Release Candidate: 8.0.13

[jamis]

The MongoDB Ruby team is pleased to announce version 8.0.13 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 8.0.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 8.0.13 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '8.0.13'

Have any feedback? Click on through to MongoDB's Jira and open a new ticket to let us know what's on your mind.

Bug Fixes

Bound regular-expression execution time in in-memory queries (MONGOID-5981)

Queries evaluated in memory, such as those against embedded associations, run in the calling thread and can spend an unbounded amount of CPU matching regular expressions. A single in-memory query is now limited by Mongoid.in_memory_regexp_time_limit (default 5.0 seconds); exceeding the limit raises Mongoid::Errors::InMemoryRegexpTimeout.

Resolve nested attribute ids within the caller's association (MONGOID-5992)

An id given in nested attributes is now resolved within the association the attributes are being applied to, rather than falling back to a collection-wide lookup that ignored default scopes. A document that is not part of that association raises Mongoid::Errors::DocumentNotFound, and a request to destroy a document that is not in the association is ignored. The new Mongoid.allow_reparenting_via_nested_attributes option (default false) restores the previous reparenting behavior when set to true.

Reject the string form of where under the query operator guard (MONGOID-5993)

A String passed to #where is sent to MongoDB as a $where expression. This now raises Mongoid::Errors::InvalidQuery when Mongoid.allow_unsafe_query_operators is false (the default); the string form is allowed only when that option is enabled.

Reject JavaScript query operators at any depth (MONGOID-5994)

Mongoid.allow_unsafe_query_operators now defaults to false. When it is false, the $where, $function, and $accumulator operators are rejected anywhere in a query selector. The guard covers every criterion-building method (where, find_by, or, and, nor, not, any_of, none_of, and elem_match, including chained operator overrides) and inspects nested expressions such as {'$expr' => {'$function' => ...}} in full.

Other Bug Fixes

• In-memory queries, such as those executed against embedded associations, now read field names from the query as data rather than dispatching them as method calls on the document (MONGOID-5973)

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in the in-memory field access, regex budgeting, and nested association handling.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Mongoid 8.0.13 hardens in-memory regex evaluation, unsafe query handling, nested attributes, and dynamic field access.

Changes:

• Adds regex budgets and timeout errors.
• Guards unsafe query operators and scopes nested-attribute lookups.
• Updates association behavior, tests, configuration, and release metadata.

File summaries

File	Reviewed changes / findings
spec/mongoid/matcher/regexp_budget_spec.rb	Tests regex budgets and timeout behavior.
spec/mongoid/criteria/queryable/selectable_where_spec.rb	Tests query operator guards.
spec/mongoid/criteria/queryable/selectable_logical_spec.rb	Updates logical query coverage.
spec/mongoid/criteria_spec.rb	Updates query operator coverage.
spec/mongoid/contextual/memory_spec.rb	Tests safe in-memory field reads.
spec/mongoid/contextual/aggregable/memory_spec.rb	Tests safe aggregate access.
spec/mongoid/attributes/nested_spec.rb	Tests nested ID and reparenting behavior.
spec/mongoid/association/referenced/has_many/proxy_spec.rb	Tests bounded association removal.
spec/mongoid/association/referenced/has_and_belongs_to_many/proxy_spec.rb	Tests HABTM behavior.
spec/integration/query_operator_guard_spec.rb	Tests query guards end to end.
spec/integration/matcher_regexp_timeout_spec.rb	Tests regex limits end to end.
spec/integration/matcher_operator_data/regex.yml	Adds regex matching cases.
spec/integration/dots_and_dollars_spec.rb	Updates unsafe-field behavior.
spec/integration/associations/has_and_belongs_to_many_spec.rb	Tests reparenting configuration.
spec/integration/app_spec.rb	Pins JSON compatibility.
product.yml	Updates release metadata.
lib/mongoid/warnings.rb	Adds reparenting warning.
lib/mongoid/version.rb	Sets version 8.0.13.
lib/mongoid/threaded.rb	Adds regex budget storage.
lib/mongoid/matcher/regexp_budget.rb	Implements regex budgets. Moderate (1 vote): preserves neither stricter pattern timeouts nor their cache key. Moderate (1 vote): misses Set traversal. Moderate (1 vote): lacks a final exhaustion check.
lib/mongoid/matcher/regex.rb	Routes regex matching through budgets.
lib/mongoid/matcher/eq_impl_with_regexp.rb	Updates regex equality matching.
lib/mongoid/matcher.rb	Loads regex budgeting.
lib/mongoid/matchable.rb	Budgets document matching.
lib/mongoid/field_readable.rb	Adds safe field lookup.
lib/mongoid/errors/in_memory_regexp_timeout.rb	Adds timeout error class.
lib/mongoid/errors.rb	Loads the new error.
lib/mongoid/criteria/queryable/selectable.rb	Adds operator validation.
lib/mongoid/criteria/queryable/mergeable.rb	Guards chained operator paths.
lib/mongoid/contextual/memory.rb	Applies safe reads and scan budgets. Critical (2 votes): legacy distinct and pluck paths still dispatch methods directly.
lib/mongoid/contextual/aggregable/memory.rb	Uses safe field access for aggregation.
lib/mongoid/config.rb	Adds configuration options. Nit (3 votes): documents none_of coverage although the 8.0 branch lacks that API.
lib/mongoid/association/referenced/has_many/proxy.rb	Bounds conditional removals.
lib/mongoid/association/nested/nested_buildable.rb	Rejects non-scalar IDs.
lib/mongoid/association/nested/many.rb	Scopes nested association resolution. Moderate (1 vote): an absent embedded ID with allowed _destroy raises DocumentNotFound before the destroy check.
lib/mongoid/association/depending.rb	Renames dependency ownership metadata.
lib/config/locales/en.yml	Documents timeout errors.
.evergreen/config/variants.yml.erb	Updates Evergreen variants.
.evergreen/config.yml	Updates generated Evergreen configuration.

Review details

Suppressed comments (4)

lib/mongoid/association/nested/many.rb:184

• For an embedded association, this branch raises before destroyable?(attrs) is evaluated. An allowed _destroy for an id absent from the embedded association therefore raises DocumentNotFound instead of being ignored, contrary to the missing-destroy behavior implemented below and described for this release. Evaluate the destroy case before the embedded-association not-found error.

          elsif association.embedded?
            raise Errors::DocumentNotFound.new(association.klass, id)
          elsif destroyable?(attrs)

lib/mongoid/matcher/regexp_budget.rb:139

• On MRI, this rebuilds every incoming Regexp with only @timeout, so it discards a stricter per-pattern timeout. For example, Regexp.new(..., timeout: 0.01) is allowed to run for the 5-second Mongoid budget when used inside open, even though the code deliberately preserves a stricter global Regexp.timeout above. Preserve the minimum of the pattern, global, and budget limits, and include the pattern timeout in the cache key so cached patterns cannot bypass that constraint.

          ::Regexp.new(regexp.source, regexp.options, timeout: @timeout)

lib/mongoid/matcher/regexp_budget.rb:365

• This traversal only descends through Hash and Array, but Mongoid's query extensions support Set values and leave them as sets during selector expansion. A selector such as { title: { '$in' => Set[/evil/] } } therefore reaches the in-memory matcher without limit_for seeing the regexp, bypassing the new budget. Traverse every supported collection type (at least Set) or normalize the selector before scanning it.

          when Array
            object.any? { |v| contains_regexp?(v) }
          else

lib/mongoid/matcher/regexp_budget.rb:303

• On the per-Regexp-timeout path, this only charges the elapsed time and does not check exhaustion after the final match. If the only match spends the remaining budget compiling the pattern (which this implementation intentionally charges) and then matches quickly, open returns normally and no InMemoryRegexpTimeout is raised even though the limit was exceeded. Check exhaustion after charging or when closing the outer scope, while preserving the already-rescued timeout cause.

          ensure
            budget.charge(Process.clock_gettime(Process::CLOCK_MONOTONIC) - started)
          end

• Files reviewed: 39/39 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.