@@ -152,3 +152,15 @@ jobs:
       - name: Install dependencies
         run: uv sync --group doc
       - run: uv run sphinx-build -W --keep-going -b html doc build/sphinx/html
+
+  all-checks:
+    if: always()
+    needs: [tests, coverage, minversions, style, doc]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Fail if a needed job did not succeed
+        if: >-
+          contains(needs.*.result, 'failure')
+          || contains(needs.*.result, 'cancelled')
+          || contains(needs.*.result, 'skipped')
+        run: exit 1
@@ -7,6 +7,9 @@ Changelog
 Added
 ^^^^^
 - Support for :rfc:`RFC9865 <9865>`
+- :meth:`Resource.replace <scim2_models.Resource.replace>` returns whether the replacement
+  changes the resource, the order of multi-valued entries aside. A server can keep
+  ``meta.version`` and ``meta.lastModified`` when a PUT changes nothing.
 
 Changed
 ^^^^^^^
@@ -15,13 +18,22 @@ Changed
   :class:`~scim2_models.InvalidCountException` from an :class:`~scim2_models.Error` carrying the
   matching ``scimType``, as :rfc:`RFC9865 §2.1 <9865#section-2.1>` defines them. They used to fall
   back to the base :class:`~scim2_models.SCIMException`.
+- :attr:`AttributeBinding.urn <scim2_models.AttributeBinding.urn>` and the error messages
+  that quote it spell the attribute as the schema declares it, such as ``userName``, whatever
+  case the path used.
 
 Security
 ^^^^^^^^
 - The ``password`` of a :class:`~scim2_models.User` is case-exact, so ``password eq "SECRET"``
   no longer matches ``secret``. RFC 7643 declares it case-insensitive, but compares passwords
   by salted hash (:rfc:`RFC7643 §4.1.1 <7643#section-4.1.1>`), and the rules of
   :rfc:`RFC7644 §5 <7644#section-5>` keep the case of passwords.
+- A filter or a PATCH path that nests more than 32 expressions, such as ``not(not(...))``, is
+  refused with ``invalidFilter`` or ``invalidPath``. A deep one used to raise a
+  :class:`RecursionError`. Parentheses and chains of ``and`` or ``or`` do not count.
+- Filters and paths from clients no longer grow memory without limit. Each unknown attribute
+  name, and each spelling of a known one such as ``USERNAME``, used to stay in memory for the
+  life of the process. Filters and paths longer than 1024 characters are no longer cached.
 
 [0.9.0] - 2026-09-27
 --------------------
 
@@ -115,6 +115,7 @@ the read-only attributes, and the immutable ones keep the value they were create
    ...     scim_ctx=Context.RESOURCE_REPLACEMENT_REQUEST,
    ... )
    >>> replacement.replace(stored)
+   True
    >>> replacement.id
    '2819c223-7f76-453a-919d-413861904646'
    >>> replacement.meta.version
@@ -128,6 +129,10 @@ The check also covers the sub-attributes of a complex attribute. In a multi-valu
 covers the entries the stored resource also holds, matched by their ``value``. So a replacement
 can add and remove entries, but cannot change an immutable sub-attribute of an entry it keeps.
 
+:meth:`~scim2_models.Resource.replace` returns :data:`False` when the replacement changes
+nothing, the order of multi-valued entries aside. A server can then keep ``meta.version`` and
+``meta.lastModified`` unchanged, as for a PATCH that changes nothing.
+
 Some values are not compared, so that a valid replacement is never refused. These are an entry
 whose ``value`` matches several entries, and an immutable reference. Per
 :rfc:`RFC7643 §2.4 <7643#section-2.4>`, two spellings of one URI can be equivalent.
 
@@ -341,7 +341,10 @@ def execute_bulk(bulk_request, location_for):
         # RFC7644 §3.7.3: a job performs as many changes as possible, unless
         # the client caps the failures it accepts with "failOnErrors".
         errors += 1
-        if bulk_request.fail_on_errors and errors >= bulk_request.fail_on_errors:
+        if (
+            bulk_request.fail_on_errors is not None
+            and errors >= bulk_request.fail_on_errors
+        ):
             break
 
     return BulkResponse[User](operations=operations)
 
@@ -161,7 +161,8 @@ Replace and patch a resource
 ----------------------------
 
 Validate a replacement with :attr:`~scim2_models.Context.RESOURCE_REPLACEMENT_REQUEST`, then use
-:meth:`~scim2_models.Resource.replace` with the stored resource. This checks immutable values:
+:meth:`~scim2_models.Resource.replace` with the stored resource. This checks immutable values,
+and tells whether the replacement changes the resource:
 
 .. doctest::
 
@@ -170,6 +171,7 @@ Validate a replacement with :attr:`~scim2_models.Context.RESOURCE_REPLACEMENT_RE
    ...     scim_ctx=Context.RESOURCE_REPLACEMENT_REQUEST,
    ... )
    >>> replacement.replace(user)
+   False
 
 Apply a :class:`~scim2_models.PatchOp` to make a partial update:
 
 
@@ -9,6 +9,7 @@
 from lark import Lark
 from lark import Token
 from lark import Transformer
+from lark import Tree
 from lark import v_args
 from lark.exceptions import LarkError
 from lark.exceptions import VisitError
@@ -208,51 +209,115 @@ def null_value(self, _token: Token) -> None:
         return None
 
 
+_MAX_DEPTH = 32
+"""How many expressions a filter or a path may nest.
+
+A deeper tree would exhaust the stack of the recursive visitors, and no client
+sends one.
+"""
+
+_MAX_CACHED_LENGTH = 1024
+"""How long a filter or a path may be to stay in the parser cache.
+
+Real filters and paths are much shorter. Parsing the longer ones each time
+bounds the memory the cache holds.
+"""
+
+_NESTING_RULES = frozenset(
+    {"or_expr", "and_expr", "not_expr", "value_path", "value_path_sub"}
+)
+
+
+def _depth(tree: Tree[Token]) -> int:
+    """Count the expressions nested in a parse tree, without recursion.
+
+    Parentheses leave no node in the tree, and a chain of ``and`` or ``or`` is a
+    single node, so neither adds to the depth.
+    """
+    depths: dict[int, int] = {}
+    for subtree in tree.iter_subtrees():
+        children = (
+            depths[id(child)] for child in subtree.children if isinstance(child, Tree)
+        )
+        nested = max(children, default=0)
+        depths[id(subtree)] = nested + (subtree.data in _NESTING_RULES)
+    return depths[id(tree)]
+
+
 # One parser for both entry points: the two start rules share a grammar, and
 # building their tables together halves the cost of importing this module.
 _PARSER = Lark(_GRAMMAR, start=["filter", "path"], parser="lalr")
 _BUILDER = _AstBuilder()
 
 
-@lru_cache(maxsize=1024)
 def _parse_filter(expression: str) -> FilterNode:
     """Parse a SCIM filter expression into its root node.
 
-    The expression is the one a ``filter`` query parameter or a
-    ``SearchRequest.filter`` carries. A syntactically invalid one raises
+    The expression is the one a filter query parameter or a
+    SearchRequest.filter carries. A syntactically invalid one raises
     InvalidFilterException.
-
-    >>> from scim2_models.path.grammar import _parse_filter
-    >>> _parse_filter('userName eq "bjensen"')
-    Comparison(attr_path=AttrPath(attr='userName', sub_attr=None, uri=None), op=<CompareOperator.eq: 'eq'>, value='bjensen')
     """
+    if len(expression) > _MAX_CACHED_LENGTH:
+        return _build_filter(expression)
+    return _cached_filter(expression)
+
+
+def _build_filter(expression: str) -> FilterNode:
+    """Parse a SCIM filter expression, without the cache."""
     try:
         tree = _PARSER.parse(expression, start="filter")
+    except LarkError as exc:
+        raise InvalidFilterException(
+            filter=expression, detail=_error_detail(exc)
+        ) from exc
+
+    if _depth(tree) > _MAX_DEPTH:
+        raise InvalidFilterException(
+            filter=expression,
+            detail=f"the filter nests more than {_MAX_DEPTH} expressions",
+        )
+
+    try:
         return cast(FilterNode, _BUILDER.transform(tree))
     except LarkError as exc:
         raise InvalidFilterException(
             filter=expression, detail=_error_detail(exc)
         ) from exc
 
 
-@lru_cache(maxsize=1024)
 def _parse_path(path: str) -> PathNode:
     """Parse a SCIM PATCH path into an abstract syntax tree.
 
-    The path is the one a ``PatchOperation.path`` carries. A syntactically
+    The path is the one a PatchOperation.path carries. A syntactically
     invalid one raises InvalidPathException.
-
-    >>> from scim2_models.path.grammar import _parse_path
-    >>> _parse_path("name.familyName")
-    AttrPath(attr='name', sub_attr='familyName', uri=None)
     """
+    if len(path) > _MAX_CACHED_LENGTH:
+        return _build_path(path)
+    return _cached_path(path)
+
+
+def _build_path(path: str) -> PathNode:
+    """Parse a SCIM PATCH path, without the cache."""
     try:
         tree = _PARSER.parse(path, start="path")
+    except LarkError as exc:
+        raise InvalidPathException(path=path, detail=_error_detail(exc)) from exc
+
+    if _depth(tree) > _MAX_DEPTH:
+        raise InvalidPathException(
+            path=path, detail=f"the path nests more than {_MAX_DEPTH} expressions"
+        )
+
+    try:
         return cast(PathNode, _BUILDER.transform(tree))
     except LarkError as exc:
         raise InvalidPathException(path=path, detail=_error_detail(exc)) from exc
 
 
+_cached_filter = lru_cache(maxsize=1024)(_build_filter)
+_cached_path = lru_cache(maxsize=1024)(_build_path)
+
+
 def _error_detail(exc: LarkError) -> str:
     """Build a human readable message out of a lark failure."""
     if isinstance(exc, VisitError):
 
@@ -16,6 +16,7 @@
 from ..exceptions import InvalidFilterException
 from ..exceptions import PathNotFoundException
 from ..utils import _find_field_name
+from ..utils import _normalize_attribute_name
 from .expressions import ORDERING_OPERATORS
 from .expressions import STRING_OPERATORS
 from .expressions import AttrPath
@@ -251,16 +252,27 @@ def _resolve_attr_path(
     # cannot outlive the model it describes: a resolved attribute names the
     # model it was resolved on, which a cache keyed by that model would keep
     # alive for as long as the process runs.
-    cache: dict[tuple[AttrPath, bool], AttributeBinding | None] | None
+    cache: dict[tuple[str | None, str, str | None], AttributeBinding] | None
     cache = model.__dict__.get(_RESOLVED_ATTRS)
     if cache is None:
         cache = {}
         setattr(model, _RESOLVED_ATTRS, cache)
 
-    key = (attr_path, strict)
-    if key not in cache:
-        cache[key] = _resolve_attr_path_uncached(model, attr_path, strict=strict)
-    return cache[key]
+    # Paths come from clients. Folding their case and leaving out the unknown
+    # ones bounds the cache to the names the model accepts, however many
+    # spellings a client sends.
+    key = (
+        attr_path.uri.lower() if attr_path.uri else None,
+        _normalize_attribute_name(attr_path.attr),
+        _normalize_attribute_name(attr_path.sub_attr) if attr_path.sub_attr else None,
+    )
+    if key in cache:
+        return cache[key]
+
+    binding = _resolve_attr_path_uncached(model, attr_path, strict=strict)
+    if binding is not None:
+        cache[key] = binding
+    return binding
 
 
 def _resolve_attr_path_uncached(
@@ -319,7 +331,7 @@ def _resolve_attr_path_uncached(
         sub_field_name=sub_field_name,
         sub_field_type=sub_field_type,
         case_exact=case_exact,
-        urn=_build_urn(target, attr_path),
+        urn=_build_urn(target, field_name, field_type, sub_field_name),
     )
 
 
@@ -391,12 +403,21 @@ def _resolve_filter_path(
         raise InvalidFilterException(detail=str(exc)) from exc
 
 
-def _build_urn(model: type[BaseModel], attr_path: AttrPath) -> str:
-    """Build the fully qualified URN of a resolved attribute."""
-    schema = attr_path.uri or (
-        getattr(model, "__schema__", None) if isclass(model) else None
-    )
-    suffix = str(AttrPath(attr=attr_path.attr, sub_attr=attr_path.sub_attr))
+def _build_urn(
+    model: type[BaseModel],
+    field_name: str,
+    field_type: type | None,
+    sub_field_name: str | None,
+) -> str:
+    """Build the fully qualified URN of a resolved attribute.
+
+    The URN is spelled as the schema declares it, whatever case the path used.
+    """
+    schema = getattr(model, "__schema__", None)
+    suffix = model._scim_name(field_name)
+    if sub_field_name is not None:
+        sub_model = cast(type[BaseModel], field_type)
+        suffix = f"{suffix}.{sub_model._scim_name(sub_field_name)}"
     return f"{schema}:{suffix}" if schema else suffix
 
 
 
@@ -187,7 +187,7 @@ class Resource(ScimObject, Generic[AnyExtension]):
     meta: Annotated[Meta | None, Mutability.read_only, Returned.default] = None
     """A complex attribute containing resource metadata."""
 
-    def replace(self, original: Self) -> None:
+    def replace(self, original: Self) -> bool:
         """Apply :rfc:`RFC 7644 §3.5.1 <7644#section-3.5.1>` replace (PUT) semantics.
 
         ``readOnly`` fields are copied from *original*.
@@ -204,9 +204,13 @@ def replace(self, original: Self) -> None:
         <7643#section-2.4>`.
 
         :param original: The original resource state to compare against.
+        :return: :data:`True` if the replacement differs from *original*, the
+            order of the entries of multi-valued attributes aside
+            (:rfc:`RFC7643 §2.4 <7643#section-2.4>`), :data:`False` otherwise.
         :raises MutabilityException: If an immutable field value differs.
         """
         self._apply_replace_constraints(original)
+        return bool(_unordered(self.model_dump()) != _unordered(original.model_dump()))
 
     @classmethod
     def __class_getitem__(cls, item: Any) -> type["Resource[Any]"]:
@@ -439,6 +443,15 @@ def from_schema(cls, schema: "Schema") -> type["Resource[Any]"]:
 AnyResource = TypeVar("AnyResource", bound="Resource[Any]")
 
 
+def _unordered(value: Any) -> Any:
+    """Reduce a dumped value to a form that compares equal regardless of entry order."""
+    if isinstance(value, dict):
+        return {key: _unordered(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return sorted((_unordered(item) for item in value), key=repr)
+    return value
+
+
 def _dedicated_attributes(
     model: type[BaseModel], excluded_models: list[type[BaseModel]]
 ) -> dict[str, Any]:
 
@@ -950,8 +950,12 @@ def test_bulk_answers_404_for_an_operation_on_an_unknown_resource():
     assert missing.response.detail == "Resource does not exist."
 
 
-def test_bulk_stops_once_the_error_limit_the_client_set_is_reached():
-    """A client caps the failures it accepts, and the operations past that cap stay undone."""
+@pytest.mark.parametrize("fail_on_errors", [1, 0])
+def test_bulk_stops_once_the_error_limit_the_client_set_is_reached(fail_on_errors):
+    """A client caps the failures it accepts, and the operations past that cap stay undone.
+
+    A client that accepts no failure stops the job at the first one.
+    """
     from doc.integrations._examples import integrations
 
     integrations.records.clear()
@@ -960,7 +964,7 @@ def test_bulk_stops_once_the_error_limit_the_client_set_is_reached():
     request = BulkRequest[User].model_validate(
         {
             "schemas": [BULK_REQUEST_SCHEMA],
-            "failOnErrors": 1,
+            "failOnErrors": fail_on_errors,
             "Operations": [
                 {
                     "method": "POST",