Merge 8.1.x into 9.0.x

.github/workflows/gradle.yml

@@ -371,6 +371,9 @@ jobs:
           include-hidden-files: true
           path: grails-forge/tmp1/cli/**/*
           if-no-files-found: 'error'
+  # Every test job from here through neo4jFunctional sets timeout-minutes to twice the slowest run that
+  # finished on its own, passed or failed, over the 160 CI runs of 2026-09-03 to 2026-09-13, rounded up to
+  # the half hour. Without a limit, a test JVM that never exits holds its job for GitHub's six-hour default.
   functional:
     name: "Functional Tests (${{ matrix.job_name }})"
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
@@ -527,6 +530,7 @@ jobs:
   security:
     name: "Spring Security Tests (${{ matrix.job_name }})"
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
+    timeout-minutes: 150 # slowest run: 71 min
     strategy:
       fail-fast: false
       matrix:
@@ -572,6 +576,7 @@ jobs:
   securityConfig:
     name: "Spring Security Config Functional Tests"
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
+    timeout-minutes: 90 # slowest run: 39 min
     strategy:
       fail-fast: false
       matrix:
@@ -611,6 +616,7 @@ jobs:
   casSecurityConfig:
     name: "Spring Security CAS Functional Tests"
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
+    timeout-minutes: 90 # slowest run: 35 min
     strategy:
       fail-fast: false
       matrix:
@@ -652,6 +658,7 @@ jobs:
   redis:
     name: "Redis Tests"
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
+    timeout-minutes: 180 # slowest run: 86 min
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
@@ -687,6 +694,7 @@ jobs:
   mongodbFunctional:
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
     name: "Mongodb Functional Tests (Java ${{ matrix.java }}, MongoDB ${{ matrix.mongodb-version }}, indy=${{ matrix.indy }})"
+    timeout-minutes: 150 # slowest run: 70 min
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
@@ -750,6 +758,7 @@ jobs:
   hibernate5Functional:
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
     name: "Hibernate5 Functional Tests (Java ${{ matrix.java }}, indy=${{ matrix.indy }})"
+    timeout-minutes: 120 # slowest run: 58 min
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
@@ -799,6 +808,7 @@ jobs:
   hibernate7Functional:
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
     name: "Hibernate7 Functional Tests (${{ matrix.job_name }})"
+    timeout-minutes: 210 # slowest run: 104 min, which failed; the slowest that passed took 86
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
@@ -869,6 +879,7 @@ jobs:
   neo4jFunctional:
     if: ${{ !contains(github.event.head_commit.message, '[skip tests]') }}
     name: "Neo4j Functional Tests (Java ${{ matrix.java }}, indy=${{ matrix.indy }})"
+    timeout-minutes: 180 # slowest run: 90 min
     runs-on: ubuntu-24.04
     timeout-minutes: 105
     strategy:

gradle/hibernate5-test-config.gradle

@@ -40,6 +40,7 @@ tasks.withType(Test).configureEach {
                 'onlyHibernate7Tests',
                 'skipHibernate5Tests',
                 'onlyMongodbTests',
+                'onlyNeo4jTests',
                 'onlyRedisTests',
                 'onlySpringSecurityTests',
                 'onlyCoreTests',

gradle/hibernate7-test-config.gradle

@@ -34,6 +34,7 @@ tasks.withType(Test).configureEach {
                 'onlyHibernate5Tests',
                 'skipHibernate7Tests',
                 'onlyMongodbTests',
+                'onlyNeo4jTests',
                 'onlyRedisTests',
                 'onlySpringSecurityTests',
                 'onlyCoreTests',

gradle/mongodb-test-config.gradle

@@ -44,6 +44,7 @@ tasks.withType(Test).configureEach {
                 'onlyHibernate5Tests',
                 'onlyHibernate7Tests',
                 'skipMongodbTests',
+                'onlyNeo4jTests',
                 'onlyRedisTests',
                 'onlySpringSecurityTests',
                 'onlyCoreTests',

gradle/redis-test-config.gradle

@@ -30,6 +30,7 @@ tasks.withType(Test).configureEach {
                 'onlyHibernate5Tests',
                 'onlyHibernate7Tests',
                 'onlyMongodbTests',
+                'onlyNeo4jTests',
                 'onlySpringSecurityTests',
                 'onlyCoreTests',
                 'skipTests'

gradle/spring-security-test-config.gradle

@@ -30,6 +30,7 @@ tasks.withType(Test).configureEach {
                 'onlyHibernate5Tests',
                 'onlyHibernate7Tests',
                 'onlyMongodbTests',
+                'onlyNeo4jTests',
                 'onlyRedisTests',
                 'onlyCoreTests',
                 'skipTests'

grails-data-graphql/core/src/main/groovy/org/grails/gorm/graphql/Schema.groovy

@@ -381,7 +381,7 @@ class Schema {
                     DataFetcher countFetcher = dataFetcherManager.getReadingFetcher(entity, COUNT).orElse(new CountEntityDataFetcher(entity))
 
                     final String countFieldName = namingConvention.getCount(entity)
-                    final GraphQLOutputType countOutputType = (GraphQLOutputType) typeManager.getType(Integer)
+                    final GraphQLOutputType countOutputType = (GraphQLOutputType) typeManager.getType(Long)
 
                     GraphQLFieldDefinition.Builder queryCount = newFieldDefinition()
                             .name(countFieldName)

grails-data-graphql/core/src/main/groovy/org/grails/gorm/graphql/fetcher/impl/CountEntityDataFetcher.groovy

@@ -34,15 +34,15 @@ import org.grails.gorm.graphql.fetcher.ReadingGormDataFetcher
  */
 @CompileStatic
 @InheritConstructors
-class CountEntityDataFetcher extends DefaultGormDataFetcher<Integer> implements ReadingGormDataFetcher<Integer> {
+class CountEntityDataFetcher extends DefaultGormDataFetcher<Long> implements ReadingGormDataFetcher<Long> {
 
-    protected Integer queryCount() {
+    protected Long queryCount() {
         staticApi.count()
     }
 
     @Override
-    Integer get(DataFetchingEnvironment environment) {
-        (Integer) withTransaction(true) {
+    Long get(DataFetchingEnvironment environment) {
+        (Long) withTransaction(true) {
             queryCount()
         }
     }

grails-data-graphql/core/src/test/groovy/org/grails/gorm/graphql/SchemaSpec.groovy

@@ -19,6 +19,7 @@
 
 package org.grails.gorm.graphql
 
+import graphql.scalars.ExtendedScalars
 import graphql.schema.*
 import org.grails.datastore.mapping.config.Settings
 import org.grails.datastore.mapping.core.DatastoreUtils
@@ -67,6 +68,15 @@ class SchemaSpec extends Specification implements GraphQLSchemaSpec {
         prefix + normalizeType(type)
     }
 
+    void "count query fields use the 64-bit Long scalar"() {
+        given:
+        List<GraphQLFieldDefinition> countFields = queryType.fieldDefinitions.findAll { it.name.endsWith('Count') }
+
+        expect: 'the schema matches what count() returns, and the Long totalCount already in paged results'
+        !countFields.isEmpty()
+        countFields.every { it.type == ExtendedScalars.GraphQLLong }
+    }
+
     void "test ComplexOperation"() {
         given:
         GraphQLObjectType type = schema.getType('AwesomeType')

grails-data-hibernate5/core/src/main/groovy/org/grails/orm/hibernate/AbstractHibernateGormStaticApi.groovy

@@ -196,8 +196,8 @@ abstract class AbstractHibernateGormStaticApi<D> extends GormStaticApi<D> {
     }
 
     @Override
-    Integer count() {
-        (Integer) hibernateTemplate.execute({ Session session ->
+    Long count() {
+        (Long) hibernateTemplate.execute({ Session session ->
             CriteriaBuilder criteriaBuilder = session.getCriteriaBuilder()
             CriteriaQuery<Long> criteriaQuery = criteriaBuilder.createQuery(Long)
             criteriaQuery.select(criteriaBuilder.count(criteriaQuery.from(persistentEntity.javaClass)))
@@ -211,7 +211,7 @@ abstract class AbstractHibernateGormStaticApi<D> extends GormStaticApi<D> {
             }
             hibernateTemplate.applySettings(criteria)
             def result = hibernateHqlQuery.singleResult()
-            Number num = result == null ? 0 : (Number)result
+            Number num = result == null ? 0L : (Number)result
             return num
         })
     }

grails-data-hibernate7/core/src/main/groovy/org/grails/orm/hibernate/HibernateGormStaticApi.groovy

@@ -231,9 +231,9 @@ class HibernateGormStaticApi<D> extends GormStaticApi<D> {
     }
 
     @Override
-    Integer count() {
+    Long count() {
         String entity = persistentEntity.name
-        doSingleInternal("select count(*) from $entity" as String, [:], [], [:], false) as Integer
+        doSingleInternal("select count(*) from $entity" as String, [:], [], [:], false) as Long
     }
 
     @Override

grails-data-mongodb/bson/src/main/groovy/org/grails/datastore/bson/codecs/encoders/BasicCollectionTypeEncoder.groovy

@@ -29,7 +29,6 @@ import org.bson.conversions.Bson
 
 import org.grails.datastore.bson.codecs.PropertyEncoder
 import org.grails.datastore.mapping.dirty.checking.DirtyCheckable
-import org.grails.datastore.mapping.dirty.checking.DirtyCheckingMap
 import org.grails.datastore.mapping.dirty.checking.DirtyCheckingSupport
 import org.grails.datastore.mapping.engine.EntityAccess
 import org.grails.datastore.mapping.engine.internal.MappingUtils
@@ -75,7 +74,7 @@ class BasicCollectionTypeEncoder implements PropertyEncoder<Basic> {
                     def propertyName = property.name
                     parentAccess.setPropertyNoConversion(
                             propertyName,
-                            new DirtyCheckingMap(value, parent, propertyName)
+                            DirtyCheckingSupport.wrap(value, parent, propertyName)
                     )
                 }
             }

grails-data-mongodb/core/src/main/groovy/org/grails/datastore/mapping/mongo/MongoCodecSession.groovy

@@ -24,6 +24,7 @@ import groovy.transform.CompileStatic
 
 import jakarta.persistence.FlushModeType
 
+import com.mongodb.DBRef
 import com.mongodb.WriteConcern
 import com.mongodb.bulk.BulkWriteResult
 import com.mongodb.client.FindIterable
@@ -59,9 +60,13 @@ import org.grails.datastore.mapping.model.MappingContext
 import org.grails.datastore.mapping.model.PersistentEntity
 import org.grails.datastore.mapping.model.config.GormProperties
 import org.grails.datastore.mapping.model.types.Association
+import org.grails.datastore.mapping.model.types.Embedded
+import org.grails.datastore.mapping.model.types.ManyToMany
+import org.grails.datastore.mapping.model.types.OneToMany
 import org.grails.datastore.mapping.model.types.ToOne
 import org.grails.datastore.mapping.mongo.engine.MongoCodecEntityPersister
 import org.grails.datastore.mapping.mongo.engine.MongoEntityPersister
+import org.grails.datastore.mapping.mongo.config.MongoAttribute
 import org.grails.datastore.mapping.mongo.engine.MongoIdCoercion
 import org.grails.datastore.mapping.mongo.engine.codecs.PersistentEntityCodec
 import org.grails.datastore.mapping.mongo.query.MongoQuery
@@ -200,7 +205,9 @@ class MongoCodecSession extends AbstractMongoSession {
                         if (delete.vetoed) continue
 
                         final Object k = coerceIdToStoredType(delete.nativeKey, persistentEntity)
-                        if (k) {
+                        // Groovy truthiness would skip an empty assigned String id, which is a
+                        // valid BSON _id -- the document would silently survive the delete.
+                        if (k != null) {
                             nativeKeys << k
                             final List cascadeOperations = delete.cascadeOperations
                             addPostFlushOperations(cascadeOperations)
@@ -337,23 +344,111 @@ class MongoCodecSession extends AbstractMongoSession {
         }
     }
 
+    /**
+     * The identifier an updateAll association value stands for. A lazy proxy keeps its id in the
+     * proxy handler, so -- like ToOneEncoder -- the proxy factory is asked first. An instance of
+     * the associated class is reflected. Anything else is taken to be the identifier itself, so
+     * updateAll(project: project) and updateAll(project: project.id) write the same value.
+     */
+    private Object identifierOf(Object value, PersistentEntity associatedEntity) {
+        def proxyFactory = mappingContext.proxyFactory
+        if (proxyFactory.isProxy(value)) {
+            return proxyFactory.getIdentifier(value)
+        }
+        if (associatedEntity.javaClass.isInstance(value)) {
+            return associatedEntity.reflector.getIdentifier(value)
+        }
+        return value
+    }
+
     @Override
     long updateAll(QueryableCriteria criteria, Map<String, Object> properties) {
         final PersistentEntity entity = criteria.persistentEntity
         final Document nativeQuery = buildNativeDocumentQueryFromCriteria(criteria, entity)
         final MongoCollection collection = getCollection(entity)
         final updateOptions = new UpdateOptions()
         updateOptions.upsert(false)
+        // Normalise into a copy: the caller's map is theirs, and may be immutable. Writing the
+        // encoded reference back into it replaced their domain object with an ObjectId or
+        // DBRef, and threw UnsupportedOperationException for a Map.of/singletonMap argument.
+        Map<String, Object> updateProperties = new LinkedHashMap<String, Object>(properties)
         for (Association association in entity.associations) {
             String associationName = association.name
-            if (association instanceof ToOne && properties.containsKey(associationName)) {
-                def value = properties.get(associationName)
+            // Embedded extends ToOne, but an embedded value is a subdocument with no
+            // identity of its own -- normal persistence encodes it through the embedded
+            // path, not ToOneEncoder. Reflecting an id from one yields null.
+            // hasOne keeps the foreign key on the child, so ToOneEncoder writes nothing on the
+            // owner for it -- see its !isForeignKeyInChild() guard. Normalizing it here would
+            // put an id field on a document that never carries one.
+            if (association instanceof ToOne && !(association instanceof Embedded)
+                    && ((ToOne) association).isForeignKeyInChild()
+                    && updateProperties.containsKey(associationName)) {
+                throw new UnsupportedOperationException(
+                        "Cannot updateAll the hasOne association [${entity.name}.${associationName}]: " +
+                        "its foreign key is held by [${association.associatedEntity?.name}], " +
+                        'so update the inverse side instead')
+            }
+            if (association instanceof ToOne && !(association instanceof Embedded)
+                    && updateProperties.containsKey(associationName)) {
+                def value = updateProperties.get(associationName)
                 if (value != null) {
-                    properties.put(associationName, association.associatedEntity.reflector.getIdentifier(value))
+                    // Write the reference exactly as ToOneEncoder does on the normal
+                    // persistence path: in the target's stored _id type, as a DBRef where the
+                    // mapping asks for one. Otherwise a bulk update leaves a reference that
+                    // association queries and external clients cannot match.
+                    def associatedEntity = association.associatedEntity
+                    def associationId = MongoIdCoercion.coerceIdToStoredType(
+                            identifierOf(value, associatedEntity), associatedEntity)
+                    MongoAttribute attr = (MongoAttribute) association.mapping.mappedForm
+                    if (attr?.isReference()) {
+                        updateProperties.put(associationName,
+                                new DBRef(getCollectionName(associatedEntity), associationId))
+                    }
+                    else {
+                        updateProperties.put(associationName, associationId)
+                    }
+                }
+            }
+            // A bidirectional one-to-many keeps its foreign key on the inverse side, so there
+            // is no field on this document to update -- OneToManyEncoder's shouldEncodeIds
+            // skips it for the same reason, and the decoder never reads one. Left in the $set
+            // the value is written as raw subdocuments and the owner stops decoding, so this
+            // says so rather than corrupting the document or silently doing nothing.
+            // ManyToMany extends ToMany, not OneToMany, so it never reaches this branch.
+            else if (association instanceof OneToMany && association.isBidirectional()
+                    && updateProperties.containsKey(associationName)) {
+                throw new UnsupportedOperationException(
+                        "Cannot updateAll the bidirectional one-to-many [${entity.name}.${associationName}]: " +
+                        "its foreign key is held by [${association.associatedEntity?.name}], " +
+                        'so update the inverse side instead')
+            }
+            // Unidirectional OneToMany and ManyToMany carry a collection of associated instances.
+            // Normal persistence stores their ids -- DBRefs where the mapping asks for it -- so
+            // the bulk path does the same rather than sending domain objects through $set.
+            // Only those two kinds: Basic also extends ToMany but is a collection of simple
+            // values with no associated entity, and must pass through untouched.
+            else if ((association instanceof OneToMany || association instanceof ManyToMany)
+                    && association.associatedEntity != null
+                    && updateProperties.containsKey(associationName)) {
+                def value = updateProperties.get(associationName)
+                if (value instanceof Collection) {
+                    def associatedEntity = association.associatedEntity
+                    MongoAttribute attr = (MongoAttribute) association.mapping.mappedForm
+                    def ids = value.collect { element ->
+                        element == null ? null :
+                                MongoIdCoercion.coerceIdToStoredType(identifierOf(element, associatedEntity), associatedEntity)
+                    }
+                    // Exactly OneToManyEncoder's shape: nulls are dropped before wrapping,
+                    // never turned into DBRef(collection, null), and a non-reference list
+                    // keeps whatever the caller passed.
+                    def encoded = attr?.isReference()
+                            ? ids.findAll { it != null }.collect { new DBRef(getCollectionName(associatedEntity), it) }
+                            : ids
+                    updateProperties.put(associationName, encoded)
                 }
             }
         }
-        final UpdateResult updateResult = updateMany(collection, nativeQuery, new Document(MONGO_SET_OPERATOR, properties), updateOptions)
+        final UpdateResult updateResult = updateMany(collection, nativeQuery, new Document(MONGO_SET_OPERATOR, updateProperties), updateOptions)
         if (updateResult.wasAcknowledged()) {
             try {
                 return updateResult.modifiedCount