Bug Fixes:

• don't re-cast atomic updates when adding validations by @zachdaniel

• ensure calculation contexts include changes from before_transaction hooks by @zachdaniel

Improvements:

• Simplify forbidden_due_to_strict_policy check (#2400) by @maennchen

Bug Fixes:

• normalize bulk index metadata before returning by @zachdaniel

• reuse type constraints when matching relationship records (#2391) by Hannes Wüthrich

Features:

• Refactor SAT Solver into crux (#2375) by @maennchen

Improvements:

• Add combination_acc callback to DataLayer behaviour by @zachdaniel

Bug Fixes:

• properly apply bypass policies that can never pass by @zachdaniel

resolves CVE-2025-48043

Bug Fixes:

• only add field to error function if not already present by @zachdaniel

Features:

• Improve selection of atomic validation attribute, including resource-level option (#2356) by @stevebrambilla

• data_one_of validation (#2358) by @barnabasJ

• add Ash.transact/3 (#2341) by @barnabasJ

Bug Fixes:

• don't stringify fieldset atoms in read action by @zachdaniel

• extended context collision prevention to all bulk operation types and added convenience helpers (#2357) by Daniel Gollings

• improve nested bulk action notification handling (#2353) by Daniel Gollings

• Ash.Query.after_transaction result argument issues. (#2354) by James Harton

• after_transaction on read error bug. by James Harton

• correct after_transaction result type for successful queries. by James Harton

• properly set defaults when using string keys in typed structs by @zachdaniel

• move rollback_on_error logic to DataLayer.transaction by @barnabasJ

• handle return_skipped_upsert? in bulk creates (#2343) by @barnabasJ

• Incorrect return type checking for generic action hooks (#2352) by James Harton

• remove non public arguments in generator action_input (#2350) by Minsub Kim

• handle atomic_refs in bulk upserts (#2342) by @barnabasJ

• fix with_transaction bug in Mnesia data layer (#2340) by Dan Wanek

• properly retrieve parent relationship paths out of exists by @zachdaniel

Improvements:

• add can? callback for return_skipped_upsert? for bulk by @barnabasJ

Bug Fixes:

• cast value to type when requiring atomic attributes by @zachdaniel

• fix amnesia support for upsets by Dan Wanek

• support top-level :shared key in Ash.Scope.ToOpts for Map (#2261) by James Harton

Improvements:

• add bulk_create for Ash.DataLayer.Mnesia (#2336) by Dan Wanek

• return errors from calculations with invalid expressions by @zachdaniel

• add source locations to a whole bunch of errors by @zachdaniel

• add location to primary key verifier by @zachdaniel

• add location for multitenancy verifier by @zachdaniel

• add location information for manage relationship transformer by @zachdaniel

• add location info for reserved field names transformer by @zachdaniel

• add location info for primary action transformer by @zachdaniel

• add location info for unique action name transformer by @zachdaniel

• implemented 'has' and 'intersects' functions (#2324) by Abdessabour Moutik

Improvements:

• use delay_task for mix ash.setup by @zachdaniel

Bug Fixes:

• update targets to ubuntu-22.04 and extend release list to prevent stuck builds (#2311) by Shahryar Tavakkoli

• Runtime upsert_fields option is not passed to data layer in certain cases (#2310) by jlgeering

• if nils_distinct?, consider multitenancy attribute as an upsert key by Zach Daniel

authorize before before_transaction hooks in bulk actions by @zachdaniel

This fixes the CVE: CVE-2025-48042. See the GHSA-jj4j-x5ww-cwh9 advisory for more.

Bug Fixes:

• authorize before before_transaction hooks in bulk actions by @zachdaniel

• special case ci_strings as strings in type casting by @zachdaniel

• make Ash.PlugHelpers.set_actor/2 typespec accept term as an actor (#2307) by Maciej Malecki