nondisposable 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d0c0a8ad776c00c83c1e8b1e3001c652c5e5b414bb8f79216d3544192843e42
-  data.tar.gz: f2ab66119b84f495ce62d2104ab1c05701441796a969ae793e0fe033c69e6447
+  metadata.gz: 96ee85d55e05d52d472cb9a4b9897e318499282c35818579621daec1bcd7bf9e
+  data.tar.gz: f633e949328cb2972dfdff7c44f33072b29dae4b5bd95ab116af24ec504f676c
 SHA512:
-  metadata.gz: 5d2c0d50d9296c92465713fcdf8c97ddfcb3f9b4536ff299b80687f4d0ea12c877a718511bd340d3f1bba897c3e1cc38bdd65ee10c9a3c6f37272cffd3a376cb
-  data.tar.gz: bd6983052fe4a8980a041c99f8aa7a4c41b35c947b5de246d39b10cdbf20c2ad36b2114dd1dad6b481388bcff02a4712977d73bf90c7d132bd0cbd594a5dc245
+  metadata.gz: 71c6fbbfcac0534c320decc1cee69147497984a9dc12f19569a2231eacc192a5a2cc328e88decdc5e8f692384bf8ae39705a9c77ff134fb5cccc02fc455c133d
+  data.tar.gz: 8abdd8d29e8bfeb5f51da7cc98a6b213a8af428b561a8be6a9d2e84bce470f96a5e2c5bbeeff2f9a4e0dda0d719f5e696562c97b9643278a5d92a5c90ae8ff06

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.6.1] - 2026-10-17
+
+### Fixed
+
+- **A populated table is no longer replaced with the bundled list by an update** (an explicit `rollback` still can; see below). In 0.6.0, when a PRIMARY source with a bundled list (the default `disposable-email-domains`) had never been fetched successfully, `DomainListUpdater` put the list bundled with the gem in its place and published it, even over a populated table. **Who is affected:** any host with the `nondisposable_source_snapshots` table whose domain table was populated before the default source had an accepted snapshot of its own. Typically that means an upgrade from 0.4/0.5, with `Sources::DEFAULT` or a multi-source configuration such as `Sources::RECOMMENDED`. If the default source failed on such a host's first update, the table was replaced by the bundled snapshot (plus any other primary that succeeded), and every domain added upstream since the gem's release stopped being blocked until the next successful run. `update` returned false, but the list had already shrunk. Now the bundled stand-in is used **only on an empty table** (a fresh install). With a populated table, publishing is skipped with an error log and the table is kept as it is, until every primary has an accepted snapshot of its own. **The deliberate exception is `DomainListUpdater.rollback`:** withdrawing a poisoned list must always succeed, so there the bundled list still stands in for a primary without a snapshot, whatever the table holds. The emptiness check also bypasses the query cache, so a stale cached answer can never let the bundled list replace rows it never saw. Reported by a codex review in CarHey.
+
 ## [0.6.0] - 2026-10-17
 
 Ships everything listed under 0.5.0 too: 0.5.0 was never released on its own.

data/README.md

@@ -408,7 +408,7 @@ Each source is fetched into its own row in `nondisposable_source_snapshots` (sta
 - it is less than half the source's high-water mark, the largest size ever accepted for it (kept on its newest good snapshot, so neither pruning nor a series of 49% cuts can wear it down; `reset_baseline` is the human override), or more than three times its last good one;
 - it is identical to a snapshot a human rolled back.
 
-Every size is a count of *storable* domains (not junk, not a public suffix, not a known real provider, not a privacy relay), counted the same way whatever your settings, so a payload padded with such lines cannot pass for a full list and changing `block_privacy_relays` or `excluded_domains` never trips a guard. The list is never published empty. A primary that has never been fetched successfully either stands in its bundled list (the default source) or blocks publishing (any other), so a first run can never replace the seed with less than it. Additions and removals are logged per source. A source that lists a known real provider, or a public suffix, is logged as a possible poisoning, and the entry is dropped. Accepting a snapshot, publishing and rolling back all happen under the same lock; downloads happen outside it.
+Every size is a count of *storable* domains (not junk, not a public suffix, not a known real provider, not a privacy relay), counted the same way whatever your settings, so a payload padded with such lines cannot pass for a full list and changing `block_privacy_relays` or `excluded_domains` never trips a guard. The list is never published empty. A primary that has never been fetched successfully blocks publishing, and the current table is kept as it is. Two exceptions let the default source's bundled list stand in for it: an EMPTY table (a fresh install), and an explicit `rollback`, which must always be able to withdraw a poisoned list. So an update can never replace a fresh seed with less than it, nor a table upgraded from 0.4/0.5 (with any source configuration) with an older bundled snapshot. Additions and removals are logged per source. A source that lists a known real provider, or a public suffix, is logged as a possible poisoning, and the entry is dropped. Accepting a snapshot, publishing and rolling back all happen under the same lock; downloads happen outside it.
 
 > [!WARNING]
 > **Two concurrency limits, by design:**

data/lib/nondisposable/domain_list_updater.rb

@@ -303,6 +303,16 @@ module Nondisposable
       def publish!(withdrawn: nil)
         snapshots = {}
         missing_primaries = []
+        # The bundled list may stand in for a never-fetched primary ONLY on an
+        # empty table. A populated table (a host upgrading from 0.4/0.5, whose
+        # rows are newer than this gem's release) is kept as it is until every
+        # primary has an accepted snapshot of its own: replacing it with the
+        # bundled snapshot would silently unblock every domain added upstream
+        # since the release (0.6.1; reported by a CarHey codex review).
+        # A rollback is the deliberate exception: withdrawing a poisoned list
+        # must succeed even when the default source never had a snapshot of
+        # its own, so there the stand-in is used whatever the table holds.
+        table_empty = DisposableDomain.uncached { DisposableDomain.none? }
 
         configured_sources.each do |source|
           snapshot = SourceSnapshot.last_good(source.name)
@@ -310,7 +320,7 @@ module Nondisposable
             snapshots[source] = snapshot.domain_list
           elsif source.name == withdrawn
             log :warn, "#{source.name} has no good snapshot left after the rollback; building the list without it."
-          elsif source.primary? && source.bundled_path
+          elsif source.primary? && source.bundled_path && (table_empty || withdrawn)
             log :warn, "#{source.name} has no good snapshot yet; using the list bundled with the gem in its place."
             snapshots[source] = Source.parse(File.read(source.bundled_path)).domains
           elsif source.primary?
@@ -322,7 +332,8 @@ module Nondisposable
 
         if missing_primaries.any?
           log :error, "Not publishing: primary source(s) #{missing_primaries.join(', ')} have never been fetched successfully. " \
-                      'Keeping the current list (seeding it from the bundled snapshot if it is empty).'
+                      'Keeping the current list unchanged (seeding it from the bundled snapshot only if it is empty) ' \
+                      'until every primary has an accepted snapshot of its own.'
           seed!
           return false
         end
@@ -371,7 +382,9 @@ module Nondisposable
       # ---- Seeding and writing ----------------------------------------------
 
       def seed!
-        return false unless DisposableDomain.none?
+        # Callers hold the publish lock, which already disables the query
+        # cache; asked uncached here as well so no future caller can forget.
+        return false unless DisposableDomain.uncached { DisposableDomain.none? }
 
         log :info, 'Domain table is empty; seeding from the blocklist bundled with the gem...'
         domains = Source.parse(bundled_domains.join("\n")).domains
@@ -465,10 +478,16 @@ module Nondisposable
       # time, and two processes publishing the same snapshots write the same
       # rows. Returns the block's value, or nil when another process held the
       # lock for longer than PUBLISH_LOCK_WAIT (it is publishing the same thing).
+      #
+      # Everything under the lock runs with the query cache OFF: an emptiness
+      # check (`DisposableDomain.none?`) answered from a cache filled before
+      # another process or thread wrote the table would let the bundled list
+      # replace rows it never saw.
       def with_publish_lock(&block)
+        uncached = -> { DisposableDomain.uncached(&block) }
         PROCESS_LOCK.synchronize do
           DisposableDomain.connection_pool.with_connection do |connection|
-            next block.call unless connection.supports_advisory_locks?
+            next uncached.call unless connection.supports_advisory_locks?
 
             acquired = false
             deadline = monotonic + PUBLISH_LOCK_WAIT
@@ -482,7 +501,7 @@ module Nondisposable
             next nil unless acquired
 
             begin
-              block.call
+              uncached.call
             ensure
               connection.release_advisory_lock(PUBLISH_LOCK_ID)
             end

data/lib/nondisposable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Nondisposable
-  VERSION = "0.6.0"
+  VERSION = "0.6.1"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: nondisposable
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-10-17 00:00:00.000000000 Z
+date: 2026-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails