Remove request-time mutable state from Array and custom-type coercers

CHANGELOG.md

@@ -38,6 +38,7 @@
 #### Fixes
 
 * [#2767](https://github.com/ruby-grape/grape/pull/2767): Update rubocop to 1.88.0 and rubocop-rspec to 3.10.2 - [@ericproulx](https://github.com/ericproulx).
+* [#2817](https://github.com/ruby-grape/grape/pull/2817): Remove request-time mutable state from Array and custom-type coercers - [@ericproulx](https://github.com/ericproulx).
 * Your contribution here.
 
 ### 3.3.4 (2026-07-25)

lib/grape/validations/types/array_coercer.rb

@@ -15,7 +15,9 @@ class ArrayCoercer < DryTypeCoercer
         def initialize(type, strict: false)
           super
           @coercer = strict ? DryTypes::Strict::Array : DryTypes::Params::Array
-          @subtype = type.first
+          # Built eagerly: instances are shared across requests (and cached in
+          # Types::CoercerCache), so no lazy state may be created at call time.
+          @elem_coercer = DryTypeCoercer.coercer_instance_for(type.first, strict:)
         end
 
         def call(_val)
@@ -27,7 +29,7 @@ def call(_val)
 
         protected
 
-        attr_reader :subtype
+        attr_reader :elem_coercer
 
         def coerce_elements(collection)
           return if collection.nil?
@@ -50,10 +52,6 @@ def coerce_elements(collection)
         def reject?(val)
           val.nil?
         end
-
-        def elem_coercer
-          @elem_coercer ||= DryTypeCoercer.coercer_instance_for(subtype, strict:)
-        end
       end
     end
   end

lib/grape/validations/types/custom_type_coercer.rb

@@ -88,8 +88,12 @@ def hash_symbolizer(method)
           ->(val) { method.call(val).deep_symbolize_keys }
         end
 
+        # +dup+ before +map!+: the collection is whatever the user's coercion
+        # method returned — possibly frozen, possibly the input itself — so we
+        # must not mutate it in place. +dup+ also preserves the class, keeping a
+        # +Set+ a +Set+ (unlike +map+, which would return an +Array+).
         def collection_symbolizer(method)
-          ->(val) { method.call(val).map! { |item| symbolize_if_hash(item) } }
+          ->(val) { method.call(val).dup.map! { |item| symbolize_if_hash(item) } }
         end
 
         def symbolize_if_hash(item)

spec/grape/validations/types/array_coercer_spec.rb

@@ -29,5 +29,17 @@
         expect(subject.call([['10'], ['20']])).to eq([Set[10], Set[20]])
       end
     end
+
+    context 'when the instance is frozen' do
+      let(:type) { Array[Integer] }
+
+      # Instances are shared across requests (and cached in CoercerCache), so
+      # the element coercer must be built eagerly rather than memoized at call
+      # time. Freezing the instance proves no lazy ivar is written by #call.
+      it 'coerces without creating lazy state' do
+        subject.freeze
+        expect(subject.call(%w[10 20])).to eq([10, 20])
+      end
+    end
   end
 end

spec/grape/validations/types/custom_type_coercer_spec.rb

@@ -23,6 +23,17 @@
           expect(coercer.call('[{"foo":"bar"}]')).to eq(Set[{ foo: 'bar' }])
         end
       end
+
+      context 'when the coercion method returns a frozen array' do
+        let(:type) { Array }
+        let(:coerce_method) { ->(val) { JSON.parse(val).freeze } }
+
+        # The returned array belongs to the user's coercion method and may be
+        # frozen or be the input itself, so symbolization must not mutate it.
+        it 'symbolizes without mutating the returned array' do
+          expect(coercer.call('[{"foo":"bar"}]')).to eq([{ foo: 'bar' }])
+        end
+      end
     end
   end
 end