[LeeroyHannigan]

Fixes #574.

An UpdateItem or a TransactWriteItems Update whose result nests an attribute more than 32 levels deep is now refused, as DynamoDB refuses it. Before, it was applied on every backend.

What happened on main

crates/engine/src/update_item.rs checks the nesting depth of ExpressionAttributeValues, and each value in such an update is within the limit. Nothing checked the item the update produced, so SET #m.#k...#k = :v with a value 2 wrappers deep at a path 30 wrappers deep stored an attribute nested past the limit.

What the service answers

Measured on 2026-10-25 at 19:53 UTC and 2026-10-26 at 00:55 UTC in us-east-1, each case twice. Depth here is counted in M or L wrappers around a scalar; 31 wrappers is 32 levels, the PutItem limit.

• An update whose result has at most 31 wrappers in every attribute is applied. That covers a SET at the top level, into a map, into a list and through if_not_exists that keeps the existing value, and a SET of a scalar at the deepest path of an item already at the limit.
• One more wrapper is refused with ValidationException Nesting Levels have exceeded supported limits, with no 1 validation error detected: prefix and no suffix, and nothing is written. That covers a SET into a map or list, into a new map member, through list_append, and through the default of if_not_exists.
• A TransactWriteItems Update past the limit is cancelled with one ValidationError reason carrying the same text.
• A condition that fails on the same request answers ConditionalCheckFailedException.
• The depth error comes before the 400 KB item size error, for UpdateItem with the SET actions in either order and for a TransactWriteItems Update (measured 2026-10-26 at 01:26 and 01:44 UTC).

The change

apply_update_validated in crates/core/src/expression/update_evaluator.rs is the function every backend's UpdateItem and TransactWriteItems Update path calls after its condition check when it evaluates the expression in Rust. The MongoDB native update path takes only one-element paths with a checked value, so it cannot produce an over-limit value. apply_update_validated now calls validate_written_nesting_depth (new file crates/core/src/expression/update_nesting.rs), which checks each top-level attribute a SET or an ADD wrote, once however many actions write into it. ADD is checked because ExtendDB creates the missing maps on an ADD path. REMOVE and DELETE cannot deepen a value. Attributes the update does not set are not checked, so an item stored deeper than the limit before this change can still be updated through its other attributes.

Tests

• crates/core/src/expression/update_nesting.rs: the limit for maps and lists, every branch of a list checked, ADD targets checked, two actions into one attribute, and attributes outside the SET and ADD left alone. A limit of 32 instead of 31 fails four of them, checking only the first element of each list fails one, and leaving ADD out fails one.
• tests/test_update_result_nesting_depth.py: 22 dual-target wire tests from the measurements. The ADD test compares only the error code and the stored item: the service refuses that request for its 33-element path, with The document path has too many nesting levels, and ExtendDB has no path length check (a gap on main, not changed here).

Run locally on 2026-10-26 at the head, with every file under tests/ whose test names match update, nest, item_size or transact:

Backend	Head	Base (main)
SQLite	312 passed, 6 skipped; the new file 22 passed	the new file: 10 failed, 12 passed
PostgreSQL 16	312 passed, 6 skipped	not run
MongoDB 7	308 passed, 6 skipped, 4 failed	not run

The 4 MongoDB failures are in tests/test_transact_absent_item_isolation.py, the write skew on main that the file marks XFAIL_UNTIL_MONGODB_FIX; the marker applies only when EXTENDDB_TEST_MONGODB_CONTAINER is set, and these runs did not set it. The 10 that fail on main are the refusals, the ADD one included; the 12 that pass are the updates that stay within the limit, the condition test and the update of another attribute.

Also run: cargo +1.97.0 fmt --all -- --check, cargo +1.97.0 clippy --all-targets -- -D warnings, cargo test --workspace --exclude extenddb-storage-cassandra on stable and on 1.88.0 (1,772 passed each), and cargo test -p extenddb-storage-cassandra --lib (61 passed). The Cassandra integration tests and the new file on Cassandra were not run locally.

CI runs the new file in run-integration, run-integration-sqlite, mongodb-pytest and cassandra-pytest.

Files

crates/core/src/expression/update_evaluator.rs is 642 lines on main and grows by one, the call. The check lives in the new 156-line update_nesting.rs.

Merging

git merge-tree --write-tree is clean against the 18 open PRs that change crates/core/src/expression/ or crates/core/src/validation/mod.rs and merge with main. #416, #395 and #200 conflict with main already.