v1.77.0

FerretDB v1 (SQLite) multi-platform binaries — one ferretdb-[.exe] asset per platform (no ferretdb.zip). Built by release-all.yml from the wekan/FerretDB fork.

Platforms: amd64, arm64, armhf, armv6, armel, i386, ppc64le, s390x, riscv64, loong64, win64, win-arm64, win32, mac-amd64, mac-arm64, freebsd-amd64, freebsd-i386, freebsd-armel, freebsd-armv6, freebsd-armv7, freebsd-arm64, netbsd-amd64, openbsd-amd64, openbsd-arm64, android-arm64

Every binary has a <name>.sha256sum beside it. To check a download:

curl -fsSLO https://github.com/wekan/FerretDB/releases/download/v1.77.0/ferretdb-amd64
curl -fsSLO https://github.com/wekan/FerretDB/releases/download/v1.77.0/ferretdb-amd64.sha256sum
sha256sum -c ferretdb-amd64.sha256sum

Fixed 🐛

• Storing an Infinity/-Infinity double no longer fails. mongorestore
  restoring a wekan cards collection with a sort: -Infinity value failed
  one document with invalid value: { "sort": -Inf } (infinity values are not allowed), even though real MongoDB stores +Inf/-Inf doubles without
  complaint. The root cause was one level down from that check: sjson (the
  JSON-based encoding documents are stored as) already special-cased NaN as
  the string "NaN" because Go's encoding/json cannot marshal NaN/Inf
  floats directly, but never did the same for Infinity, so
  internal/types/document_validation.go rejected it outright rather than
  hand the storage layer a value it could not round-trip.
  internal/handler/sjson/double.go now encodes ±Infinity as "Infinity"/
  "-Infinity" strings the same way, internal/handler/sjson/sjson.go's
  single-value fast path decodes them back, and the document-validation
  rejection is removed now that storage supports it. The same restriction on
  a $mul that overflows to infinity
  (internal/handler/common/update.go) is removed for the same reason -
  real MongoDB allows that too. TestDouble in
  internal/handler/sjson/double_test.go and TestDocumentValidateData in
  internal/types/document_validation_test.go pin the round-trip and the
  now-valid documents; TestInfinityDouble and TestUpdateProduceInfinity
  in integration/ (replacing the two cases removed from
  TestDiffDocumentValidation and the former TestDiffUpdateProduceInfinity,
  since infinity is not actually a difference from MongoDB) cover the
  insert/read/update round-trip against a live server by @xet7. Thanks to
  xet7.

• The tools module no longer resolves a gRPC-Go with an xDS-server crash
  vulnerability. Dependabot alert FerretDB#47:
  GHSA-2v4p-qf9q-27wj -
  a gRPC-Go server configured with xds.NewGRPCServer() crashes (High
  severity, Denial of Service) on a crafted request missing both the
  :authority and Host headers, affecting google.golang.org/grpc >=
  1.83.0, < 1.83.2. The root module and integration/go.mod were already on
  the patched 1.83.2 (PR #24, #25), but tools/go.mod - a separate module
  pulling grpc in indirectly through golang.org/x/pkgsite - was missed and
  stayed on the vulnerable 1.83.1. go get google.golang.org/grpc@v1.83.2
  followed by go mod tidy brings it to the patched version; go mod verify and go list -m all both succeed with the updated graph by
  @xet7. Thanks to xet7.

Other Changes 🤖

• The gRPC library receives a follow-up patch release.
  PR #24 and
  PR #25 update
  google.golang.org/grpc from 1.83.1 to 1.83.2 in both the root module and
  integration. Module checksums verify and the affected packages build by
  @xet7. Thanks to dependabot and xet7.

• Database-image and build-tooling dependencies are current.
  PR #26 bumps the mongo
  image used by build/deps from 8.3.8 to 8.3.9, and
  PR #27 bumps the golang
  image used by build/ferretdb from 1.27.0 to 1.27.1 by @xet7. Thanks to
  dependabot and xet7.

• Runtime dependencies in the "ferretdb" group are current.
  PR #28 updates
  github.com/SAP/go-hdb (1.18.2 → 1.18.3), github.com/go-sql-driver/mysql
  (1.10.0 → 1.10.1), github.com/prometheus/client_model (0.6.2 → 0.6.3),
  github.com/prometheus/common (0.70.1 → 0.71.0), golang.org/x/crypto
  (0.55.0 → 0.56.0), golang.org/x/sys (0.47.0 → 0.48.0) and
  modernc.org/sqlite (1.57.0 → 1.58.0, pulling in newer
  modernc.org/libc/modernc.org/memory). The bump left integration's
  go.mod/go.sum out of sync with the root module's new indirect-dependency
  versions, which failed go build ./integration/... with "updates to go.mod
  needed"; go mod tidy there brings it back in sync. Module checksums
  verify and a binary containing the SQLite, PostgreSQL, MySQL and HANA
  handlers builds successfully by @xet7. Thanks to dependabot and xet7.