Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

Security

  • ?filter= can no longer invoke arbitrary model methods. A filter is only honoured when the decorator has explicitly declared it, and its :scope may not point at a method name other than the filter itself. Previously a crafted filter value could call any public model class method (e.g. delete_all).
  • Sort fields must be plain identifiers. In addition to the index-field allowlist, a sort field name must match [a-zA-Z_][a-zA-Z0-9_]* before it reaches the ORDER BY clause.
  • Cap search query length. Queries longer than 1000 characters are rejected with Wallaby::UnprocessableEntity, bounding parser work (DoS hardening).

0.3.3 - 2026-10-03

Changed

  • Require Rails 8.0+ (activerecord) and Ruby 3.3+ (drop EOL Rails 7.1/7.2, Ruby <= 3.2)

[TODO]

  • Refactor Transformer
  • Consider to move the ActiveRecord related documents (.md files) back to this repo.
  • Review the tests, consider to add request specs.

0.3.0.beta2 -

Changed

  • chore: cache pagination total (#39)

0.3.0.beta1 - 2023-09-22

Changed

  • fix: documentation for search syntax related to end-with (#35)
  • fix: broken page when no primary key (#34)
  • chore: Update rubocop to run only on the changed files (#33)
  • chore: documentation by docsify (#31)
  • chore: update test matrix with what Ruby and Rails support (#30)
  • feat: allow nulls option and preload associations for index query (#29)
  • chore: hide foreign and polymorphic keys instead of removing them from field_names (#28)
  • chore: fix new rubocop issues e.g. Layout/IndentationWidth (#27)
  • chore: revert the env step and fix the branch name in gemfiles (#26)
  • chore: add step to echo env (#25)
  • chore: add GITHUB_REF_NAME as well (#24)
  • chore: use GITHUB_BASE_REF for gemfiles (#23)
  • chore: use Github Actions instead (#22)
  • chore: use Wallaby.controller_configuration instead of Wallaby.configuration (#21)
  • chore: use Wallaby.controller_configuration instead of Wallaby.configuration (#21)

Added

  • feat: support NULLS FIRSTLAST (#32)

0.2.7 - 2022-02-03

Changed

  • chore: use wallaby-core 0.2.3

0.2.6 - 2020-04-19

Changed

  • chore: filter out the classes that have invalid class name, e.g. primary::SchemaMigration (#19)
  • fix: make sure index/show/form fields returns empty hash when database or table doesn’t exist (#18)

0.2.5 - 2020-04-12

Changed

  • chore: take out Logger and use the one from wallaby-core and update the documents (#16)
  • feat: change to use native ActiveRecord pagination (#15)
  • chore: update the specs for authorizer changes (#14)

0.2.4 - 2020-03-22

Changed

  • feat: custom logger to provide better information output to the Rails’ log (#11)
  • fix: use and to join the conditions for not in (#10)

0.2.2 - 2020-03-19

Changed

  • fix: nil must be handled differently in a sequence sub query (#9)
  • fix: check database and table’s existence before getting the metadata. (#8)
  • chore: use simplecov 0.17 for codeclimate report (#7)

0.2.1 - 2020-02-17

Changed

  • fix: convert per_page param to integer for will_paginate (#6)

0.2.0 - 2020-02-16

Changed

  • chore: remove kaminari from dependency but make it work with both kaminari and will_paginate (#5)
  • feat: improve querier to allow null, empty string and string matching query (#4)

0.1.0 - 2019-10-01

Added

Extracted code from Wallaby