In build_update_with_params, when value is a Hash (used for updating nested attributes), the values are directly interpolated into the query string as #{v} without being parameterized or quoted:

if value.is_a?(Hash)
    value.map do |k, v|
        "#{key}.#{k} = #{v}"
    end.join(", ") + for_clause

This not only defeats prepared-statement caching for nested attribute updates but also introduces a N1QL injection vulnerability if user-controlled input is passed to nested attributes.

To fix this, we should parameterize these values using @model.bind(v, params) as well:

if value.is_a?(Hash)
    value.map do |k, v|
        "#{key}.#{k} = #{@model.bind(v, params)}"
    end.join(", ") + for_clause

There are two important improvement opportunities in serialize_for_binding and bind:

1. Array Parameterization (Prepared-Statement Caching): N1QL natively supports passing arrays as a single positional parameter (e.g., name IN $1). The current implementation converts arrays into individual positional parameters (e.g., name IN [$1, $2]), which produces a different query string for every different array length. This completely defeats prepared-statement caching for IN queries (which is one of the main goals of this PR). Passing the array itself as a single parameter keeps the query string identical regardless of array length, enabling prepared-statement caching.

2. ActiveSupport::TimeWithZone Support: ActiveSupport::TimeWithZone (the default time class in Rails) does not inherit from Time or DateTime, so timezone-aware times will not be serialized to ISO8601 strings and will fail or serialize incorrectly. Adding value.acts_like?(:time) ensures robust support for Rails applications.

            def serialize_for_binding(value)
                if value.is_a?(Array)
                    value.map { |v| serialize_for_binding(v) }
                elsif [DateTime, Time].any? { |clazz| value.is_a?(clazz) } || (value.respond_to?(:acts_like?) && value.acts_like?(:time))
                    value.iso8601(@precision || 0)
                elsif value.is_a?(Date)
                    value.to_s
                else
                    value
                end
            end

            def bind(value, params)
                if value.nil?
                    nil
                else
                    params << serialize_for_binding(value)
                    "$#{params.length}"
                end
            end