From 1b70e34ba228d7fd7114fb4e9aaf907beb2c05e7 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 01:28:22 +0000 Subject: [PATCH] docs(releases): name 17.2.0 as the current v17 series MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `content/docs/releases/index.mdx` still ended its v17 entry with "(current series: 17.1.0, released 2026-08-20)" after the 17.2.0 train published (packages/spec version-packages commit e7d2cc67f, 2026-08-23T06:29:35Z; confirmed via packages/spec/CHANGELOG.md's `## 17.2.0` heading and package.json's "version": "17.2.0" — the newest GA 17.x release). content/docs/releases/v17.mdx had no heading naming the 17.2 series at all. - index.mdx: v17 status parenthetical now names 17.2.0 (released 2026-08-23), and the summary clause gets a 17.2 continuation matching the existing per-minor shape. - v17.mdx: frontmatter description, release-status blockquote and a new "## Highlights — 17.2.0" section (matching the existing 17.0.0/17.1.0 sections) summarizing the 17.2.0 train's most significant changes across the 69 packages that published it: the by-id update/delete accept-set tightenings (#11009, #11142), further ADR-0049 retirements (sys_position.permissions #9885, MetricSchema.filters #10414, record:highlights icon #10054, themes #10485), the http_request_errors_total retirement (#9834), analytics cross-object-filter refusals (#10759, #10861), driver-sql introspection failing loudly instead of reporting silent absence (#11161), two CLI authoring-surface retirements (#10359, #10917), and the per-item publish ?package= org-scope fix. Docs-only, per the stated exception to "never edit content/docs/releases/ in a code PR": this is the dedicated docs-only PR, not a rider. Not attempted: the full "N.N.0 in detail" + "Upgrade checklist" + "References" depth 17.0.0/17.1.0 carry, and a failing gate leg for index staleness (out of scope per triage). Card relationship is declared in the PR body, not here (a squashed branch must not carry conflicting per-commit Fixes/Part-of trailers). Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx --- content/docs/releases/index.mdx | 2 +- content/docs/releases/v17.mdx | 87 +++++++++++++++++++++++++++------ 2 files changed, 72 insertions(+), 17 deletions(-) diff --git a/content/docs/releases/index.mdx b/content/docs/releases/index.mdx index baf0714e65..068c694096 100644 --- a/content/docs/releases/index.mdx +++ b/content/docs/releases/index.mdx @@ -18,7 +18,7 @@ migration steps, then covers new capabilities and notable fixes. ## Versions -- [v17.0.0](/docs/releases/v17) — Files become owned `sys_file` records with server-enforced `accept`/`maxSize` and a governed download path, bulk export becomes its own opt-in privilege, the SDK is reconciled against the routes the server actually mounts (21 dead methods out, 40+ real ones in), approval nodes route approvers dynamically via CEL expressions and decision outputs, a datasource that cannot connect fails the boot, and Node 22 becomes the supported floor; 17.1 adds partial field masking, record-view auditing on `sys_audit_log`, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table (current series: 17.1.0, released 2026-08-20). +- [v17.0.0](/docs/releases/v17) — Files become owned `sys_file` records with server-enforced `accept`/`maxSize` and a governed download path, bulk export becomes its own opt-in privilege, the SDK is reconciled against the routes the server actually mounts (21 dead methods out, 40+ real ones in), approval nodes route approvers dynamically via CEL expressions and decision outputs, a datasource that cannot connect fails the boot, and Node 22 becomes the supported floor; 17.1 adds partial field masking, record-view auditing on `sys_audit_log`, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table; 17.2 tightens by-id `update`/`delete` against a silently-dropped `where` predicate or a mismatched id, retires `sys_position.permissions` and other dead ADR-0049 surfaces, and stops analytics from answering the wrong number on a cross-object filter (current series: 17.2.0, released 2026-08-23). - [v16.0.0](/docs/releases/v16) — One org identifier (`organizationId`) across hooks and actions, quorum + per-group sign-off (会签) approvals with metadata-declared decision actions, time-relative automations, filtered roll-ups, strict dashboard widgets, an identity-scoped MCP stdio transport, and a platform-wide enforce-or-remove sweep that makes dead metadata loud; 16.1 adds a `requires` capability-provider preflight, two more dashboard build gates, and `runAs:'user'` automations that run with the triggering user's real grants (final release: 16.1.0). - [v15.0.0](/docs/releases/v15) — Explain record access layer by layer, a docked AI workspace in the Console, project-ready Gantt charts, and phone sign-in; 15.1 adds permission-following attachments, no-code third-party connectors, dashboard-wide filters, pinyin search, and whole-record inline editing — with materially safer multi-tenant and write-path defaults (final release: 15.1.1). - [v14.0.0](/docs/releases/v14) — ADR-0090 vocabulary convergence completed, object `enable.*` flags become real gates, admin user management, phone/SMS auth, book-audience enforcement, data-lifecycle contract, and effective-dated grants (final release: 14.8.0). diff --git a/content/docs/releases/v17.mdx b/content/docs/releases/v17.mdx index 2baf5e2b45..855fa46fde 100644 --- a/content/docs/releases/v17.mdx +++ b/content/docs/releases/v17.mdx @@ -1,6 +1,6 @@ --- title: v17.0.0 -description: Files become platform records with governed download, bulk export becomes its own opt-in privilege, the SDK reaches every route the server actually mounts, approvals route approvers dynamically, and a boot that cannot reach its datasource stops pretending it can. Backend and Console notes for 17.0.0 and 17.1.0. +description: Files become platform records with governed download, bulk export becomes its own opt-in privilege, the SDK reaches every route the server actually mounts, approvals route approvers dynamically, and a boot that cannot reach its datasource stops pretending it can. Backend and Console notes for 17.0.0, 17.1.0, and 17.2.0. --- **The v17 line** is a truth-telling release. Where v16 made *declared metadata* @@ -13,22 +13,25 @@ readable by everyone in the tenant. Alongside that, `agent.tools[]`, the GraphQL surface, the `ObjectStackProtocol` alias, and a long tail of parsed-but-never-enforced spec clusters are removed rather than maintained. -> **Release status: 17.1.0 is released**, and is the current version of the v17 -> line. It was published to the `latest` tag on 2026-08-20, taking over from -> 17.0.0 — which was published on 2026-08-14, closing a train that ran through -> `17.0.0-rc.0` … `rc.6` (the last of them cut 2026-08-10). A plain install now -> resolves 17.1.0. `changeset pre exit` ran with the 17.0.0 cut, so the -> `@objectstack/*` packages no longer publish as `17.0.0-rc.N`. Caret ranges on -> `^16.x` hold at 16.x until you opt in, which is the reason this train is a -> major at all: its breaking density (the `ApiMethod` shrink, the GraphQL -> removal, the ADR-0104 write cutover, the dead-cluster retirements) is too high -> to auto-upgrade `^16.x` consumers into on their next install. +> **Release status: 17.2.0 is released**, and is the current version of the v17 +> line. It was published to the `latest` tag on 2026-08-23, taking over from +> 17.1.0 — published 2026-08-20, which took over from 17.0.0 — published +> 2026-08-14, closing a train that ran through `17.0.0-rc.0` … `rc.6` (the last +> of them cut 2026-08-10). A plain install now resolves 17.2.0. `changeset pre +> exit` ran with the 17.0.0 cut, so the `@objectstack/*` packages no longer +> publish as `17.0.0-rc.N`. Caret ranges on `^16.x` hold at 16.x until you opt +> in, which is the reason this train is a major at all: its breaking density +> (the `ApiMethod` shrink, the GraphQL removal, the ADR-0104 write cutover, the +> dead-cluster retirements) is too high to auto-upgrade `^16.x` consumers into +> on their next install. > -> ⚠️ **17.1.0 is a minor by version number, not by blast radius.** Several of its -> security corrections change who can read or write on an existing deployment, -> and several accept-set narrowings that landed after the 17.0.0 cut ship as -> `minor` under the lockstep launch-window convention. Read the 17.1.0 upgrade -> checklist before upgrading. +> ⚠️ **17.1.0 and 17.2.0 are minors by version number, not by blast radius.** +> Several of 17.1.0's security corrections change who can read or write on an +> existing deployment — read its upgrade checklist below. 17.2.0 adds write-path +> accept-set tightenings of the same shape: a by-id `update`/`delete` that used +> to silently drop an extra `where` predicate, or a mismatched `data.id` / +> `where.id`, now refuses loudly instead (#11009, #11142) — read **Highlights — +> 17.2.0** below before upgrading. ## Highlights — 17.0.0 @@ -149,6 +152,58 @@ parsed-but-never-enforced spec clusters are removed rather than maintained. host-performed `submitBehavior.url` redirects for consoles mounted at a sub-path. +## Highlights — 17.2.0 + +- **Two write-path guardrails close the "silently dropped predicate" hole.** A + by-id `update`/`delete` whose `where` names anything besides `id` now refuses + loudly instead of binding the row unconditionally and discarding the extra + keys — a compare-and-set written as `{ where: { id, status: {...} } }` used to + land unconditionally with no diagnostic (#11009). A by-id `update` whose + `data.id` and `where.id` are both truthy scalars that **disagree** now refuses + `UPDATE_ID_MISMATCH` (HTTP 400) instead of writing the payload row and + silently dropping the losing id (#11142). Both were unconditional writes + masquerading as conditional ones, not failures — flow `update_record` / + `delete_record` nodes that named `id` plus other filter keys without + declaring `multi: true` are where this is most likely to surface. +- **Further ADR-0049 enforce-or-remove retirements.** `sys_position.permissions` + — a security-object column no producer ever wrote and no runtime path ever + read — is gone (#9885); so are `MetricSchema.filters`, the per-metric raw-SQL + filter nothing read (#10414), the `record:highlights` field `icon` (#10054), + and the `themes` carrier key plus `ThemeSchema` — `app.branding` remains the + one color-authoring surface (#10485). +- **`http_request_errors_total` is retired** (#9834). Its only emitter never + saw the REST data API, the auth mount, or any inbound surface but the + dispatcher's own route Proxy, so the series undercounted from day one. A + dashboard or alert keyed on it now reads a flat zero — that zero is the + removal, not a healthy server. +- **Analytics stops answering the wrong number on a cross-object filter.** A + filter nested inside a combinator (`$or`, `$not`, a nested `$and`) on the + ObjectQL path used to reach `engine.aggregate` unchecked, because the + cross-object envelope check only saw a top-level AND-ed leaf; both analytics + doors now refuse it the same way a top-level cross-object filter already was + (#10759), and a dataset's own definition-level `filter` gets the identical + guard (#10861). +- **Driver introspection stops guessing.** `driver-sql`'s + `introspectPrimaryKeys` / `introspectForeignKeys` / `introspectUniqueConstraints` + used to swallow a failed read and report "no keys" with no diagnostic; a + failed read now throws by default (`{ onFailure: 'partial' }` opts back into + the old behaviour) — schema-drift comparisons and federated-object codegen + were consuming that silent absence as a real answer (#11161). +- **CLI: two dead authoring surfaces are gone.** `os g agent` is retired and + now says why and points at skills — the kernel ships exactly two agents + (`ask`/`build`) per ADR-0063 §2, so scaffolding a third was already discarded + (#10359). The `@capabilities` hook-body directive comment is retired — the + build strips the `//` comment it read before any handler is a runtime + function, so it never reached a build that used it (#10917). +- **A per-item publish naming `?package=` stops matching another package's + draft.** `POST /api/v1/meta/:type/:name/publish?package=PKG_ID` now resolves + its draft's org scope package-exactly, closing a path where the scope probe + could match a different package's draft in the caller's org and the + package-exact promote then 404'd over the caller's own publishable draft + sitting env-wide. A publish that states `?package=` no longer discovers a + package-less draft of the same `(type, name)` — retry without the query + parameter for that draft. + --- # 17.0.0 in detail