Release Candidate: 7.6.2

[jamis]

The MongoDB Ruby team is pleased to announce version 7.6.2 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 7.6.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 7.6.2 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '7.6.2'

Have any feedback? Click on through to MongoDB's Jira and open a new ticket to let us know what's on your mind.

🔴 End-Of-Life Notice

After December 31, 2026, this 7.x series will no longer be supported. It will no longer receive any maintenance or security updates. If you are still running on Mongoid 7.x or earlier, please upgrade.

Bug Fixes

Bound regular-expression execution time in in-memory queries (MONGOID-5981)

Queries evaluated in memory, such as those against embedded associations, run in the calling thread and can spend an unbounded amount of CPU matching regular expressions. A single in-memory query is now limited by Mongoid.in_memory_regexp_time_limit (default 5.0 seconds); exceeding the limit raises Mongoid::Errors::InMemoryRegexpTimeout.

Resolve nested attribute ids within the caller's association (MONGOID-5992)

An id given in nested attributes is now resolved within the association the attributes are being applied to, rather than falling back to a collection-wide lookup that ignored default scopes. A document that is not part of that association raises Mongoid::Errors::DocumentNotFound, and a request to destroy a document that is not in the association is ignored. The new Mongoid.allow_reparenting_via_nested_attributes option (default false) restores the previous reparenting behavior when set to true.

Reject the string form of where under the query operator guard (MONGOID-5993)

A String passed to #where is sent to MongoDB as a $where expression. This now raises Mongoid::Errors::InvalidQuery when Mongoid.allow_unsafe_query_operators is false (the default); the string form is allowed only when that option is enabled.

Reject JavaScript query operators at any depth (MONGOID-5994)

Mongoid.allow_unsafe_query_operators now defaults to false. When it is false, the $where, $function, and $accumulator operators are rejected anywhere in a query selector. The guard covers every criterion-building method (where, find_by, or, and, nor, not, any_of, none_of, and elem_match) and inspects nested expressions such as {'$expr' => {'$function' => ...}} in full.

Other Bug Fixes

• In-memory queries, such as those executed against embedded associations, now read field names from the query as data rather than dispatching them as method calls on the document (MONGOID-5973)

[Copilot]

🟡 Changes recommended

Critical query-validation, regexp-budget, and unsafe field-access issues remain unresolved, along with lost CI coverage.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Release candidate for Mongoid 7.6.2, adding regexp limits, query-operator safeguards, safer in-memory access, and nested-attribute handling.

Changes:

• Adds cumulative in-memory regexp budgets and timeout errors.
• Rejects unsafe JavaScript query operators by default.
• Restricts nested-attribute reparenting and improves field access safety.
• Updates release metadata, tests, fixtures, and Evergreen configuration.

File summaries

File	Reviewed change
spec/mongoid/matcher/regexp_budget_spec.rb	Regexp budget coverage.
spec/mongoid/criteria/queryable/selectable_where_spec.rb	Query guard coverage.
spec/mongoid/criteria/queryable/selectable_logical_spec.rb	Logical query and string-query updates.
spec/mongoid/criteria_spec.rb	Criteria compatibility coverage.
spec/mongoid/contextual/memory_spec.rb	Safe in-memory field access coverage.
spec/mongoid/contextual/aggregable/memory_spec.rb	Safe aggregation coverage.
spec/mongoid/attributes/nested_spec.rb	Nested-attribute behavior coverage.
spec/mongoid/association/referenced/has_many/proxy_spec.rb	Association removal coverage.
spec/mongoid/association/referenced/has_and_belongs_to_many/proxy_spec.rb	HABTM removal coverage.
spec/integration/query_operator_guard_spec.rb	Query-operator guard integration coverage.
spec/integration/matcher_regexp_timeout_spec.rb	Regexp timeout integration coverage.
spec/integration/matcher_operator_data/regex.yml	Regexp matcher fixtures.
spec/integration/app_spec.rb	JSON dependency compatibility.
product.yml	Product release metadata.
lib/mongoid/warnings.rb	Reparenting warning.
lib/mongoid/version.rb	Version 7.6.2 metadata.
lib/mongoid/threaded.rb	Moderate (2 votes): regexp budget thread-local key is not namespaced.
lib/mongoid/matcher/regexp_budget.rb	Critical (2 votes): caller regexp timeouts are not preserved. Moderate (2 votes): the budget is not checked after the final charge.
lib/mongoid/matcher/regex.rb	Budgeted regexp matching.
lib/mongoid/matcher/eq_impl_with_regexp.rb	Budgeted regexp equality matching.
lib/mongoid/matcher.rb	Matcher loading.
lib/mongoid/matchable.rb	Budgeted document matching.
lib/mongoid/field_readable.rb	Safe field resolution.
lib/mongoid/errors/in_memory_regexp_timeout.rb	In-memory regexp timeout error.
lib/mongoid/errors.rb	Error loading.
lib/mongoid/criteria/queryable/selectable.rb	Critical (3 votes): multi-criteria any_of can bypass unsafe-operator validation. Moderate (1 vote): string where changes the expected embedded-query error.
lib/mongoid/criteria/queryable/mergeable.rb	Query validation integration.
lib/mongoid/contextual/memory.rb	Critical (1 vote): the default legacy pluck path can still dispatch methods such as destroy.
lib/mongoid/contextual/aggregable/memory.rb	Safe aggregation reads.
lib/mongoid/config.rb	Nit (1 vote): documents unavailable none_of coverage. Nit (1 vote): Ruby-version wording misstates JRuby timeout behavior.
lib/mongoid/association/referenced/has_many/proxy.rb	Bounded association removal.
lib/mongoid/association/nested/nested_buildable.rb	Scalar nested ID validation.
lib/mongoid/association/nested/many.rb	Moderate (1 vote): absent embedded IDs with _destroy can raise instead of being ignored.
lib/mongoid/association/depending.rb	Dependency owner attribute handling.
lib/config/locales/en.yml	Timeout messages.
.evergreen/config/variants.yml.erb	Moderate (3 votes): disabled matrices remove active application-test variants.
.evergreen/config.yml	Moderate (2 votes): disabled matrices remove active application-test variants.

Review details

Suppressed comments (5)

lib/mongoid/association/nested/many.rb:185

• Because the association.embedded? branch runs before destroyable?, nested attributes containing _destroy for an id that is absent from an embedded association raise DocumentNotFound instead of being ignored. The referenced-association branch below already implements the documented ignore behavior; test this case and handle destroyable? before the embedded-association not-found branch.

          elsif association.embedded?
            raise Errors::DocumentNotFound.new(association.klass, id)
          elsif destroyable?(attrs)
            # A destroy of a document that is not in the association is
            # ignored, rather than reaching for it outside the association.

lib/mongoid/config.rb:151

• none_of is not defined in this 7.6 branch—the new spec notes that it is unavailable at spec/mongoid/criteria/queryable/selectable_where_spec.rb:720—so this documentation promises coverage for an API callers cannot invoke. Remove it from this list or add the API before documenting it.

    # +where+, +find_by+, +and+, +or+, +nor+, +not+, +any_of+, and +none_of+.

lib/mongoid/config.rb:136

• PER_REGEXP_TIMEOUT is deliberately false for JRuby even when it reports Ruby 3.4, so this 'Ruby 3.2 and later' description is false there: the implementation uses the whole-scope Timeout wall-clock fallback. Document the engine capability instead so JRuby users know what the limit covers.

    # Set to nil to remove the limit. On Ruby 3.2 and later the remaining
    # budget is compiled into the pattern, so the limit counts only the time
    # spent matching. Earlier Rubies have no per-Regexp timeout, so the query
    # is bounded with Timeout instead and the limit is wall clock over the
    # whole in-memory evaluation.

lib/mongoid/criteria/queryable/selectable.rb:906

• The guard also misses public selector-building paths that do not use _mongoid_expand_keys: geo_spatial writes through __merge__, and max_distance writes through __add__/with_strategy. In strict mode, for example, Band.geo_spatial('$where' => js) can still add a server-side JavaScript operator; validate these paths or move the check to a common selector write point.

        # It deliberately does not cover the APIs that ask for JavaScript
        # outright, such as #js_query and Criteria#for_js: there the developer
        # has chosen server-side JavaScript, so there is nothing to guard
        # against. The same goes for the low-level Storable methods
        # (#add_field_expression, #add_operator_expression), which write to the
        # selector directly.

lib/mongoid/criteria/queryable/selectable.rb:820

• This guard now rejects string where criteria while they are being built, so match.records.where("this.name == null") raises Mongoid::Errors::InvalidQuery before the embedded matcher can raise its existing UnsupportedJavascript. The unchanged example at spec/mongoid/criteria_spec.rb:3690-3694 will fail; update that expectation/configuration (or preserve the old embedded-specific error) as part of this change.

              unless Mongoid.allow_unsafe_query_operators?
                raise Errors::InvalidQuery,
                      "String criteria are not allowed because they compile to the '$where' operator, " \
                      'which is not allowed in a query expression. Set Mongoid.allow_unsafe_query_operators = true ' \
                      'to permit all operators.'

• Files reviewed: 39/39 changed files
• Comments generated: 7
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.