yes 2.6.1 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ad1c2c42cc9d5a9b1edf908cccb44f63de770f8c693715ad18f2571f515d976
-  data.tar.gz: 8ec5fbc7a12f0a36d774b0af83e9b3642abb4ea6eb7e6175af1ff72c6d8f30f9
+  metadata.gz: 43f1b8affefa3e8621597402df80a13eef9779a30f5f2762af02bc9c1dd7b3f7
+  data.tar.gz: ffb68f2c31476168b8113387aa39074083c6bad9b510b80daa12d8649496a633
 SHA512:
-  metadata.gz: 21588c2cffb2b8b82ad156ae9951fb0795e7504270e38c0119a2b429fd55c4d4629e2be3ee24d4c021f4b793b03a464323c8d19dc6498334597c3a7319b78ea1
-  data.tar.gz: 8b278620d445d8beff8ee69483d3dd96d9789ae3840463869c15651ee347349e600e3fc8027f0542cb6e0a5138d02dbcabc2eb08ce410029ed7e2f96bea4bf02
+  metadata.gz: 6ddf86402c312aa66d6ca19d40f9fb44f9e37f85937c5d3758af88a9a75b25fa09f8f8eba1c9065b38af5fe4d77bb97d0da9dac85f4a16933d77f599192f8632
+  data.tar.gz: 510ec59f73ef0191e6f3766c5c94e30a9d5dccaf1197faa364239cd122f4f9a398484984ed11c9a58bdd9624d64352291a2fb7c61b5464ad62dc1305ba7a5e02

data/CHANGELOG.md

@@ -4,6 +4,33 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [2.8.0] - 2026-10-29
+
+### yes-read-api
+
+#### Security
+- `QueriesController` answers `400 Bad Request` (`{ "title": "Bad Request", "detail": ... }`)
+  instead of silently ignoring a filter parameter its query does not apply. A basic query (`GET`/`HEAD`)
+  applies `filters` only, an advanced query (`POST`) applies `filter_definition` only. Rejected are a `GET`
+  or `HEAD` carrying `filter_definition`, a `POST` carrying `filters`, a `POST` without `filter_definition`, and
+  a `GET` with a `filter_id` whose stored body has no `filter_definition` (`the stored filter has no
+  filter_definition`), since a stored filter runs as an advanced query too.
+  Request authorizers commonly decide what to check by which parameter is present, so an ignored parameter could
+  be authorized while the query returned rows it never bounded. The check runs for subclass actions too.
+  Clients must send `filters` on `GET` and `filter_definition` on `POST`; other parameters (`page`, `order`,
+  `include`, `filter_id`, ...) are unaffected. Requests that relied on the ignored parameter now receive `400`.
+
+## [2.7.0] - 2026-10-29
+
+### yes-core
+
+#### Added
+- `Yes::Core::Commands::Bus#call` accepts `extra_notifier_classes:`, a list of command notifier classes that
+  run for that call only. They are appended to the configured `command_notifier_classes`, get the same
+  `notifier_options`, and also run when commands are processed inline. `Yes::Core::Commands::Processor#perform`
+  takes their names as an optional last argument. No new argument is passed to the processor unless per-call
+  notifiers are given, so jobs enqueued before the upgrade and custom processors keep working.
+
 ## [2.6.1] - 2026-10-28
 
 ### yes-core

data/README.md

@@ -1740,6 +1740,16 @@ class SlackNotifier < Yes::Core::Commands::Notifier
 end
 ```
 
+#### Per-call Notifiers
+
+To attach a notifier to one specific command bus call only, for example to report failures of a batch import without registering the notifier for every batch, pass it as `extra_notifier_classes`:
+
+```ruby
+Yes::Core::CommandBus.new.call(commands, extra_notifier_classes: [ImportFailureNotifier])
+```
+
+The per-call notifiers are appended to the configured `command_notifier_classes` and receive the same `notifier_options`. Unlike the configured ones, they also run when commands are processed inline, because the caller asked for them explicitly. The notifier classes must be named (anonymous classes are not supported), as only their names are passed on to the command processor job.
+
 ## Read API
 
 The Read API (`yes-read-api`) provides an HTTP endpoint for querying read models with filtering, pagination, and authorization. Like the Command API, it is a standalone Rails engine that does **not** depend on the aggregate DSL — it works with any ActiveRecord model that has a matching serializer.

data/lib/yes/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Yes
-  VERSION = '2.6.1'
+  VERSION = '2.8.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: 'yes'
 version: !ruby/object:Gem::Version
-  version: 2.6.1
+  version: 2.8.0
 platform: ruby
 authors:
 - Nico Ritsche
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
 - !ruby/object:Gem::Dependency
   name: yes-command-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
 - !ruby/object:Gem::Dependency
   name: yes-core
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
 - !ruby/object:Gem::Dependency
   name: yes-read-api
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.6.1
+        version: 2.8.0
 description: Event sourcing framework for Ruby on Rails applications
 email:
 - nico.ritsche@yousty.ch