Release Candidate: 8.1.13

[jamis]

The MongoDB Ruby team is pleased to announce version 8.1.13 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 8.1.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 8.1.13 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '8.1.13'

Have any feedback? Click on through to MongoDB's Jira and open a new ticket to let us know what's on your mind.

Bug Fixes

Bound regular-expression execution time in in-memory queries (MONGOID-5981)

Queries evaluated in memory, such as those against embedded associations, run in the calling thread and can spend an unbounded amount of CPU matching regular expressions. A single in-memory query is now limited by Mongoid.in_memory_regexp_time_limit (default 5.0 seconds); exceeding the limit raises Mongoid::Errors::InMemoryRegexpTimeout.

Resolve nested attribute ids within the caller's association (MONGOID-5992)

An id given in nested attributes is now resolved within the association the attributes are being applied to, rather than falling back to a collection-wide lookup that ignored default scopes. A document that is not part of that association raises Mongoid::Errors::DocumentNotFound, and a request to destroy a document that is not in the association is ignored. The new Mongoid.allow_reparenting_via_nested_attributes option (default false) restores the previous reparenting behavior when set to true.

Reject the string form of where under the query operator guard (MONGOID-5993)

A String passed to #where is sent to MongoDB as a $where expression. This now raises Mongoid::Errors::InvalidQuery when Mongoid.allow_unsafe_query_operators is false (the default); the string form is allowed only when that option is enabled.

Reject JavaScript query operators at any depth (MONGOID-5994)

Mongoid.allow_unsafe_query_operators now defaults to false. When it is false, the $where, $function, and $accumulator operators are rejected anywhere in a query selector. The guard covers every criterion-building method (where, find_by, or, and, nor, not, any_of, none_of, and elem_match, including chained operator overrides) and inspects nested expressions such as {'$expr' => {'$function' => ...}} in full.

Other Bug Fixes

• In-memory queries, such as those executed against embedded associations, now read field names from the query as data rather than dispatching them as method calls on the document (MONGOID-5973)

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in query validation, legacy field access, regexp budgeting, and nested-association handling.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Release candidate for Mongoid 8.1.13, adding safeguards for in-memory matching, query operators, nested attributes, and field access.

Changes:

• Adds cumulative regexp timeouts and safer in-memory field reads.
• Restricts unsafe query operators by default.
• Scopes nested-attribute resolution to associations and updates release metadata.

File summaries

File	Summary
spec/mongoid/matcher/regexp_budget_spec.rb	Regexp budget coverage
spec/mongoid/criteria/queryable/selectable_where_spec.rb	String-query guard coverage
spec/mongoid/criteria/queryable/selectable_logical_spec.rb	Logical operator guard coverage
spec/mongoid/criteria_spec.rb	Criteria query coverage
spec/mongoid/contextual/memory_spec.rb	Safe in-memory field access
spec/mongoid/contextual/aggregable/memory_spec.rb	Safe aggregation access
spec/mongoid/attributes/nested_spec.rb	Nested attribute behavior
spec/mongoid/association/referenced/has_many/proxy_spec.rb	Association removal behavior
spec/mongoid/association/referenced/has_and_belongs_to_many/proxy_spec.rb	HABTM removal behavior
spec/integration/query_operator_guard_spec.rb	Query operator guard integration tests
spec/integration/matcher_regexp_timeout_spec.rb	Regexp timeout integration tests
spec/integration/matcher_operator_data/regex.yml	Regex matcher fixtures
spec/integration/dots_and_dollars_spec.rb	Dollar-field compatibility
spec/integration/associations/has_and_belongs_to_many_spec.rb	Reparenting behavior
spec/integration/app_spec.rb	JSON compatibility
product.yml	Release metadata
lib/mongoid/warnings.rb	Reparenting warning
lib/mongoid/version.rb	Version 8.1.13
lib/mongoid/threaded.rb	Regexp budget thread state
lib/mongoid/matcher/regexp_budget.rb	Regexp budget implementation
lib/mongoid/matcher/regex.rb	Budgeted regex matching
lib/mongoid/matcher/eq_impl_with_regexp.rb	Regexp equality matching
lib/mongoid/matcher.rb	Matcher integration
lib/mongoid/matchable.rb	Matching budget integration
lib/mongoid/field_readable.rb	Data-only field reads
lib/mongoid/errors/in_memory_regexp_timeout.rb	Timeout exception
lib/mongoid/errors.rb	Error registration
lib/mongoid/criteria/queryable/selectable.rb	Query operator validation
lib/mongoid/criteria/queryable/mergeable.rb	Chained operator guards
lib/mongoid/contextual/memory.rb	In-memory matching and reads
lib/mongoid/contextual/aggregable/memory.rb	Safe aggregation reads
lib/mongoid/config.rb	New configuration options
lib/mongoid/association/referenced/has_many/proxy.rb	Bounded association removal
lib/mongoid/association/nested/nested_buildable.rb	Nested ID validation
lib/mongoid/association/nested/many.rb	Association-scoped nested IDs
lib/mongoid/association/depending.rb	Dependency owner naming
lib/config/locales/en.yml	Timeout messages

Review details

Suppressed comments (4)

lib/mongoid/association/nested/many.rb:221

• For a referenced has_many with a custom primary_key, the association membership query uses base.send(primary_key) (see has_many.rb:113-115), but this error reports parent.id. The new DocumentNotFound params therefore identify the wrong parent key—for example, _id instead of parent.p; use the association's configured primary key value.

            { _id: id, association.foreign_key => parent.id }

lib/mongoid/association/nested/many.rb:186

• This branch runs before destroyable?, so an _destroy request for an id absent from an embedded many association raises DocumentNotFound instead of being ignored. Move the missing-association destroy check ahead of the embedded not-found check to keep the documented behavior consistent for embedded and referenced associations.

          elsif association.embedded?
            raise Errors::DocumentNotFound.new(association.klass, id)
          elsif destroyable?(attrs)
            # A destroy of a document that is not in the association is
            # ignored, rather than reaching for it outside the association.

lib/mongoid/config.rb:229

• The behavior described here is not true for all Ruby 3.2+ implementations: RegexpBudget::PER_REGEXP_TIMEOUT is enabled only for MRI, while the code explicitly uses the Timeout fallback on JRuby even when it reports Ruby 3.4. Please document this as MRI 3.2+ (or otherwise mention the engine capability) so users know the configured limit may cover wall-clock evaluation on JRuby.

    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
    # budget is compiled into the pattern, so the limit counts only the time
    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
    # is bounded with Timeout instead and the limit is wall clock over the
    # whole in-memory evaluation.

lib/mongoid/matcher/regexp_budget.rb:139

• Rebuilding an application-supplied Regexp here discards its per-pattern timeout and replaces it with the Mongoid budget/global timeout. Thus a caller that set a stricter timeout on the condition is silently less protected whenever a budget is open, unlike the global-timeout behavior tested in this PR. Preserve the smaller per-pattern timeout (and include it in the cache key so equal source/options with different timeouts are not conflated).

          ::Regexp.new(regexp.source, regexp.options, timeout: @timeout)

• Files reviewed: 37/37 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.