Skip to content

Fix/jsonapi nested eager loaded leak#60298

Closed
YoussefMansour9 wants to merge 2 commits into
laravel:13.xfrom
YoussefMansour9:fix/jsonapi-nested-eager-loaded-leak
Closed

Fix/jsonapi nested eager loaded leak#60298
YoussefMansour9 wants to merge 2 commits into
laravel:13.xfrom
YoussefMansour9:fix/jsonapi-nested-eager-loaded-leak

Conversation

@YoussefMansour9
Copy link
Copy Markdown
Contributor

Prevent unrequested nested eager-loaded relationships from appearing in the included section of JSON:API resource responses.

Fixes #60126

Bug: When a resource is loaded with nested eager-loading like Post::with('comments.commenter')->find($id) and only include=comments is requested, the commenter relation leaks into included. This happens because compileIncludedNestedRelationshipsMap pre-populates ALL loaded model relations, and array_push in resolveIncludedResourceObjects propagates them regardless of the include query.

Changes:

  • Thread sub-include paths through the compile chain so each sub-resource knows which relations were actually requested via the include query.
  • Rewrite compileIncludedNestedRelationshipsMap to check against the parsed include query instead of all loaded model relations.
  • Scope sub-resource resolution via a resolutionSparseIncluded property to prevent includePreviouslyLoadedRelationships from compiling unrequested eager-loaded relations.
  • Remove array_push in resolveIncludedResourceObjects since all intended nested entries are pre-populated during the initial compile.
  • Fix resolveResourceType Stringable return type.
  • Update chaperone test: inverse relations set by chaperone() are no longer automatically included unless explicitly in the include query.
  • Add test verifying that include=comments does not leak comments.commenter into included.

Youssef Mansour and others added 2 commits May 25, 2026 19:05
…el#60260)

When using illuminate/database as a standalone package (without the full
Laravel framework), the base_path() helper function is not available.
Guard the call with function_exists() to prevent a fatal error.
…cluded

Prevent unrequested nested eager-loaded relationships from appearing in
the included section of JSON:API resource responses.

- Thread sub-include paths through the compile chain so each sub-resource
  knows which relations were actually requested via the include query.
- Rewrite compileIncludedNestedRelationshipsMap to check against the
  parsed include query instead of all loaded model relations.
- Scope sub-resource resolution via a resolutionSparseIncluded property
  to prevent includePreviouslyLoadedRelationships from compiling
  unrequested eager-loaded relations.
- Remove array_push in resolveIncludedResourceObjects since all intended
  nested entries are pre-populated during the initial compile.
- Fix resolveResourceType Stringable return type (missing string cast
  exposed when generator is consumed).
- Update chaperone test: inverse relations set by chaperone() are no
  longer automatically included unless explicitly in the include query.
- Add test verifying that include=comments does not leak
  comments.commenter into included.
@taylorotwell
Copy link
Copy Markdown
Member

Thanks for your pull request to Laravel!

I appreciate you taking the time to submit this; however, it appears this contribution may have been primarily AI-generated without careful human review and consideration.

We've found that AI-generated code often doesn't align well with Laravel's conventions, architectural decisions, and the specific context of what we're trying to accomplish with the framework. Quality contributions require thoughtful human insight into the codebase.

If you're interested in contributing to Laravel, I'd encourage you to familiarize yourself with the existing codebase, engage with the community, and submit PRs that reflect your own understanding and careful consideration of the problem you're solving.

@YoussefMansour9 YoussefMansour9 deleted the fix/jsonapi-nested-eager-loaded-leak branch May 28, 2026 11:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

JsonApiResource always returning eager-loaded relationships on nested relations

2 participants