mongoid 9.0.9 → 9.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5dca0df68ed7086b6c641b1021e556812e23872d5bd52a9777093e2d8cf1e64
-  data.tar.gz: 24630d19104369a922b3a5a152012ae8eba3719576ef3c9e5f97304b6896a1c4
+  metadata.gz: b6976a4808058209fda8554306590eeb5fd44759d8c228d02bca544acbe5c200
+  data.tar.gz: e0dcd20719682c2a425d9ed17c1459376b6956311f9ec439c74843a4cefb8502
 SHA512:
-  metadata.gz: 03013a0c28cda90cfc3b99c26d22e7672e8ce1c6449e599d7ae39a42d19ba742f37dea7510411ca004c7d5d5f25af80e9230bac63fef8ce43515711d7f669343
-  data.tar.gz: 8bd5b0c4faa4f5f16fcc56ff612bae5a14fd40fa01513fda545469d225c6cd4909022c066719950147dc116dc1a7bdb79b69d48ad40454aabdb45481994dd69b
+  metadata.gz: 64ee6ee13a326ed9fae0e6b6dc08fa28ba0608a75342993b873023e4f87076160f6a8997e3edd53a273da4716c92d5aabc6b49f0931a489d2074d92f8de912d7
+  data.tar.gz: 491ecfb05581a08609bc41aedd39600f143a15f681405400c813402be95e11ed24d4be7363ac8079da9bc022d7d5b22ad3c53e534d41ee66a10977751a44b954

data/README.md

@@ -21,9 +21,9 @@ Compatibility
 
 Mongoid supports and is tested against:
 
-- MRI 2.7 - 3.2
-- JRuby 9.4
-- MongoDB server 3.6 - 7.0
+- MRI 2.7 - 4.0
+- JRuby 9.4 and 10.0
+- MongoDB server 3.6 - 8.2
 
 Issues
 ------

data/Rakefile

@@ -68,6 +68,37 @@ RSpec::Core::RakeTask.new('spec:progress') do |spec|
   spec.pattern = "spec/**/*_spec.rb"
 end
 
+RUBOCOPABLE = %w[ examples gemfiles perf lib spec mongoid.gemspec Gemfile Rakefile upload-api-docs ].freeze
+
+desc 'Run rubocop'
+task rubocop: %w[ rubocop:run ]
+
+namespace :rubocop do
+  desc 'Run rubocop on the codebase'
+  task :run do
+    Bundler.with_unbundled_env do
+      sh 'bundle', 'exec', 'rubocop', *RUBOCOPABLE, verbose: false
+    end
+  end
+
+  desc 'Add a git pre-commit hook that runs rubocop'
+  task :install_hook do
+    hook_path = File.join('.git', 'hooks', 'pre-commit')
+    hook_script = <<~HOOK
+      #!/usr/bin/env bash
+      set -e
+
+      echo "Running rubocop..."
+      rake rubocop
+    HOOK
+
+    File.write(hook_path, hook_script)
+    FileUtils.chmod('+x', hook_path)
+
+    puts "Git pre-commit hook installed at #{hook_path}."
+  end
+end
+
 desc 'Build and validate the evergreen config'
 task eg: %w[ eg:build eg:validate ]
 

data/lib/mongoid/association/nested/many.rb

@@ -184,11 +184,17 @@ module Mongoid
             else
               update_document(doc, attrs)
             end
-          else
+          elsif association.embedded?
+            raise Errors::DocumentNotFound.new(association.klass, id)
+          elsif association.is_a?(Association::Referenced::HasAndBelongsToMany) || Mongoid.allow_reparenting_via_nested_attributes?
+            Mongoid::Warnings.warn_reparenting_via_nested_attributes if Mongoid.allow_reparenting_via_nested_attributes?
+
             # push existing document to association
             doc = association.klass.unscoped.find(converted)
             update_document(doc, attrs)
             existing.push(doc) unless destroyable?(attrs)
+          else
+            raise Errors::DocumentNotFound.new(association.klass, { _id: id, association.foreign_key => parent.id })
           end
 
           parent.children_may_have_changed!

data/lib/mongoid/association/referenced/auto_save.rb

@@ -32,13 +32,24 @@ module Mongoid
           Threaded.exit_autosave(self)
         end
 
-        # Check if there is changes for auto-saving
+        # Check if there are changes for auto-saving. Returns true if the
+        # document is new, changed, or marked for destruction, or if any
+        # in-memory referenced child with autosave: true recursively
+        # satisfies the same condition.
         #
-        # @example Return true if there is changes on self or in
-        #           autosaved associations.
-        #   document.changed_for_autosave?
-        def changed_for_autosave?(doc)
-          doc.new_record? || doc.changed? || doc.marked_for_destruction?
+        # The seen set prevents infinite recursion when autosave associations
+        # form a cycle (e.g. a belongs_to with autosave: true whose target
+        # has a has_many with autosave: true pointing back).
+        #
+        # @param [ Document ] doc The document to check.
+        # @param [ Set ] seen Documents already visited (cycle guard).
+        #
+        # @return [ true | false ] Whether the document needs autosaving.
+        def changed_for_autosave?(doc, seen = Set.new)
+          return false unless seen.add?(doc)
+
+          doc.new_record? || doc.changed? || doc.marked_for_destruction? ||
+            autosave_children_changed?(doc, seen)
         end
 
         # Define the autosave method on an association's owning class for
@@ -60,6 +71,8 @@ module Mongoid
                 __autosaving__ do
                   if assoc_value = ivar(association.name)
                     Array(assoc_value).each do |doc|
+                      next unless changed_for_autosave?(doc)
+
                       pc = doc.persistence_context? ? doc.persistence_context : persistence_context.for_child(doc)
                       doc.with(pc) do |d|
                         d.save
@@ -72,6 +85,35 @@ module Mongoid
             klass.after_persist_parent save_method, unless: :autosaved?
           end
         end
+
+        private
+
+        # Returns true if any in-memory referenced child with autosave: true
+        # needs saving.
+        #
+        # @param [ Document ] doc The document whose children to check.
+        # @param [ Set ] seen Cycle guard passed through from changed_for_autosave?.
+        #
+        # @return [ true | false ]
+        def autosave_children_changed?(doc, seen)
+          if Mongoid.autosave_saves_unchanged_documents?
+            Mongoid::Warnings.warn_autosave_saves_unchanged_documents
+            return true
+          end
+
+          doc.class.relations.values.select { |a| a.autosave? && !a.embedded? }.any? do |assoc|
+            (assoc_value = doc.ivar(assoc.name)) &&
+              in_memory_docs(assoc_value).any? { |child| changed_for_autosave?(child, seen) }
+          end
+        end
+
+        # Returns the in-memory documents for an association value without
+        # triggering a database load of any unloaded documents. Association
+        # proxies expose in_memory for this purpose; a plain document (which
+        # belongs_to can store directly in the ivar) is itself in-memory.
+        def in_memory_docs(assoc_value)
+          assoc_value.respond_to?(:in_memory) ? assoc_value.in_memory : [ assoc_value ]
+        end
       end
     end
   end

data/lib/mongoid/attributes.rb

@@ -104,7 +104,8 @@ module Mongoid
     # @api private
     def process_raw_attribute(name, raw, field)
       value = field ? field.demongoize(raw) : raw
-      attribute_will_change!(name) if value.resizable?
+      is_relation = relations.key?(name)
+      attribute_will_change!(name) if value.resizable? && !is_relation
       value
     end
 

data/lib/mongoid/clients/factory.rb

@@ -131,6 +131,10 @@ module Mongoid
             [MONGOID_WRAPPING_LIBRARY] + options[:wrapping_libraries]
           else
             [MONGOID_WRAPPING_LIBRARY]
+          end.tap do |wrap|
+            if defined?(::Rails) && ::Rails.respond_to?(:version)
+              wrap << { name: 'Rails', version: ::Rails.version }
+            end
           end
           options[:wrapping_libraries] = wrap_lib
         end

data/lib/mongoid/config/defaults.rb

@@ -18,19 +18,23 @@ module Mongoid
         case version.to_s
         when /^[0-7]\./
           raise ArgumentError, "Version no longer supported: #{version}"
-        when "8.0"
+
+        when '8.0'
           self.legacy_readonly = true
 
-          load_defaults "8.1"
-        when "8.1"
+          load_defaults '8.1'
+
+        when '8.1'
           self.immutable_ids = false
           self.legacy_persistence_context_behavior = true
           self.around_callbacks_for_embeds = true
           self.prevent_multiple_calls_of_embedded_callbacks = false
 
-          load_defaults "9.0"
-        when "9.0"
+          load_defaults '9.0'
+
+        when '9.0'
           # All flag defaults currently reflect 9.0 behavior.
+
         else
           raise ArgumentError, "Unknown version: #{version}"
         end

data/lib/mongoid/config.rb

@@ -110,6 +110,31 @@ module Mongoid
     # to `:global_thread_pool`.
     option :global_executor_concurrency, default: nil
 
+    # When this flag is true, it will be possible to change the parent of a
+    # record in a "has_many" association by passing the child record's id in the
+    # nested attributes for another parent record.
+    #
+    # When this flag is false, attempting to change the parent of a record in a
+    # "has-many" association via nested attributes will raise an error.
+    #
+    # The default is `true`. Note that allowing reparenting via nested attributes
+    # is a potential security risk, since it could allow a malicious user to move
+    # records that they do not own to a parent record that they do own.
+    #
+    # This option will default to `false` in Mongoid 9.1, and will be removed
+    # in Mongoid 10.
+    option :allow_reparenting_via_nested_attributes, default: true
+
+    # When this flag is true, any documents in associations with `autosave: true`
+    # will be saved even if they have not been changed. When this flag is false,
+    # only autosaved documents that have been changed will be saved. The default
+    # is `true`.
+    #
+    # This option will default to `false` in Mongoid 9.1, and will be removed
+    # in Mongoid 10, with the only behavior at that point being as if this
+    # option were set to `false`.
+    option :autosave_saves_unchanged_documents, default: true
+
     # When this flag is false, a document will become read-only only once the
     # #readonly! method is called, and an error will be raised on attempting
     # to save or update such documents, instead of just on delete. When this

data/lib/mongoid/criteria.rb

@@ -41,24 +41,57 @@ module Mongoid
     include Clients::Sessions
     include Options
 
+    # Allowed methods for from_hash to prevent arbitrary method execution.
+    # Only query-building methods are allowed, not execution or modification methods.
+    ALLOWED_FROM_HASH_METHODS = %i[
+      all all_in all_of and any_in any_of asc ascending
+      batch_size between
+      collation comment cursor_type
+      desc descending
+      elem_match eq exists extras
+      geo_spatial group gt gte
+      hint
+      in includes
+      limit lt lte
+      max_distance max_scan max_time_ms merge mod
+      ne near near_sphere nin no_timeout none none_of nor not not_in
+      offset only or order order_by
+      project
+      raw read reorder
+      scoped skip slice snapshot
+      text_search type
+      unscoped unwind
+      where with_size with_type without
+    ].freeze
+
     class << self
       # Convert the given hash to a criteria. Will iterate over each keys in the
-      # hash which must correspond to method on a criteria object. The hash
-      # must also include a "klass" key.
+      # hash which must correspond to an allowed method on a criteria object. The hash
+      # can include a "klass" key that specifies the model class for the criteria.
       #
       # @example Convert the hash to a criteria.
       #   Criteria.from_hash({ klass: Band, where: { name: "Depeche Mode" })
       #
+      # @deprecated This method is deprecated and will
+      #  be removed in a future release.
+      #
       # @param [ Hash ] hash The hash to convert.
       #
       # @return [ Criteria ] The criteria.
+      #
+      # @raise [ ArgumentError ] If a method is not allowed in from_hash.
       def from_hash(hash)
         criteria = Criteria.new(hash.delete(:klass) || hash.delete('klass'))
         hash.each_pair do |method, args|
-          criteria = criteria.__send__(method, args)
+          method_sym = method.to_sym
+          unless ALLOWED_FROM_HASH_METHODS.include?(method_sym)
+            raise ArgumentError, "Method '#{method}' is not allowed in from_hash"
+          end
+          criteria = criteria.public_send(method_sym, args)
         end
         criteria
       end
+      Mongoid.deprecate(self, :from_hash)
     end
 
     # Static array used to check with method missing - we only need to ever
@@ -246,7 +279,8 @@ module Mongoid
     #   criteria.merge(other_criteria)
     #
     # @example Merge the criteria with a hash. The hash must contain a klass
-    #   key and the key/value pairs correspond to method names/args.
+    #   key that specifies the model class for the criteria and the key/value
+    #   pairs correspond to method names/args.
     #
     #   criteria.merge({
     #     klass: Band,
@@ -254,7 +288,7 @@ module Mongoid
     #     order_by: { name: 1 }
     #   })
     #
-    # @param [ Criteria ] other The other criterion to merge with.
+    # @param [ Criteria | Hash ] other The other criterion to merge with.
     #
     # @return [ Criteria ] A cloned self.
     def merge(other)

data/lib/mongoid/version.rb

@@ -5,5 +5,5 @@ module Mongoid
   #
   # Note that this file is automatically updated via `rake candidate:create`.
   # Manual changes to this file will be overwritten by that rake task.
-  VERSION = '9.0.9'
+  VERSION = '9.0.11'
 end

data/lib/mongoid/warnings.rb

@@ -33,5 +33,9 @@ module Mongoid
     warning :symbol_type_deprecated, 'The BSON Symbol type is deprecated by MongoDB. Please use String or StringifiedSymbol field types instead of the Symbol field type.'
     warning :legacy_readonly, 'The readonly! method will only mark the document readonly when the legacy_readonly feature flag is switched off.'
     warning :mutable_ids, 'Ignoring updates to immutable attribute `_id`. Please set Mongoid::Config.immutable_ids to true and update your code so that `_id` is never updated.'
+    warning :reparenting_via_nested_attributes, 'Reparenting documents via nested attributes is insecure and is deprecated. Set Mongoid.allow_reparenting_via_nested_attributes to false and update your code to avoid reparenting documents via nested attributes.'
+    warning :autosave_saves_unchanged_documents, "Autosave associations are currently configured to save documents even if they haven't changed. " \
+                                                 'This legacy behavior is deprecated. Set Mongoid.autosave_saves_unchanged_documents to false to ' \
+                                                 'skip saving unchanged documents in autosave associations.'
   end
 end

data/spec/integration/app_spec.rb

@@ -37,37 +37,34 @@ describe 'Mongoid application tests' do
     FileUtils.mkdir_p(TMP_BASE)
   end
 
-  context 'demo application' do
+  context 'generated application' do
     context 'sinatra' do
       it 'runs' do
-        skip 'https://jira.mongodb.org/browse/MONGOID-5826'
-
-        clone_application(
-          'https://github.com/mongoid/mongoid-demo',
-          subdir: 'sinatra-minimal',
-        ) do
-
+        create_sinatra_app('mongoid-sinatra-test') do
           # JRuby needs a long timeout
           start_app(%w(bundle exec ruby app.rb), 4567, 40) do |port|
             uri = URI.parse('http://localhost:4567/posts')
             resp = JSON.parse(uri.open.read)
 
             resp.should == []
-
           end
         end
       end
     end
 
     context 'rails-api' do
-      it 'runs' do
-        skip 'https://jira.mongodb.org/browse/MONGOID-5826'
-
-        clone_application(
-          'https://github.com/mongoid/mongoid-demo',
-          subdir: 'rails-api',
-        ) do
+      before(:all) do
+        # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+        # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+        if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+          skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+        elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+          skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
+        end
+      end
 
+      it 'runs' do
+        create_rails_api_app('mongoid-rails-api-test') do
           # JRuby needs a long timeout
           start_app(%w(bundle exec rails s), 3000, 50) do |port|
             uri = URI.parse('http://localhost:3000/posts')
@@ -114,7 +111,7 @@ describe 'Mongoid application tests' do
 
     Dir.chdir(TMP_BASE) do
       FileUtils.rm_rf(name)
-      check_call(insert_rails_gem_version(%W(rails new #{name} --skip-spring --skip-active-record)), env: clean_env)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --skip-spring --skip-active-record)), env: rails_env)
 
       Dir.chdir(name) do
         adjust_rails_defaults
@@ -126,10 +123,149 @@ describe 'Mongoid application tests' do
     end
   end
 
+  def create_sinatra_app(name)
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      FileUtils.mkdir_p(name)
+
+      Dir.chdir(name) do
+        # Create minimal Sinatra app with Post model
+        File.open('app.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            require 'sinatra'
+            require 'mongoid'
+            require 'json'
+
+            Mongoid.load!('config/mongoid.yml')
+
+            class Post
+              include Mongoid::Document
+              field :title, type: String
+            end
+
+            get '/posts' do
+              content_type :json
+              Post.all.to_json
+            end
+          RUBY
+        end
+
+        # Create Gemfile
+        File.open('Gemfile', 'w') do |f|
+          f.write(<<~RUBY)
+            source 'https://rubygems.org'
+            gem 'sinatra'
+            gem 'rackup'
+            gem 'mongoid', path: '#{File.expand_path(BASE)}'
+            gem 'puma'
+          RUBY
+        end
+
+        FileUtils.mkdir_p('config')
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+
+        yield
+      end
+    end
+  end
+
+  def create_rails_api_app(name)
+    install_rails
+
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --api --skip-spring --skip-active-record)), env: rails_env)
+
+      Dir.chdir(name) do
+        adjust_rails_defaults
+        adjust_app_gemfile
+
+        # Create Post model
+        File.open('app/models/post.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Post
+              include Mongoid::Document
+              field :title, type: String
+            end
+          RUBY
+        end
+
+        # Create PostsController
+        File.open('app/controllers/posts_controller.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class PostsController < ApplicationController
+              def index
+                render json: Post.all
+              end
+            end
+          RUBY
+        end
+
+        # Add route
+        routes_content = File.read('config/routes.rb')
+        routes_content.sub!(/Rails\.application\.routes\.draw do\n/,
+                           "Rails.application.routes.draw do\n  resources :posts, only: [:index]\n")
+        File.open('config/routes.rb', 'w') { |f| f.write(routes_content) }
+
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+
+        yield
+      end
+    end
+  end
+
+  def create_rails_rake_test_app(name)
+    install_rails
+
+    Dir.chdir(TMP_BASE) do
+      FileUtils.rm_rf(name)
+      check_call(insert_rails_gem_version(%W(rails new #{name} --api --skip-spring --skip-active-record)), env: rails_env)
+
+      Dir.chdir(name) do
+        adjust_rails_defaults
+        adjust_app_gemfile
+
+        # Create Post model with index
+        File.open('app/models/post.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Post
+              include Mongoid::Document
+              include Mongoid::Timestamps
+              field :subject, type: String
+              field :message, type: String
+
+              index subject: 1
+            end
+          RUBY
+        end
+
+        # Create Comment model
+        File.open('app/models/comment.rb', 'w') do |f|
+          f.write(<<~RUBY)
+            class Comment
+              include Mongoid::Document
+              include Mongoid::Timestamps
+              belongs_to :post
+            end
+          RUBY
+        end
+
+        write_mongoid_yml
+        check_call(%w(bundle install), env: clean_env)
+      end
+    end
+  end
+
   context 'new application - rails' do
     before(:all) do
-      if SpecConfig.instance.rails_version < '7.1'
-        skip '`rails new` with rails < 7.1 fails because modern concurrent-ruby removed logger dependency'
+      # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+      # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+      if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+        skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+      elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+        skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
       end
     end
 
@@ -186,17 +322,31 @@ describe 'Mongoid application tests' do
     if (rails_version = SpecConfig.instance.rails_version) == 'master'
     else
       check_call(%w(gem list))
+
+      # Rails 6.0 and 6.1 need logger gem on Ruby 2.7+ due to stdlib changes
+      if rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+        check_call(%w(gem install logger --no-document))
+      end
+
       check_call(%w(gem install rails --no-document --force -v) + ["~> #{rails_version}.0"])
     end
   end
 
-  context 'local test applications' do
+  context 'generated test applications' do
+    before(:all) do
+      # Rails 6.0/6.1 have Logger issues on Ruby 3.1+
+      # Rails < 7.1 have concurrent-ruby issues on Ruby 4.0+
+      if RUBY_VERSION >= '4.0' && SpecConfig.instance.rails_version < '7.1'
+        skip 'Rails < 7.1 is not compatible with Ruby 4.0+. Set RAILS=7.1 or higher.'
+      elsif RUBY_VERSION >= '3.1' && SpecConfig.instance.rails_version < '6.1'
+        skip 'Rails < 6.1 is not compatible with Ruby 3.1+. Set RAILS=6.1 or higher.'
+      end
+    end
+
     let(:client) { Mongoid.default_client }
 
     describe 'create_indexes rake task' do
 
-      APP_PATH = File.join(File.dirname(__FILE__), '../../test-apps/rails-api')
-
       %w(development production).each do |rails_env|
         context "in #{rails_env}" do
 
@@ -207,20 +357,11 @@ describe 'Mongoid application tests' do
                 clean_env.merge(RAILS_ENV: rails_env, AUTOLOADER: autoloader)
               end
 
+              let(:app_name) { "mongoid-rake-test-#{rails_env}-#{autoloader}" }
+              let(:app_path) { File.join(TMP_BASE, app_name) }
+
               before do
-                Dir.chdir(APP_PATH) do
-                  remove_bundler_req
-
-                  if BSON::Environment.jruby?
-                    # Remove existing Gemfile.lock - see
-                    # https://github.com/rubygems/rubygems/issues/3231
-                    require 'fileutils'
-                    FileUtils.rm_f('Gemfile.lock')
-                  end
-
-                  check_call(%w(bundle install), env: env)
-                  write_mongoid_yml
-                end
+                create_rails_rake_test_app(app_name)
 
                 client['posts'].drop
                 client['posts'].create
@@ -233,7 +374,7 @@ describe 'Mongoid application tests' do
                 index.should be nil
 
                 check_call(%w(bundle exec rake db:mongoid:create_indexes -t),
-                  cwd: APP_PATH, env: env)
+                  cwd: app_path, env: env)
 
                 index = client['posts'].indexes.detect do |index|
                   index['key'] == {'subject' => 1}
@@ -317,6 +458,12 @@ describe 'Mongoid application tests' do
       line =~ /mongoid/
     end
     gemfile_lines << "gem 'mongoid', path: '#{File.expand_path(BASE)}'\n"
+
+    # Rails 6.0 and 6.1 need logger gem on Ruby 2.7+ due to stdlib changes
+    if rails_version && rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+      gemfile_lines << "gem 'logger'\n"
+    end
+
     if rails_version
       gemfile_lines.delete_if do |line|
         line =~ /gem ['"]rails['"]/
@@ -376,6 +523,17 @@ describe 'Mongoid application tests' do
     @clean_env ||= Hash[ENV.keys.grep(/BUNDLE|RUBYOPT/).map { |k| [k, nil ] }]
   end
 
+  def rails_env
+    # For Rails 6.0/6.1 on Ruby 2.7+, we need to require logger
+    # to fix "uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger"
+    env = clean_env.dup
+    rails_version = SpecConfig.instance.rails_version
+    if rails_version && rails_version.to_f < 7.0 && RUBY_VERSION >= '2.7'
+      env['RUBYOPT'] = '-rlogger'
+    end
+    env
+  end
+
   def wait_for_port(port, timeout, process)
     deadline = Mongoid::Utils.monotonic_time + timeout
     loop do

data/spec/mongoid/association/auto_save_spec.rb

@@ -5,6 +5,53 @@ require "spec_helper"
 require_relative './referenced/has_many_models'
 require_relative './referenced/has_one_models'
 
+# Models for the MONGOID-5751 regression test: after_save callbacks must not
+# fire for pre-existing, unchanged documents when autosave: true cascades a
+# save from a parent to its children.
+module AutoSaveMONGOID5751
+  class Table
+    include Mongoid::Document
+
+    has_many :rows, autosave: true, class_name: 'AutoSaveMONGOID5751::Row',
+                    inverse_of: :table
+
+    class << self
+      attr_accessor :after_save_count
+    end
+    self.after_save_count = 0
+
+    after_save { self.class.after_save_count += 1 }
+  end
+
+  class Row
+    include Mongoid::Document
+
+    belongs_to :table, class_name: 'AutoSaveMONGOID5751::Table', inverse_of: :rows
+    has_many :cells, autosave: true, class_name: 'AutoSaveMONGOID5751::Cell',
+                     inverse_of: :row
+
+    class << self
+      attr_accessor :after_save_count
+    end
+    self.after_save_count = 0
+
+    after_save { self.class.after_save_count += 1 }
+  end
+
+  class Cell
+    include Mongoid::Document
+
+    belongs_to :row, class_name: 'AutoSaveMONGOID5751::Row', inverse_of: :cells
+
+    class << self
+      attr_accessor :after_save_count
+    end
+    self.after_save_count = 0
+
+    after_save { self.class.after_save_count += 1 }
+  end
+end
+
 describe Mongoid::Association::Referenced::AutoSave do
 
   describe ".auto_save" do
@@ -399,6 +446,57 @@ describe Mongoid::Association::Referenced::AutoSave do
           expect(harvest.reload.season).to eq('Fall')
         end
       end
+
+      # Regression test for MONGOID-5751: after_save must not fire for
+      # pre-existing, unchanged documents that are merely loaded into memory
+      # as a side-effect of the autosave traversal.
+      context 'when a parent with existing children has a new child added' do
+        before do
+          # Persist a table with 3 pre-existing rows, each with 3 cells.
+          table = AutoSaveMONGOID5751::Table.create!
+          3.times do
+            row = table.rows.create!
+            3.times { row.cells.create! }
+          end
+
+          # Reset counters so only the saves triggered by the call below are
+          # measured.
+          AutoSaveMONGOID5751::Table.after_save_count = 0
+          AutoSaveMONGOID5751::Row.after_save_count = 0
+          AutoSaveMONGOID5751::Cell.after_save_count = 0
+
+          # Reload the table fresh from the database, then append exactly one
+          # new row (with one new cell) and persist.
+          reloaded = AutoSaveMONGOID5751::Table.find(table.id)
+          new_row = reloaded.rows.build
+          new_row.cells.build
+          reloaded.save!
+        end
+
+        it 'fires after_save once for the parent table' do
+          expect(AutoSaveMONGOID5751::Table.after_save_count).to eq(1)
+        end
+
+        it 'fires after_save only for the newly added cell' do
+          expect(AutoSaveMONGOID5751::Cell.after_save_count).to eq(1)
+        end
+
+        context 'when autosave_saves_unchanged_documents is true' do
+          config_override :autosave_saves_unchanged_documents, true
+
+          it 'fires after_save for all new and pre-existing rows' do
+            expect(AutoSaveMONGOID5751::Row.after_save_count).to eq(4)
+          end
+        end
+
+        context 'when autosave_saves_unchanged_documents is false' do
+          config_override :autosave_saves_unchanged_documents, false
+
+          it 'fires after_save only for the newly added row, not for pre-existing rows' do
+            expect(AutoSaveMONGOID5751::Row.after_save_count).to eq(1)
+          end
+        end
+      end
     end
   end
 end

data/spec/mongoid/attributes/nested_spec.rb

@@ -164,24 +164,47 @@ describe Mongoid::Attributes::Nested do
       end
     end
 
-    context "when the relation is a references many" do
-
+    context 'when the relation is a has-many' do
       before do
         Person.send(:undef_method, :posts_attributes=)
         Person.accepts_nested_attributes_for :posts
       end
 
-      let(:person) do
-        Person.new(posts_attributes: { "1" => { title: "First" }})
+      context 'when adding a new document to a relation' do
+        let(:person) do
+          Person.new(posts_attributes: { '1' => { title: 'First' } })
+        end
+
+        it 'sets the nested attributes' do
+          expect(person.posts.first.title).to eq('First')
+        end
       end
 
-      it "sets the nested attributes" do
-        expect(person.posts.first.title).to eq("First")
+      context 'when adding an existing document to a relation' do
+        let(:person1) { Person.create! }
+        let(:post) { person1.posts.create!(title: 'Sample Post') }
+
+        let(:person2) { Person.create!(posts_attributes: { '0' => { id: post.id, title: 'Reparented!' } }) }
+
+        context 'when allow_reparenting_via_nested_attributes is false' do
+          config_override :allow_reparenting_via_nested_attributes, false
+
+          it 'raises a document not found error' do
+            expect { person2 }.to raise_error(Mongoid::Errors::DocumentNotFound)
+          end
+        end
+
+        context 'when allow_reparenting_via_nested_attributes is true' do
+          config_override :allow_reparenting_via_nested_attributes, true
+
+          it 'sets the nested attributes' do
+            expect(person2.posts.map(&:title)).to eq([ 'Reparented!' ])
+          end
+        end
       end
     end
 
-    context "when the relation is a references and referenced in many" do
-
+    context 'when the relation is a has-and-belongs-to-many' do
       before do
         Person.send(:undef_method, :preferences_attributes=)
         Person.accepts_nested_attributes_for :preferences
@@ -1355,10 +1378,11 @@ describe Mongoid::Attributes::Nested do
             context "when the ids do not match" do
 
               it "raises an error" do
-                expect {
+                expect do
                   person.addresses_attributes =
-                    { "foo" => { "id" => "test", "street" => "Test" } }
-                }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Address with id\(s\)/)
+                    { 'foo' => { 'id' => 'test', 'street' => 'Test' } }
+                end.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                   /Document\(s\) not found for class Address/)
               end
             end
           end
@@ -3012,12 +3036,12 @@ describe Mongoid::Attributes::Nested do
                 end
 
                 it "raises a document not found error" do
-                  expect {
+                  expect do
                     person.posts_attributes =
-                      { "0" =>
-                        { "id" => BSON::ObjectId.new.to_s, "title" => "Rogue" }
-                      }
-                  }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Post with id\(s\)/)
+                      { '0' =>
+                        { 'id' => BSON::ObjectId.new.to_s, 'title' => 'Rogue' } }
+                  end.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                     /Document\(s\) not found for class Post/)
                 end
               end
             end
@@ -3048,10 +3072,11 @@ describe Mongoid::Attributes::Nested do
             context "when the ids do not match" do
 
               it "raises an error" do
-                expect {
+                expect do
                   person.posts_attributes =
-                    { "foo" => { "id" => "test", "title" => "Test" } }
-                }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Post with id\(s\)/)
+                    { 'foo' => { 'id' => 'test', 'title' => 'Test' } }
+                end.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                   /Document\(s\) not found for class Post/)
               end
             end
           end
@@ -3765,10 +3790,11 @@ describe Mongoid::Attributes::Nested do
             context "when the ids do not match" do
 
               it "raises an error" do
-                expect {
+                expect do
                   person.preferences_attributes =
-                    { "foo" => { "id" => "test", "name" => "Test" } }
-                }.to raise_error(Mongoid::Errors::DocumentNotFound, /Document\(s\) not found for class Preference with id\(s\)/)
+                    { 'foo' => { 'id' => 'test', 'name' => 'Test' } }
+                end.to raise_error(Mongoid::Errors::DocumentNotFound,
+                                   /Document\(s\) not found for class Preference/)
               end
             end
           end

data/spec/mongoid/attributes_spec.rb

@@ -2722,7 +2722,23 @@ describe Mongoid::Attributes do
     end
   end
 
-  context "when modifiying a set referenced with the [] notation" do
+  context "when accessing an embedded document with the attribute accessor" do
+    let(:band) { Band.create! }
+
+    before do
+      Band.where(id: band.id).update_all({
+        :$push => {records: { _id: BSON::ObjectId.new }}
+      })
+    end
+
+    it "does not throw a conflicting update error" do
+      b1 = Band.find(band.id)
+      b1[:records].is_a?(Array).should be true
+      expect { b1.save! }.not_to raise_error
+    end
+  end
+
+  context "when modifying a set referenced with the [] notation" do
     let(:catalog) { Catalog.create!(set_field: [ 1 ].to_set) }
 
     before do

data/spec/mongoid/clients/factory_spec.rb

@@ -30,6 +30,34 @@ describe Mongoid::Clients::Factory do
     end
   end
 
+  shared_examples_for 'includes rails wrapping library' do
+    context 'when Rails is available' do
+      around do |example|
+        rails_was_defined = defined?(::Rails)
+
+        if !rails_was_defined
+          module ::Rails
+            def self.version
+              '6.1.0'
+            end
+          end
+        end
+
+        example.run
+
+        if !rails_was_defined
+          Object.send(:remove_const, :Rails) if defined?(::Rails)
+        end
+      end
+
+      it 'adds Rails as another wrapping library' do
+        expect(client.options[:wrapping_libraries]).to include(
+          {'name' => 'Rails', 'version' => '6.1.0'},
+        )
+      end
+    end
+  end
+
   describe ".create" do
 
     context "when provided a name" do
@@ -89,6 +117,8 @@ describe Mongoid::Clients::Factory do
               Mongoid::Clients::Factory::MONGOID_WRAPPING_LIBRARY)]
           end
 
+          it_behaves_like 'includes rails wrapping library'
+
           context 'when configuration specifies a wrapping library' do
 
             let(:config) do
@@ -110,6 +140,8 @@ describe Mongoid::Clients::Factory do
                 {'name' => 'Foo'},
               ]
             end
+
+            it_behaves_like 'includes rails wrapping library'
           end
         end
 

data/spec/mongoid/criteria_spec.rb

@@ -3250,5 +3250,201 @@ describe Mongoid::Criteria do
         expect(criteria.selector).to eq({ 'name' => 'Songs Ohia' })
       end
     end
+
+    context 'with allowed methods' do
+      context 'when using multiple query methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            where: { active: true },
+            limit: 10,
+            skip: 5,
+            order_by: { name: 1 }
+          }
+        end
+
+        it 'applies all methods successfully' do
+          expect(criteria.selector).to eq({ 'active' => true })
+          expect(criteria.options[:limit]).to eq(10)
+          expect(criteria.options[:skip]).to eq(5)
+          expect(criteria.options[:sort]).to eq({ 'name' => 1 })
+        end
+      end
+
+      context 'when using query selector methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            gt: { members: 2 },
+            in: { genre: ['rock', 'metal'] }
+          }
+        end
+
+        it 'applies selector methods' do
+          expect(criteria.selector['members']).to eq({ '$gt' => 2 })
+          expect(criteria.selector['genre']).to eq({ '$in' => ['rock', 'metal'] })
+        end
+      end
+
+      context 'when using aggregation methods' do
+        let(:hash) do
+          {
+            klass: Band,
+            project: { name: 1, members: 1 }
+          }
+        end
+
+        it 'applies aggregation methods' do
+          expect { criteria }.not_to raise_error
+        end
+      end
+    end
+
+    context 'with disallowed methods' do
+      context 'when attempting to call create' do
+        let(:hash) do
+          { klass: Band, create: { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in from_hash")
+        end
+      end
+
+      context 'when attempting to call create!' do
+        let(:hash) do
+          { klass: Band, 'create!': { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create!' is not allowed in from_hash")
+        end
+      end
+
+      context 'when attempting to call build' do
+        let(:hash) do
+          { klass: Band, build: { name: 'Malicious' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'build' is not allowed in from_hash")
+        end
+      end
+
+      context 'when attempting to call find' do
+        let(:hash) do
+          { klass: Band, find: 'some_id' }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'find' is not allowed in from_hash")
+        end
+      end
+
+      context 'when attempting to call execute_or_raise' do
+        let(:hash) do
+          { klass: Band, execute_or_raise: ['id1', 'id2'] }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'execute_or_raise' is not allowed in from_hash")
+        end
+      end
+
+      context 'when attempting to call new' do
+        let(:hash) do
+          { klass: Band, new: { name: 'Test' } }
+        end
+
+        it 'raises ArgumentError' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'new' is not allowed in from_hash")
+        end
+      end
+
+      context 'when allowed method is combined with disallowed method' do
+        let(:hash) do
+          {
+            klass: Band,
+            where: { active: true },
+            create: { name: 'Malicious' }
+          }
+        end
+
+        it 'raises ArgumentError before executing any methods' do
+          expect { criteria }.to raise_error(ArgumentError, "Method 'create' is not allowed in from_hash")
+        end
+      end
+    end
+
+    context 'security validation' do
+      # This test ensures that ALL public methods not in the allowlist are blocked
+      it 'blocks all dangerous public methods' do
+        dangerous_methods = %i[
+          build create create! new
+          find find_or_create_by find_or_create_by! find_or_initialize_by
+          first_or_create first_or_create! first_or_initialize
+          execute_or_raise multiple_from_db for_ids
+          documents= inclusions= scoping_options=
+          initialize freeze as_json
+        ]
+
+        dangerous_methods.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { described_class.from_hash(hash) }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in from_hash"
+          ), "Expected method '#{method}' to be blocked but it was allowed"
+        end
+      end
+
+      it 'blocks dangerous inherited methods from Object' do
+        # Critical security test: block send, instance_eval, etc.
+        inherited_dangerous = %i[
+          send __send__ instance_eval instance_exec
+          instance_variable_set method
+        ]
+
+        inherited_dangerous.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { described_class.from_hash(hash) }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in from_hash"
+          ), "Expected inherited method '#{method}' to be blocked"
+        end
+      end
+
+      it 'blocks Enumerable execution methods' do
+        # from_hash should build queries, not execute them
+        enumerable_methods = %i[each map select count sum]
+
+        enumerable_methods.each do |method|
+          hash = { klass: Band, method => 'arg' }
+          expect { described_class.from_hash(hash) }.to raise_error(
+            ArgumentError,
+            "Method '#{method}' is not allowed in from_hash"
+          ), "Expected Enumerable method '#{method}' to be blocked"
+        end
+      end
+
+      it 'allows all whitelisted methods' do
+        # Sample of allowed methods from each category
+        allowed_sample = {
+          where: { name: 'Test' },      # Query selector
+          limit: 10,                     # Query option
+          skip: 5,                       # Query option
+          gt: { age: 18 },              # Query selector
+          in: { status: ['active'] },   # Query selector
+          ascending: :name,              # Sorting
+          includes: :notes,            # Eager loading
+          merge: { klass: Band },        # Merge
+        }
+
+        allowed_sample.each do |method, args|
+          hash = { klass: Band, method => args }
+          expect { described_class.from_hash(hash) }.not_to raise_error,
+            "Expected method '#{method}' to be allowed but it was blocked"
+        end
+      end
+    end
   end
 end

data/spec/mongoid/errors/document_not_found_spec.rb

@@ -64,9 +64,16 @@ describe Mongoid::Errors::DocumentNotFound do
       end
 
       it "contains the problem in the message" do
-        expect(error.message).to include(
-          "Document not found for class Person with attributes {:name=>\"syd\"}."
-        )
+        # Ruby 3.4+ changed Hash#inspect format from {:name=>"syd"} to {name: "syd"}
+        if RUBY_VERSION >= '3.4'
+          expect(error.message).to include(
+            "Document not found for class Person with attributes {name: \"syd\"}."
+          )
+        else
+          expect(error.message).to include(
+            "Document not found for class Person with attributes {:name=>\"syd\"}."
+          )
+        end
       end
 
       it "contains the summary in the message" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mongoid
 version: !ruby/object:Gem::Version
-  version: 9.0.9
+  version: 9.0.11
 platform: ruby
 authors:
 - The MongoDB Ruby Team
@@ -75,6 +75,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bson
   requirement: !ruby/object:Gem::Requirement
@@ -1231,7 +1245,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 4.0.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Elegant Persistence in Ruby for MongoDB.
 test_files: