yes 2.4.5 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3911bd78f9c4eff4e845defe91790e1a0d7b3f9050710cfd3acf573dffc114a
-  data.tar.gz: e3fce24424170ed6a43e98f8bd129c9c78fc7d2b5d1b4b55e54454632d367059
+  metadata.gz: 7d2ddb9e50702c3c99ab4cba938f1fabcbe8591d149afa8f3ea76e52541f42bb
+  data.tar.gz: f8f54a0ec7a1906640c47207d6dfc091dd2cac0f4f5e561fa415903d42eb4fa2
 SHA512:
-  metadata.gz: 593e188833682247031b0b1d17443d4ac58765dc9e96569cb838ef61ccec379c8dec28328d1cb0e70b901ca35fcc0813841e1e5c2717bd344cee7928efe01b09
-  data.tar.gz: bc6b2aba7b251abda0224c28f1da88a9ace2bfb1498f5be429b530d9202e532f8b6bf3d99535735b6247b6182855981ec12ad8cb2a6d7302c8038ceff92b3d9a
+  metadata.gz: da2a6ae6bd18505cba5cfdf0a80abe4e6de1be364718cb4a489f7b9c79960656ca803a0a1d02169b111aec07056a9f8eaccfb4581aec8bee416ec7784de2f89a
+  data.tar.gz: 6e0111d1761b8e098a7bb10244cbe5da922dbe9b69327c32ba99420e5dfafb2eb0c5671e75af4eff3ea7628041c9d852727f8bc7c839cf94307f8ec89220bc4c

data/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to this project will be documented in this file.
 
+## [Unreleased]
+
+## [2.6.0] - 2026-10-28
+
+### yes-core
+
+#### Added
+- `Yes::Core::ReadModel::Builder#call` now writes the stream revision of the handled event into the read
+  model's `revision` column, if it has one. The column only moves forward, so replaying older events does
+  not lower it, and a rebuild ends at the last revision of the stream. Events that were not handled (no
+  handler, locale not available) leave it unchanged. Per-aggregate revision columns such as
+  `shop_order_revision` are not touched. The builder writes `revision` for every event of the read model's own
+  stream, so a read model whose `revision` column an aggregate writes must not also be fed by a builder (use
+  per-aggregate revision columns or project the events through the aggregate instead). Only events of the
+  read model's own stream are considered, compared by stream id only: a read model fed by two streams with
+  the same id (different context or stream name) would get a mixed revision and must not rely on it. This lets a consumer of a read model fed by a
+  subscription compare its `revision` with the stream's last revision to know whether the projection has caught up.
+
+## [2.5.0] - 2026-10-08
+
+### yes-core
+
+#### Added
+- `Configuration#auth_error_classes` returns `Yes::Core::AuthenticationError` plus the error classes
+  of the configured auth adapter. The command API now uses it to decide which errors it rescues.
+
+### yes-read-api
+
+#### Fixed
+- The read API now rescues the error classes of the configured auth adapter like the command API
+  does, so e.g. an expired token yields 401 instead of an unhandled error.
+- A malformed bearer token no longer fails the request with an unhandled error when tracing is
+  enabled; the controller answers 401.
+
+#### Security
+- `QueriesController` now hands the request authorizer only the filter parameter the query applies.
+  It used to pass the raw params, with both `filters` and `filter_definition`, although a basic
+  query applies only `filters` and an advanced query (the `advanced` action, or a persisted filter
+  given by `filter_id`) applies only `filter_definition`. A request authorizer that chooses what to
+  authorize by which of the two is present could therefore authorize parameters the query ignores,
+  for example `GET /:model?filter_definition[scope][company_ids]=<own company>` passing the check
+  while the query returned unscoped rows. The query is built from the same reduced params, so
+  authorizers that bound a request by changing them keep working. Subclasses that call the request
+  authorizer from their own actions should drop the ignored parameter the same way.
+
+### yes-command-api
+
+#### Fixed
+- A malformed bearer token no longer fails the request with an unhandled error when tracing is
+  enabled; the controller answers 401.
+
 ## [2.4.5] - 2026-09-23
 
 ### yes-core

data/lib/yes/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yes
-  VERSION = '2.4.5'
+  VERSION = '2.6.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: 'yes'
 version: !ruby/object:Gem::Version
-  version: 2.4.5
+  version: 2.6.0
 platform: ruby
 authors:
 - Nico Ritsche
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
 - !ruby/object:Gem::Dependency
   name: yes-command-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
 - !ruby/object:Gem::Dependency
   name: yes-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
 - !ruby/object:Gem::Dependency
   name: yes-read-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.4.5
+        version: 2.6.0
 description: Event sourcing framework for Ruby on Rails applications
 email:
 - nico.ritsche@yousty.ch