Open master merge by anuragsarkar97 · Pull Request #8 · apolloio/chewy

anuragsarkar97 · 2023-08-16T07:36:38Z

No description provided.

Updates the requirements on [rubocop](https://github.com/rubocop/rubocop) to permit the latest version. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.63.4...v1.63.5) --- updated-dependencies: - dependency-name: rubocop dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update rubocop requirement from 1.63.5 to 1.64.1 Updates the requirements on [rubocop](https://github.com/rubocop/rubocop) to permit the latest version. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.63.5...v1.64.1) --- updated-dependencies: - dependency-name: rubocop dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Fix rubocop --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Samuel Ebeagu <samuel.ebeagu@toptal.com>

Updates the requirements on [rubocop](https://github.com/rubocop/rubocop) to permit the latest version. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.64.1...v1.65.0) --- updated-dependencies: - dependency-name: rubocop dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Updates the requirements on [rubocop](https://github.com/rubocop/rubocop) to permit the latest version. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.65.0...v1.65.1) --- updated-dependencies: - dependency-name: rubocop dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ES 8.x upgrade * Fix termnite after changes * fixup es * Elastic security on: configuration example * Mass index deletion disabled by default in Elastic * Elastic docker file: increase sleep, bump image * Spec fixes * bump dependency * Bump version, update docs --------- Co-authored-by: Danil Nurgaliev <danil.nurgaliev@toptal.com>

* Fix id conversion issue in delayed_sidekiq strategy Ensure ids extracted from Redis remain strings, preventing UUID issues. Previously, ids were being converted to integers, causing problems with UUIDs in the `delayed_sidekiq` strategy. This update also enhances the test suite: - Existing tests are updated. - A new test ensures the issue is resolved. Due to SQLite's lack of UUID support, a `stub_uuid_model` method is added. This method stubs models with UUIDs, using `SecureRandom.uuid` for the primary key. Move table creations to individual methods. Having every table creation inside a single block casued Rubocop `Metrics/BlockLength` error. To fix it I moved each table creation to an individual method. * Add changelog notes --------- Co-authored-by: Sundus Yousuf <sundus.yousuf@recruitmilitray.com>

orca-security-us

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0 0 0 0	View in Orca
Passed	Secrets	0 0 0 0	View in Orca
Passed	Vulnerabilities	0 0 0 0	View in Orca

kodem-security · 2025-11-21T06:53:26Z

Kodem Security Scan Summary

Status	Check	Issues by Severity	Link
✅ Passed	Open Source Security Report		Link to Check

kodem-security · 2025-11-21T06:53:56Z

Kodem Security Scan Summary

Status	Check	Issues by Severity	Link
✅ Passed	Code Weakness Security Report	🟧 M: 2	Link to Check

Note: Kai marked all findings as likely false positives.

Rails 6.1 and 7.0 have reached EOL, and 7.1 is approaching it. Requiring Rails >= 7.2 and Ruby >= 3.2 aligns with currently supported versions and fixes CI incompatibilities with older combinations.

The pinned 1.65.1 was incompatible with newer rubocop-ast, breaking CI. Bump to latest, target Ruby 3.2, and regenerate the todo file.

sqlite3 ~> 1.4 conflicts with Rails 8.0 (requires >= 2.1). Unpinned unparser pulls versions incompatible with Ruby 3.4 AST.

Bump actions/checkout to v6, run rubocop on Ruby 3.4, add workflow_dispatch for manual CI triggers, and remove the deprecated docker-compose version key.

ActiveRecord returns frozen arrays from pluck/import_fields in newer versions. Use map to build new arrays instead of mutating in place.

Ruby 3.4 changed Hash#inspect to use the new syntax ({key: value} instead of {:key=>value}). Relax the assertions to match substrings or patterns instead of exact inspect output.

@options

* Context drop in parallel import workers is corrected Routine#initialize deleted :context from @options, but IMPORT_WORKER/LEFTOVERS_WORKER rebuild Routine.new(**options) per worker — context was silently dropped when import ran with parallel:. Keep :context in @options so workers receive it. * Rubocop AbcSize on source_for is disabled source_for replaces multiple lvars in the alicorn lambda source, each branch is small and clear — splitting hurts readability. * CHANGELOG entry for #996 is moved to current release section * Import context documentation is added

* Chewy::Index.exists? accepts an optional suffix Lets callers check a specific physical index without manually resolving aliases (e.g. `UsersIndex.exists?('2024')`). * Chewy::Index::Actions specs are split per method * reset! alias swap is atomic Concrete unsuffixed index removal and alias creation now happen in a single update_aliases cluster state update via the remove_index action, closing the race window where a concurrent process could recreate the unsuffixed name between the delete and the alias add.

Re-adds the opt-in `progressbar:` import option and `PROGRESS=1` rake toggle originally added in #787 and reverted in #800. Parallel mode keeps process-based workers; the bar is incremented in the parent process via Parallel's `finish:` callback, avoiding the GVL regression that motivated the revert.

* Deprecated ZRANGEBYSCORE in delayed_sidekiq worker is replaced Redis deprecated ZRANGEBYSCORE in 6.2.0 in favor of ZRANGE ... BYSCORE. Behavior is identical for the inclusive '-inf'..score range used here. Refs #928. * CHANGELOG entry for #1024 is added

@fields

* update_fields: [] is treated as a no-op Empty array means "update zero fields", not "full reindex". Default of update_fields becomes nil (still triggers full reindex), so the public default behavior is unchanged. parent_changed? guards against nil @fields to keep join-field indexes safe on the full-reindex path. Fixes #992. * redis_test service is added to docker-compose Test suite needs Redis at 127.0.0.1:6379 for sidekiq and delayed_sidekiq specs; CI already provisions it via the GHA services block. Local parity removes the connection-refused failures when running bundle exec rspec. * Empty update_fields short-circuit is hoisted in index_entry The no-op guard now runs before cache lookup and data_for, skipping crutch composition for objects the caller asked to leave alone. parent_changed? is already gated on @fields including the join field, so the original branch was unreachable for an empty array.

* import_count on multi-select relations is corrected Bare `.count` on a relation with multiple `.select(...)` clauses generates `SELECT COUNT(col1, col2, ...)`, which is invalid SQL and raises StatementInvalid. The error is rescued upstream, so the progressbar silently falls back to the unbounded spinner. Using `count(:all)` forces `SELECT COUNT(*)` regardless of `select_values`. * Changelog entry for import_count fix is added

Elasticsearch removed the `_type` field from search responses in 8.0 (ES 7 already returned only the placeholder `_doc`), so Chewy's lingering `_type` references no longer matched real responses. The mock response helpers in particular produced fixtures that did not reflect what ES actually returns, which could mislead users writing assertions against them. This removes `_type` from: - `Chewy::Minitest::Helpers` and `Chewy::Rspec::Helpers` mock responses - `Chewy::Search::Request::EVERFIELDS` (also drops the long-obsolete `_parent` entry) and the `pluck` documentation - `Chewy::Index::Wrapper` generated accessors - the README response example and associated specs It also documents the mock-helper assertion change in the Chewy 7 / ES 7 to Chewy 8 / ES 8 migration guide section. This is a behavioral no-op against ES 8+/9 clusters (none return `_type`); it simply aligns the code and test fixtures with actual Elasticsearch responses.

Rename the private `Chewy::Index::Witchcraft::Cauldron#exctract_lambdas` helper to the correct `extract_lambdas`. Internal-only rename of a private method; no public API or behavior change.

* Compiled compose path is the default for every index Generates one __chewy_compose__ method per index from the field tree on first import and reuses it for every object, replacing the iterative Fields::Root#compose loop for 3-4x faster composition with no extra dependencies. update_fields: imports stay on the fast path via per-fields-set memoized methods; ignore_blank, geo_point, custom root procs, and non-identifier field names fall back transparently. * Chewy::Index.witchcraft! is deprecated The compiled compose path now delivers equivalent throughput without method_source/parser/prism/unparser. Calling witchcraft! prints a deprecation warning, and those requires are now lazy so apps that don't use it avoid ~24 MiB of boot-time allocations and ~1 MiB retained (#644). * Docs cover the compiled compose path and witchcraft deprecation * benchmark directory is ignored * Rubocop offenses in the compiled compose path are fixed Style/SymbolProc is disabled inline on the arity-test lambdas rather than rewritten to &:sym — the explicit (o) arity is what those specs exercise, and a symbol proc would change the parameter count the compiler dispatches on.

scroll_batches captured the _scroll_id only inside the per-batch loop, so a scope returning zero hits — which still opens a scroll context on the initial scroll request — never reached clear_scroll and leaked the context until its keepalive expired. Capturing the _scroll_id from the initial result clears it regardless of how many batches are iterated. This was a notable contributor to exhausting the cluster-wide search.max_open_scroll_context limit under load.

The per-thread Chewy.client keeps its connections open until the GC reclaims the dead thread's client, leaking file descriptors in long-lived multi-threaded processes (e.g. Sidekiq, which churns threads). Neither elasticsearch-ruby nor elastic-transport expose a way to close connections, so close them via Faraday and drop the thread-local. Refs #951.

Sidekiq 7+ yields a redis-client-backed client with no `#eval`; the keyword `eval(script, keys:, argv:)` form forwarded the keys array as a nested argument, which redis-client rejects. The scripts now run via EVALSHA through a shared helper, the one form both redis-rb and redis-client expand to flat arguments.

* Add bundler cooldown of 7 days Configure a bundler cooldown of 7 days on the rubygems.org source. This delays installing gem versions that were published within the last 7 days, giving newly released versions time to be vetted by the community before they are pulled into this project. The cooldown reduces exposure to malicious or broken releases that are typically caught and yanked shortly after publication. Reference: https://blog.rubygems.org/2026/06/03/cooldown-let-new-gems-be-vetted.html * Add bundler cooldown to appraisal gemfiles The gemfiles/rails.*.activerecord.gemfile files are standalone Bundler entrypoints used by the CI matrix; each has its own rubygems source, so they need cooldown: 7 too — the root Gemfile's source does not apply when these are selected via BUNDLE_GEMFILE.

* Duplicate sidekiq gem entry is removed Declared in both Gemfile and gemfiles/base.gemfile, triggering Bundler's "listed more than once" warning. * Explicit nil check in bulk builder field guard, rather than safe navigation * v8.4.0 is released

…are corrected (#1043) * Symbol#to_proc field values on the compiled compose path are corrected The compiled path forwarded crutches/context as extra positional args to every non-zero-arity proc. A proc(&:method) then passed them to the method, raising ArgumentError. Splat-declaring procs are now called with the object alone, matching the plain compose path. * Version 8.4.1 is released

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* cooldown added to dependabot * Reviewers field from dependabot is removed it is deprecated

Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1 to 1.316.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1...v1.316.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.316.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Remove unused rexml and rspec_junit_formatter dev deps Both gems were auto-required via Bundler.require but never referenced in lib or spec. rspec_junit_formatter's JUnit output is not invoked by CI. Dropping them trims the dev/test dependency surface. * Remove guard and guard-rspec local file-watch runner guard/guard-rspec is a heavyweight local-only file-watch test runner that CI never invokes. The Guardfile was stock generator boilerplate with Rails and Capybara watchers irrelevant to this gem. Removing both gems and the Guardfile. * Timecop is replaced with ActiveSupport::Testing::TimeHelpers ActiveSupport is already a hard runtime dependency, so its TimeHelpers remove the need for the timecop dev dependency. travel_to/freeze_time truncate sub-second precision by default, so with_usec: true is passed where specs assert against fractional-second timestamps. TimeHelpers also forbids nesting a block-form time-travel inside an active stub, so the nested delayed_sidekiq/scheduler cases are rewritten to sequential non-block travel calls with explicit restore of the outer time.

Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.316.0 to 1.319.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@v1.316.0...v1.319.0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.319.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Tags like v7 are movable pointers: whoever controls the action can re-point them and the next run executes unreviewed code with the job token. Pinning to the commit SHA freezes what runs. Versions stay as comments, so Dependabot keeps bumping them like it already does.

Scans the workflows on each push to master and on pull requests, and fails when something regresses: an unpinned action, an archived dependency, a known CVE, a dangerous trigger. The config starts from the generated defaults and is scoped to this repo, the few controls that are off carry a note explaining why. Each run publishes the score to score.getplumber.io, shown as a badge in the README.

Bumps [ruby/setup-ruby](https://github.com/ruby/setup-ruby) from 1.319.0 to 1.321.0. - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@003a5c4...95ef2b0) --- updated-dependencies: - dependency-name: ruby/setup-ruby dependency-version: 1.321.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Alfonso Uceda <alfonso.uceda@toptal.com>

The pinned version predates the CLI's built-in default configuration, and the local .plumber.yaml it required disabled the branch protection control, which kept the score badge stuck on UNKNOWN instead of publishing a grade. Current releases ship a curated default configuration when no config file is present, and the repo now passes it fully: every control including branch protection evaluates green on master, so the file and its exceptions can go. New controls added by future releases apply automatically. The gate is set to 85 points so a single small finding does not block PRs.

dependabot Bot and others added 11 commits May 23, 2024 14:52

Rename team (#957)

2d6a3f5

Bump chewy version to 8.0.0-beta (#963)

d2c38f7

Assign dependabot PR's to sre (#966)

5193d28

Adding Ruby 3.3 and Rails 7.2 to CI matrix (#967)

17597e6

updating ruby and active record versions based on test suite (#968)

21c5407

akshay-apollo force-pushed the master branch from f2dace4 to 2b97a59 Compare November 22, 2024 19:45

tylerwillingham added 3 commits November 21, 2025 08:52

Add Ruby 3.4 to CI matrix

7b09b20

Add Rails 8.0 to CI matrix

8d8c778

Remove EOL Ruby versions 3.0 and 3.1 from CI matrix

6b202d5

orca-security-us Bot reviewed Nov 21, 2025

View reviewed changes

bbatsov added 12 commits November 21, 2025 08:58

Update codeowners

18132fe

[Fix #980] Remove mention of journal_name from the docs

c4624f0

Tweak some wording

767c850

Bump the copyright years

e55bfc1

Bump the copyright years

fde2fdc

Drop support for Rails <= 7.1

be79f8f

Rails 6.1 and 7.0 have reached EOL, and 7.1 is approaching it. Requiring Rails >= 7.2 and Ruby >= 3.2 aligns with currently supported versions and fixes CI incompatibilities with older combinations.

Update RuboCop to 1.84.2 and regenerate todo

23b5721

The pinned 1.65.1 was incompatible with newer rubocop-ast, breaking CI. Bump to latest, target Ruby 3.2, and regenerate the todo file.

Update sqlite3 to ~> 2.1 and pin unparser to ~> 0.6.15

eb591ec

sqlite3 ~> 1.4 conflicts with Rails 8.0 (requires >= 2.1). Unpinned unparser pulls versions incompatible with Ruby 3.4 AST.

Modernize GitHub Actions and docker-compose setup

b25cfc0

Bump actions/checkout to v6, run rubocop on Ruby 3.4, add workflow_dispatch for manual CI triggers, and remove the deprecated docker-compose version key.

Fix FrozenError in Syncer when mutating frozen arrays

cd5fd71

ActiveRecord returns frozen arrays from pluck/import_fields in newer versions. Use map to build new arrays instead of mutating in place.

Fix specs broken by Ruby 3.4 Hash#inspect format change

ca10cc7

Ruby 3.4 changed Hash#inspect to use the new syntax ({key: value} instead of {:key=>value}). Relax the assertions to match substrings or patterns instead of exact inspect output.

Update README compatibility to reflect current Ruby/Rails support

010e129

AlfonsoUceda and others added 30 commits May 28, 2026 14:09

v8.1.0 is released (#1019)

6f49e72

v8.2.0 is released (#1025)

11728e5

v8.2.1 is released (#1027)

599305f

Fix misspelled extract_lambdas in Witchcraft (#1030)

e4ef3f6

Rename the private `Chewy::Index::Witchcraft::Cauldron#exctract_lambdas` helper to the correct `extract_lambdas`. Internal-only rename of a private method; no public API or behavior change.

v8.3.0 is released (#1033)

3376c21

Gemfiles are simplified (#1035)

83e71a6

v8.3.1 is released (#1038)

ca4f6f5

v8.4.0 is released (#1040)

9029b5b

* Duplicate sidekiq gem entry is removed Declared in both Gemfile and gemfiles/base.gemfile, triggering Bundler's "listed more than once" warning. * Explicit nil check in bulk builder field guard, rather than safe navigation * v8.4.0 is released

Update dependabot (#1046)

2dbc54e

* cooldown added to dependabot * Reviewers field from dependabot is removed it is deprecated

Navigation Menu

Uh oh!

Open master merge - #8

Open master merge#8
anuragsarkar97 wants to merge 89 commits into
apolloio:masterfrom
toptal:master

anuragsarkar97 commented Aug 16, 2023

Uh oh!

orca-security-us Bot left a comment •

edited

Loading

Uh oh!

kodem-security Bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

kodem-security Bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

17 participants

Uh oh!

Conversation

anuragsarkar97 commented Aug 16, 2023

Uh oh!

orca-security-us Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Orca Security Scan Summary

Uh oh!

kodem-security Bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kodem Security Scan Summary

Uh oh!

kodem-security Bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Kodem Security Scan Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

17 participants

orca-security-us Bot left a comment •

edited

Loading

kodem-security Bot commented Nov 21, 2025 •

edited

Loading

kodem-security Bot commented Nov 21, 2025 •

edited

Loading