691622f130331
-  data.tar.gz: 9da999b97fa15b04ca97420d6a6942c5d32b70bd0e8f27e33e01b8861cdd0206342d6afd11db15eb0c1d445beda4ce1f6a5ff5cceffcb54d5917e3a185cdc16a
+  metadata.gz: 24c275cfcaecdba9ced126b7970b37962998673a3a8609c885a69befc53adba646ec2c7d9517198509e358ebba5300f3b336c86f02df98af9d18a6f4a4c306c3
+  data.tar.gz: e7d2fd4e0d0ff74b68ea4d3673399d1b72897ad7c8647fa38835ff2b58c850d58ba95a1145a52f55893e88e36eb0aa90bece72a2e6e593173661d16100666edc

data/.github/workflows/release.yml

@@ -13,6 +13,8 @@ jobs:
         uses: actions/checkout@v5
         with:
           persist-credentials: false
+          # semantic-release reads the tag history to work out the next version
+          fetch-depth: 0
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

data/.tool-versions

@@ -1 +1 @@
-ruby 3.3.4
+ruby 4.0.6

data/CHANGELOG.md

@@ -1,5 +1,51 @@
 graphiti changelog
 
+# [2.0.0-beta.11](https://github.com/graphiti-api/graphiti/compare/v2.0.0-beta.10...v2.0.0-beta.11) (2026-08-27)
+
+
+### Bug Fixes
+
+* always render included when the client asked to include ([8691b3f](https://github.com/graphiti-api/graphiti/commit/8691b3fd08f3cae0481ba72839911fdc71ef5634))
+* autolink = true no longer clobbers an inherited :on_demand ([2d26f8c](https://github.com/graphiti-api/graphiti/commit/2d26f8cb567e82a16918345de9114b8ceef64523))
+* read the links param from the query, not the context object ([3b934cb](https://github.com/graphiti-api/graphiti/commit/3b934cb25be049e1e80ba400123da944cfd23d04))
+* stop assigning the same child twice when a resource repeats in the include path ([588503b](https://github.com/graphiti-api/graphiti/commit/588503b109508495d8170373d80019c6971f7d9c))
+
+
+### Features
+
+* omit relationships that render no ids and no link ([916aa8c](https://github.com/graphiti-api/graphiti/commit/916aa8c9c596c5d9b6c802c5ab13b766a13d1e70))
+
+
+### Performance Improvements
+
+* memoize whether a belongs_to renders ids from its foreign key ([dcb60b2](https://github.com/graphiti-api/graphiti/commit/dcb60b2096c414756ccff534773d2e45594f0144))
+* only deduplicate resources that two include paths can both reach ([744f014](https://github.com/graphiti-api/graphiti/commit/744f014249382bc25d5ea43f692778ad7adc25c3))
+* resolve a lone sideload inline rather than through the pool ([3415592](https://github.com/graphiti-api/graphiti/commit/3415592d75900389a8f11f53b65ab399e297e4a9))
+* reuse the resolved data and proxies when building cache keys ([8a17350](https://github.com/graphiti-api/graphiti/commit/8a17350542ba0062fdcddd115afe8041b62198c7))
+* skip the on-demand link strip when no relationship renders links on demand ([cf86a8c](https://github.com/graphiti-api/graphiti/commit/cf86a8c249077d9f9d5a13de49989d102bbaed04))
+
+# [2.0.0-beta.10](https://github.com/graphiti-api/graphiti/compare/v2.0.0-beta.9...v2.0.0-beta.10) (2026-08-24)
+
+
+### Bug Fixes
+
+* apply sideloads at definition once setup! has run ([39ef393](https://github.com/graphiti-api/graphiti/commit/39ef39383520816319282854c0ae99677bcd5127)), closes [#524](https://github.com/graphiti-api/graphiti/issues/524)
+* give client-caused errors real detail and stop 500ing on bad query params ([35acc3e](https://github.com/graphiti-api/graphiti/commit/35acc3e6c78f68eeeb05728ea16264b136455c30)), closes [#531](https://github.com/graphiti-api/graphiti/issues/531)
+* let an abstract resource declare relationships ([6036392](https://github.com/graphiti-api/graphiti/commit/6036392ebd611c7ed492beb3fe5754433eac9ffd)), closes [#453](https://github.com/graphiti-api/graphiti/issues/453)
+* reject a non-object data payload instead of raising TypeError ([51603b8](https://github.com/graphiti-api/graphiti/commit/51603b854270715b80a75d9aa05a4020e6bbdce5))
+* Update some missing sections and terms after renames, register unsupported pagination error ([39cff19](https://github.com/graphiti-api/graphiti/commit/39cff19f6f1f73126514c8b18234a18ad5eb7379))
+
+
+### Features
+
+* carry CurrentAttributes into concurrent sideloads ([7092096](https://github.com/graphiti-api/graphiti/commit/7092096f6d99ad277cc56817c616d946f655d55b))
+* fold allow_nil and deny_empty into one blanks: filter option ([a108403](https://github.com/graphiti-api/graphiti/commit/a108403e5cd87fd2fdf177da30c4c4f97b9fe750))
+* move link rendering onto the resource as page_links and relationship_links ([57878d1](https://github.com/graphiti-api/graphiti/commit/57878d14fdfc4741e8d418c8edbc4a8687335843))
+* move typecast_reads onto the resource and let the railtie own Rails config ([236e970](https://github.com/graphiti-api/graphiti/commit/236e9706d7d8f08e9640c5c22ac596e2f7466849))
+* one link mode per relationship, cascading from relationship_links ([f0e1da1](https://github.com/graphiti-api/graphiti/commit/f0e1da1e13a8d12b47458495b378779f5687ffe2))
+* point connection pool timeouts at the sizing formula and add an audit task to check ([6e017c6](https://github.com/graphiti-api/graphiti/commit/6e017c60fd45338e4e6c8527adebfd46be4bfd8d))
+* split validate_endpoints into validate_requests and validate_links ([100a370](https://github.com/graphiti-api/graphiti/commit/100a370deec6a0e6ae165bdf77e50b6b14d068d3))
+
 # [2.0.0-beta.9](https://github.com/graphiti-api/graphiti/compare/v2.0.0-beta.8...v2.0.0-beta.9) (2026-08-22)
 
 

data/Rakefile

@@ -11,31 +11,36 @@ RSpec::Core::RakeTask.new(:spec) do |t|
   end
 end
 
+# Allocations mean the same anywhere and timings do not, so the history has a
+# reference CPU, named on every row, and recording timings refuses to mix them.
 namespace :performance do
   # Shelling out keeps a failure to the script's own message, with no rake backtrace on top.
   def measure(*arguments)
     exit(1) unless system("bundle", "exec", "ruby", "spec/performance/measure_releases.rb", *arguments)
   end
 
-  desc "Compare the working tree to the last release, and plot it"
-  task :current do
-    measure
+  desc "Read a change: measure the working tree, print the comparison and plot it"
+  task :read do
+    measure("--read")
   end
 
-  desc "Plot the release history plus the working tree to tmp/performance.html and open it"
-  task :page do
-    exit(1) unless system("bundle", "exec", "ruby", "spec/performance/chart_page.rb")
+  desc "Open the recorded history as a chart. Any machine, measures nothing"
+  task :chart do
+    exit(1) unless system("bundle", "exec", "ruby", "spec/performance/chart_page.rb", "--no-current")
   end
 
-  desc "Measure one release and record it (TAG=v2.0.0-beta.9)"
+  desc "Fill in the history. Missing releases by default, TAG=v2.0.0-beta.9 for one, ALL=1 for every. Reference CPU"
   task :record do
-    tag = ENV["TAG"] or abort "pass the release to record, e.g. rake performance:record TAG=v2.0.0-beta.9"
-    measure(tag)
+    measure(*(if ENV["TAG"]
+                [ENV["TAG"]]
+              else
+                ENV["ALL"] ? ["--all"] : ["--missing"]
+              end))
   end
 
-  desc "Re-record every release for this ruby, replacing its rows"
-  task :record_all do
-    measure("--all")
+  desc "Measure the working tree for the release to name, and commit it. Reference CPU"
+  task :pending do
+    measure("--pending")
   end
 end
 

data/lib/generators/graphiti/generator_mixin.rb

@@ -33,6 +33,30 @@ module Graphiti
       methods.any? { |m| actions.include?(m) }
     end
 
+    def resource_setting_groups
+      name_width = Graphiti::Resource::SETTINGS.keys.map(&:length).max
+      assignments = Graphiti::Resource::SETTINGS.to_h do |name, setting|
+        value = setting[:format] || setting[:default].inspect
+        [name, "self.#{name.to_s.ljust(name_width)} = #{value}"]
+      end
+      hint_column = assignments.values.map(&:length).max + 2
+
+      Graphiti::Resource::SETTING_GROUPS.transform_values do |settings|
+        settings.map do |name, setting|
+          hint = resource_setting_hint(setting)
+          hint ? "#{assignments[name].ljust(hint_column)}# #{hint}" : assignments[name]
+        end
+      end
+    end
+
+    def resource_setting_hint(setting)
+      return setting[:note] if setting[:note]
+      return unless setting[:values]
+
+      setting[:values].map(&:inspect)
+        .to_sentence(two_words_connector: " or ", last_word_connector: ", or ")
+    end
+
     def graphiti_config
       File.exist?(".graphiticfg.yml") ? YAML.load_file(".graphiticfg.yml") : {}
     end

data/lib/generators/graphiti/templates/application_resource.rb.erb

@@ -14,21 +14,14 @@ class ApplicationResource < Graphiti::Resource
   self.endpoint_namespace = '<%= api_namespace %>'
   <%- unless omit_comments? -%>
 
-  # Defaults every Resource inherits. These are already the values shown;
-  # uncomment to change them API-wide, or set them on individual Resources.
-  # See https://graphiti.dev/concepts/resources
-  #
-  # self.attributes_readable_by_default     = true
-  # self.attributes_writable_by_default     = true
-  # self.attributes_sortable_by_default     = true
-  # self.attributes_filterable_by_default   = true
-  # self.attributes_schema_by_default       = true
-  # self.relationships_readable_by_default  = true
-  # self.relationships_writable_by_default  = true
-  # self.belongs_to_resource_ids_by_default = :foreign_key
-  # self.filters_accept_nil_by_default      = false
-  # self.filters_deny_empty_by_default      = false
-  # self.default_page_size                  = 20
-  # self.max_page_size                      = 1_000
+  # Defaults every Resource inherits. Uncomment to change them API-wide, or set
+  # them on individual Resources. See https://graphiti.dev/concepts/resources
+  <%- resource_setting_groups.each_pair do |group, lines| -%>
+
+  # <%= group.to_s.humanize %>
+    <%- lines.each do |line| -%>
+  # <%= line %>
+    <%- end -%>
+  <%- end -%>
   <%- end -%>
 end

data/lib/graphiti/adapters/abstract.rb

@@ -371,10 +371,11 @@ module Graphiti
           activerecord_adapter.associate \
             parent, child, association_name, association_type
         elsif [:has_many, :many_to_many].include?(association_type)
-          if parent.send(:"#{association_name}").nil?
+          associated = parent.send(:"#{association_name}")
+          if associated.nil?
             parent.send(:"#{association_name}=", [child])
-          else
-            parent.send(:"#{association_name}") << child
+          elsif associated.none? { |existing| existing.equal?(child) }
+            associated << child
           end
         else
           parent.send(:"#{association_name}=", child)

data/lib/graphiti/configuration.rb

@@ -24,10 +24,6 @@ module Graphiti
 
     attr_accessor :respond_to
     attr_accessor :context_for_endpoint
-    attr_accessor :links_on_demand
-    attr_accessor :pagination_links_on_demand
-    attr_accessor :pagination_links
-    attr_accessor :typecast_reads
     attr_accessor :raise_on_missing_sidepost
     attr_accessor :before_sideload
 
@@ -44,32 +40,12 @@ module Graphiti
       @concurrency = false
       @concurrency_max_threads = 4
       @respond_to = [:json, :jsonapi, :xml]
-      @links_on_demand = false
-      @pagination_links_on_demand = false
-      @pagination_links = false
-      @typecast_reads = true
       @raise_on_missing_sidepost = true
       @cache_rendering = false
       self.debug = ENV.fetch("GRAPHITI_DEBUG", true)
       self.debug_models = ENV.fetch("GRAPHITI_DEBUG_MODELS", false)
 
       @uri_decoder = infer_uri_decoder
-
-      # FIXME: Don't duplicate the Railtie's initializer
-      if defined?(::Rails.root) && (root = ::Rails.root)
-        config_file = root.join(".graphiticfg.yml")
-        if config_file.exist?
-          cfg = YAML.load_file(config_file)
-          @schema_path = root.join("public#{cfg["namespace"]}/schema.json")
-        else
-          @schema_path = root.join("public/schema.json")
-        end
-
-        if (logger = ::Rails.logger)
-          self.debug = logger.debug? && debug
-          Graphiti.logger = logger
-        end
-      end
     end
 
     def cache_rendering?
@@ -111,6 +87,48 @@ module Graphiti
       send(:"#{key}=", original)
     end
 
+    def typecast_reads
+      Resource.typecast_reads
+    end
+
+    def typecast_reads=(val)
+      Resource.typecast_reads = val
+    end
+
+    def links_on_demand
+      Resource.relationship_links == :on_demand
+    end
+
+    def links_on_demand=(val)
+      if val
+        Resource.relationship_links = :on_demand
+      elsif Resource.relationship_links == :on_demand
+        Resource.relationship_links = true
+      end
+    end
+
+    def pagination_links
+      Resource.page_links == true
+    end
+
+    def pagination_links=(val)
+      return if Resource.page_links == :on_demand
+
+      Resource.page_links = !!val
+    end
+
+    def pagination_links_on_demand
+      Resource.page_links == :on_demand
+    end
+
+    def pagination_links_on_demand=(val)
+      if val
+        Resource.page_links = :on_demand
+      elsif Resource.page_links == :on_demand
+        Resource.page_links = false
+      end
+    end
+
     def uri_decoder=(decoder)
       unless decoder.respond_to?(:call)
         raise "uri_decoder must respond to `call`."
@@ -141,4 +159,17 @@ module Graphiti
 
   msg = "Use `config.graphiti.respond_to_formats`"
   DEPRECATOR.deprecate_methods(Configuration, respond_to: msg, "respond_to=": msg)
+
+  relationship_msg = "Set `self.relationship_links` (true, false, or :on_demand) on your resource"
+  pagination_msg = "Set `self.page_links` (true, false, or :on_demand) on your resource"
+  typecast_msg = "Set `self.typecast_reads` on your resource"
+  DEPRECATOR.deprecate_methods(Configuration,
+    typecast_reads: typecast_msg,
+    "typecast_reads=": typecast_msg,
+    links_on_demand: relationship_msg,
+    "links_on_demand=": relationship_msg,
+    pagination_links: pagination_msg,
+    "pagination_links=": pagination_msg,
+    pagination_links_on_demand: pagination_msg,
+    "pagination_links_on_demand=": pagination_msg)
 end

data/lib/graphiti/delegates/pagination.rb

@@ -6,7 +6,7 @@ module Graphiti
       end
 
       def links?
-        @proxy.query.pagination_links? && @proxy.data.present?
+        @proxy.query.page_links? && @proxy.data.present?
       end
 
       def links
@@ -104,7 +104,7 @@ module Graphiti
 
       def page_size
         @page_size ||= (page_param[:size] ||
-                        @proxy.resource.default_page_size ||
+                        @proxy.resource.page_default_size ||
                         Graphiti::Scoping::Paginate::DEFAULT_PAGE_SIZE).to_i
       end
 

data/lib/graphiti/errors.rb

@@ -221,7 +221,7 @@ module Graphiti
 
           Make sure the endpoint "#{@sideload.resource.endpoint[:full_path]}" exists with action #{@action.inspect}, or customize the endpoint for #{@sideload.resource.class.name}.
 
-          If you do not wish to generate a link, pass link: false or set self.autolink = false.
+          If you do not wish to generate a link, pass link: false or set self.relationship_links = false. To keep the link and stop checking it, set self.validate_links = false.
         MSG
       end
     end
@@ -255,6 +255,8 @@ module Graphiti
           Graphiti.config.context_for_endpoint must be set to enable link generation:
 
           Graphiti.config.context_for_endpoint = ->(path, action) { ... }
+
+          Or set self.validate_links = false to render links without checking them.
         MSG
       end
     end
@@ -445,9 +447,9 @@ module Graphiti
 
           secondary_endpoint '/my_url', [:index, :update]
 
-          Or disable endpoint validation for this resource:
+          Or disable request validation for this resource:
 
-          self.validate_endpoints = false
+          self.validate_requests = false
 
           See https://graphiti.dev/concepts/links for more information.
 
@@ -708,6 +710,36 @@ module Graphiti
       end
     end
 
+    class InvalidFilterBlanks < Base
+      def initialize(resource_class, attribute, value)
+        @resource_class = resource_class
+        @attribute = attribute
+        @value = value
+      end
+
+      def message
+        <<~MSG
+          #{@resource_class.name}: #{@attribute} must be one of :literal, :null, or :rejected. Got #{@value.inspect}.
+
+            :literal  - "null" and "" reach the filter as strings (default)
+            :null     - "null" becomes nil, so the filter can query for NULL
+            :rejected - a blank value raises InvalidFilterValue
+        MSG
+      end
+    end
+
+    class InvalidLinkRendering < Base
+      def initialize(resource_class, attribute, value)
+        @resource_class = resource_class
+        @attribute = attribute
+        @value = value
+      end
+
+      def message
+        "#{@resource_class.name}: #{@attribute} must be true, false, or :on_demand. Got #{@value.inspect}."
+      end
+    end
+
     class UnselectedForeignKey < Base
       def initialize(resource_class, sideload, model)
         @resource_class = resource_class

data/lib/graphiti/query.rb

@@ -2,6 +2,9 @@ require "digest"
 
 module Graphiti
   class Query
+    TRUTHY_LINKS = [true, "true"].freeze
+    LINKLESS_FORMATS = [:json, :xml, "json", "xml"].freeze
+
     attr_reader :resource, :association_name, :params, :action
 
     def initialize(resource, params, *positional, association_name: nil, nested_include: nil, parents: [], action: nil)
@@ -36,29 +39,70 @@ module Graphiti
       @entity_map
     end
 
+    # Deduplication exists for a row two include paths both resolve, so a
+    # resource class sitting at one node has nothing to collide with.
+    def repeated_resource_classes
+      return root.repeated_resource_classes unless root == self
+
+      @repeated_resource_classes ||= begin
+        counts = Hash.new(0)
+        walk = [self]
+        while (query = walk.pop)
+          counts[query.resource.class] += 1
+          query.sideloads.each_pair do |name, sideload_query|
+            walk << sideload_query
+            sideload = query.resource.class.sideload(name)
+            next unless sideload.respond_to?(:children)
+
+            # A polymorphic child resolves under a class no node names.
+            sideload.children.each_value { |child| counts[child.resource.class] += 2 }
+          end
+        end
+        counts.select { |_, count| count > 1 }.keys.to_set
+      end
+    end
+
     def top_level?
       !association?
     end
 
-    def links?
-      return false if [:json, :xml, "json", "xml"].include?(params[:format])
-      if Graphiti.config.links_on_demand
-        [true, "true"].include?(@params[:links])
-      else
-        true
-      end
+    def includes_requested?
+      @include_param.present?
+    end
+
+    def links_requested?
+      return @links_requested if defined?(@links_requested)
+
+      @links_requested = TRUTHY_LINKS.include?(@params[:links])
+    end
+
+    def suppress_links?
+      return @suppress_links if defined?(@suppress_links)
+
+      @suppress_links = LINKLESS_FORMATS.include?(params[:format])
     end
 
-    def pagination_links?
+    def render_link?(mode)
+      return false if suppress_links?
+
+      (mode == :on_demand) ? links_requested? : mode == true
+    end
+
+    def page_links?
       if action == :find
         false
-      elsif Graphiti.config.pagination_links_on_demand
-        [true, "true"].include?(@params[:pagination_links])
+      elsif @resource.page_links == :on_demand
+        page_links_requested?
       else
-        Graphiti.config.pagination_links
+        @resource.page_links
       end
     end
 
+    def page_links_requested?
+      [@params[:page_links], @params[:pagination_links]]
+        .any? { |value| [true, "true"].include?(value) }
+    end
+
     def debug_requested?
       !!@params[:debug]
     end
@@ -267,8 +311,8 @@ module Graphiti
     def query_cache_key
       attrs = {extra_fields: extra_fields,
                fields: fields,
-               links: links?,
-               pagination_links: pagination_links?,
+               links: suppress_links? ? :none : links_requested?,
+               page_links: page_links?,
                format: params[:format]}
 
       Digest::SHA1.hexdigest(attrs.to_s)
@@ -387,5 +431,9 @@ module Graphiti
         action
       end
     end
+
+    alias_method :pagination_links?, :page_links?
+    DEPRECATOR.deprecate_methods(self,
+      pagination_links?: "Use `page_links?`")
   end
 end

data/lib/graphiti/rails/controller.rb

@@ -30,14 +30,34 @@ module Graphiti
 
         register_exception Graphiti::Errors::InvalidRequest,
           status: 400, handler: Graphiti::Rails::InvalidRequestHandler
-        register_exception Graphiti::Errors::ConflictRequest,
-          status: 409, handler: Graphiti::Rails::ConflictRequestHandler
-        register_exception Graphiti::Errors::RecordNotFound,
-          status: 404, handler: Graphiti::Rails::ExceptionHandler
         register_exception Graphiti::Errors::RemoteWrite,
-          status: 400, handler: Graphiti::Rails::ExceptionHandler
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
         register_exception Graphiti::Errors::SingularSideload,
-          status: 400, handler: Graphiti::Rails::ExceptionHandler
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::InvalidInclude,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::UnsupportedSort,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::UnsupportedOperator,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::InvalidFilterValue,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::RequiredFilter,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::UnsupportedPageSize,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::UnsupportedBeforeCursor,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::UnsupportedPagination,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+        register_exception Graphiti::Errors::FilterGroupMissingRequiredFilters,
+          status: 400, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+
+        register_exception Graphiti::Errors::RecordNotFound,
+          status: 404, detail: :exception, handler: Graphiti::Rails::ExceptionHandler
+
+        register_exception Graphiti::Errors::ConflictRequest,
+          status: 409, handler: Graphiti::Rails::ConflictRequestHandler
       end
     end
   end

data/lib/graphiti/rails/rake_helpers.rb

@@ -21,6 +21,23 @@ module Graphiti
         ::Rails.application.config.action_controller.perform_caching = false
       end
 
+      # The pool and RAILS_MAX_THREADS are read from this environment, and production may size both differently.
+      def connection_pool_advisory
+        return unless defined?(ActiveRecord::Base)
+
+        pool = ActiveRecord::Base.connection_db_config.pool
+        threads = ENV.fetch("RAILS_MAX_THREADS", 5).to_i
+        sideload_threads = Graphiti.config.concurrency_max_threads
+        needed = threads + sideload_threads + 1
+        return if pool.nil? || pool >= needed
+
+        "WARNING database.yml pool is #{pool} in this environment. With concurrency on (the production default), " \
+          "each sideload holds its own connection, so pool should be at least " \
+          "web threads (#{threads}) + concurrency_max_threads (#{sideload_threads}) + 1 = #{needed}. " \
+          "If production sizes these differently, check the numbers there. " \
+          "See graphiti.dev/concepts/resources#concurrency-pool-sizing."
+      end
+
       def make_request(path, debug = false)
         if path.split("/").length == 2
           path = "#{ApplicationResource.endpoint_namespace}#{path}"

data/lib/graphiti/renderer.rb

@@ -13,8 +13,11 @@ module Graphiti
       @records ||= @proxy.data
     end
 
+    # JSON:API requires the key even when the include turns up nothing.
     def to_jsonapi
-      render(self.class.jsonapi_renderer).to_json
+      rendered = render(self.class.jsonapi_renderer)
+      rendered[:included] ||= [] if proxy.query.includes_requested?
+      rendered.to_json
     end
 
     def as_graphql

data/lib/graphiti/request_validators/update_validator.rb

@@ -2,7 +2,7 @@ module Graphiti
   module RequestValidators
     class UpdateValidator < Validator
       def validate
-        if required_payload? && payload_matches_endpoint?
+        if validate_data_shape && required_payload? && payload_matches_endpoint?
           super
         else
           false

data/lib/graphiti/request_validators/validator.rb

@@ -17,6 +17,7 @@ module Graphiti
         # In the future these should have their own validation logic, but
         # for now we can just bypass
         return errors.blank? unless @params.has_key?(:data)
+        return false unless validate_data_shape
 
         resource = @root_resource
         if @params[:data].has_key?(:type)
@@ -56,6 +57,14 @@ module Graphiti
         @errors.add(:page, :invalid, message: "must be an object")
       end
 
+      def validate_data_shape
+        data = @params[:data]
+        return true if data.nil? || data.respond_to?(:each_pair)
+
+        @errors.add(:data, :invalid, message: "must be an object")
+        false
+      end
+
       def process_relationships(resource, relationships, payload_path)
         relationships.each_key do |name|
           unless resource.class.sideload(name.to_sym)