jpie 3.10.1.pre.202609020314 → 3.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77c269f352f52e8757d0dcad28af7987bd83e151607b4d2e3a1f4c8091181078
-  data.tar.gz: aefd634c9df9be3090b5d256946aad77bb5fd5cd7d9a482a5c99c517c1a6a670
+  metadata.gz: aee1da20dd3c81baafa8bcb78801d128f2b59f76be85b12216f96bf35b822344
+  data.tar.gz: 7de107c0fd9ea459ad0f7015d7b0a6877e88462f81b9900cdf022d14788a8118
 SHA512:
-  metadata.gz: c1f18a739c4d517b537eb95ff2b4889cc2ca3879fa2f720719feb0ef25d97850c5c54555465048dd786e2082b0b8cc75de8393d1f0028774f90a8ba83f0bad14
-  data.tar.gz: 541c1b7783c40d3759dd053c00a31e547ab383a8ba961516880948a57667dd7eafabf54057532e44234c77e4986917c88e68741a65167f6abc9f6361981c95a1
+  metadata.gz: 6639e6a66ac7c37cbf50372b433f9b1be772d6e1bda28cd76edbfb4a15612c6307bb9412894e0c6eede135aa6e0de321c2726cf3eda493381f746153ff6dd4fc
+  data.tar.gz: 1998a903147f3737344b172459656dbb2638525d0371aac16c6951a8c519334ee4ddae641a7a260d200cd41d1c4ea480202bfd476bb930a1f55a8165d1ce4a07

data/CHANGELOG.md

@@ -7,6 +7,17 @@ at release time.
 
 ## [Unreleased]
 
+## [3.10.1]
+
+### Fixed
+
+- Resolve the relationships controller under any module scope. A
+  `"controller#action"` string took the surrounding module scope, so every
+  relationship route inside a `namespace` or a `scope module:` raised
+  `MissingController`.
+- Reject a `page[number]` or `page[size]` above 2147483647. A wider value
+  overflowed a 64-bit `OFFSET` and answered 500; it now answers 400.
+
 ### Added
 
 - Open-source documents: `LICENSE`, `NOTICE`, `CONTRIBUTING.md`,
@@ -28,5 +39,6 @@ at release time.
 Releases before 3.10.0 predate this file. Read their history in the git tags
 and in the [GitHub releases](https://github.com/klaayinc/json_api/releases).
 
-[Unreleased]: https://github.com/klaayinc/json_api/compare/v3.10.0...HEAD
+[Unreleased]: https://github.com/klaayinc/json_api/compare/v3.10.1...HEAD
+[3.10.1]: https://github.com/klaayinc/json_api/compare/v3.10.0...v3.10.1
 [3.10.0]: https://github.com/klaayinc/json_api/compare/v3.9.0...v3.10.0

data/lib/json_api/controllers/concerns/controller_helpers/parsing.rb

@@ -5,6 +5,10 @@ module JSONAPI
     module Parsing
       extend ActiveSupport::Concern
 
+      # The widest page[number] or page[size] a client may send. A signed 32-bit maximum keeps
+      # page[number] * max_page_size inside a 64-bit OFFSET for any page size a server sets.
+      PAGE_VALUE_MAX = (2**31) - 1
+
       included do
         before_action :parse_jsonapi_body, if: -> { modifying_request? }
       end
@@ -116,12 +120,14 @@ module JSONAPI
 
       # page[number]/page[size] are coerced with to_i and used as a divisor and as
       # LIMIT/OFFSET. A non-positive or non-numeric value (0, -5, "abc") produces a
-      # divide-by-zero (FloatDomainError) or a negative LIMIT/OFFSET. Reject it as a
-      # bad request instead of letting the raise escape as a 500.
+      # divide-by-zero (FloatDomainError) or a negative LIMIT/OFFSET, and a value above
+      # PAGE_VALUE_MAX overflows a 64-bit OFFSET once page[number] is multiplied by the page
+      # size. Reject all of them as a bad request instead of letting the raise escape as a 500.
       def require_positive_integer(value, name)
-        return if value.to_s.match?(/\A\d+\z/) && value.to_i.positive?
+        return if value.to_s.match?(/\A\d+\z/) && value.to_i.between?(1, PAGE_VALUE_MAX)
 
-        raise JSONAPI::Errors::ParameterNotAllowed, ["#{name} must be a positive integer"]
+        raise JSONAPI::Errors::ParameterNotAllowed,
+              ["#{name} must be a positive integer no greater than #{PAGE_VALUE_MAX}"]
       end
 
       def render_sort_errors(invalid)

data/lib/json_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module JSONAPI
-  VERSION = "3.10.1.pre.202609020314"
+  VERSION = "3.10.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jpie
 version: !ruby/object:Gem::Version
-  version: 3.10.1.pre.202609020314
+  version: 3.10.1
 platform: ruby
 authors:
 - Emil Kampp