yes 2.7.0 → 2.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +16 -0
  3. data/lib/yes/version.rb +1 -1
  4. metadata +9 -9
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 944da2a67e980d1fb3cde4eab7489658750049367f7768ecad8f726211c08f81
4
- data.tar.gz: 907d2c09c45c4a45c185298d318b5c1578f53bf013497ecbe94909a6665c0345
3
+ metadata.gz: 43f1b8affefa3e8621597402df80a13eef9779a30f5f2762af02bc9c1dd7b3f7
4
+ data.tar.gz: ffb68f2c31476168b8113387aa39074083c6bad9b510b80daa12d8649496a633
5
5
  SHA512:
6
- metadata.gz: adf1804ce07f002acb29ba54815e8d21c98a1d1a1be3f6ea44bd97805ae236e58bb201bb5f67c133de56999d3280ddc9caee7a4bacc0a43f1ec0f7b25c874540
7
- data.tar.gz: 57699ff64dd32932c987d489494d96a3569c294d859ed6bdb5d6f2a31031843e77e9f4e2d2b5b5a1552818df7221d1c4ebf5234bddd5f3810aff21ea6b5bb7e0
6
+ metadata.gz: 6ddf86402c312aa66d6ca19d40f9fb44f9e37f85937c5d3758af88a9a75b25fa09f8f8eba1c9065b38af5fe4d77bb97d0da9dac85f4a16933d77f599192f8632
7
+ data.tar.gz: 510ec59f73ef0191e6f3766c5c94e30a9d5dccaf1197faa364239cd122f4f9a398484984ed11c9a58bdd9624d64352291a2fb7c61b5464ad62dc1305ba7a5e02
data/CHANGELOG.md CHANGED
@@ -4,6 +4,22 @@ All notable changes to this project will be documented in this file.
4
4
 
5
5
  ## [Unreleased]
6
6
 
7
+ ## [2.8.0] - 2026-10-29
8
+
9
+ ### yes-read-api
10
+
11
+ #### Security
12
+ - `QueriesController` answers `400 Bad Request` (`{ "title": "Bad Request", "detail": ... }`)
13
+ instead of silently ignoring a filter parameter its query does not apply. A basic query (`GET`/`HEAD`)
14
+ applies `filters` only, an advanced query (`POST`) applies `filter_definition` only. Rejected are a `GET`
15
+ or `HEAD` carrying `filter_definition`, a `POST` carrying `filters`, a `POST` without `filter_definition`, and
16
+ a `GET` with a `filter_id` whose stored body has no `filter_definition` (`the stored filter has no
17
+ filter_definition`), since a stored filter runs as an advanced query too.
18
+ Request authorizers commonly decide what to check by which parameter is present, so an ignored parameter could
19
+ be authorized while the query returned rows it never bounded. The check runs for subclass actions too.
20
+ Clients must send `filters` on `GET` and `filter_definition` on `POST`; other parameters (`page`, `order`,
21
+ `include`, `filter_id`, ...) are unaffected. Requests that relied on the ignored parameter now receive `400`.
22
+
7
23
  ## [2.7.0] - 2026-10-29
8
24
 
9
25
  ### yes-core
data/lib/yes/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Yes
4
- VERSION = '2.7.0'
4
+ VERSION = '2.8.0'
5
5
  end
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: 'yes'
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.7.0
4
+ version: 2.8.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Nico Ritsche
@@ -15,56 +15,56 @@ dependencies:
15
15
  requirements:
16
16
  - - '='
17
17
  - !ruby/object:Gem::Version
18
- version: 2.7.0
18
+ version: 2.8.0
19
19
  type: :runtime
20
20
  prerelease: false
21
21
  version_requirements: !ruby/object:Gem::Requirement
22
22
  requirements:
23
23
  - - '='
24
24
  - !ruby/object:Gem::Version
25
- version: 2.7.0
25
+ version: 2.8.0
26
26
  - !ruby/object:Gem::Dependency
27
27
  name: yes-command-api
28
28
  requirement: !ruby/object:Gem::Requirement
29
29
  requirements:
30
30
  - - '='
31
31
  - !ruby/object:Gem::Version
32
- version: 2.7.0
32
+ version: 2.8.0
33
33
  type: :runtime
34
34
  prerelease: false
35
35
  version_requirements: !ruby/object:Gem::Requirement
36
36
  requirements:
37
37
  - - '='
38
38
  - !ruby/object:Gem::Version
39
- version: 2.7.0
39
+ version: 2.8.0
40
40
  - !ruby/object:Gem::Dependency
41
41
  name: yes-core
42
42
  requirement: !ruby/object:Gem::Requirement
43
43
  requirements:
44
44
  - - '='
45
45
  - !ruby/object:Gem::Version
46
- version: 2.7.0
46
+ version: 2.8.0
47
47
  type: :runtime
48
48
  prerelease: false
49
49
  version_requirements: !ruby/object:Gem::Requirement
50
50
  requirements:
51
51
  - - '='
52
52
  - !ruby/object:Gem::Version
53
- version: 2.7.0
53
+ version: 2.8.0
54
54
  - !ruby/object:Gem::Dependency
55
55
  name: yes-read-api
56
56
  requirement: !ruby/object:Gem::Requirement
57
57
  requirements:
58
58
  - - '='
59
59
  - !ruby/object:Gem::Version
60
- version: 2.7.0
60
+ version: 2.8.0
61
61
  type: :runtime
62
62
  prerelease: false
63
63
  version_requirements: !ruby/object:Gem::Requirement
64
64
  requirements:
65
65
  - - '='
66
66
  - !ruby/object:Gem::Version
67
- version: 2.7.0
67
+ version: 2.8.0
68
68
  description: Event sourcing framework for Ruby on Rails applications
69
69
  email:
70
70
  - nico.ritsche@yousty.ch