docs(releases): compile the v17 release page for the 17.0.0 cut

[qq9340100]

v17 development is complete, so content/docs/releases/v17.mdx is brought up to the state of the train. Docs-only — one file, +555/−10.

Compiled from the changesets, per the CLAUDE.md rule that release notes are written centrally at release time: pending work is everything in .changeset/*.md not yet recorded in .changeset/pre.json.

What changed

Closes the rc.5 window against the cut that consumed it. That section was written as open against 135 pending changesets. The rc.6 cut (e7e0a6d, 2026-08-10) actually released 425 — 36 major-class, 123 minor, 266 patch, making it the largest round of the train, ahead of rc.4's 360.

Because the window closed well past its draft, the landings that arrived in between are added: the single driver vocabulary (mongo → mongodb, #6345), the ADR-0045 publish gate's own machine-managed key (#4829), the doors that were open only by omission (resumeAuthority fail-closed#5561, runtime api create withdrawn #5488, registerHook empty target), and the enforce-or-remove tail across notifications (#6361), ExportFieldMeta (#6536), import (#6704), aggregation, action and SDUI surfaces (#5775, #6776). The Console pin move is marked released as @objectstack/console 17.0.0-rc.6.

Adds ## Landed since 17.0.0-rc.6 — the open, final window: 374 pending — 11 major-class, 99 minor, 264 patch. Its spine is the credential story (#7990, #8082, #8336, #8075): inline credential keys, URL-embedded userinfo and ${…} placeholders are refused at publish, the two dead credential-sink families are removed, and what was already stored is encrypted, redacted or marked internal. Also covered: the driver-text disclosure class, per-organization uniqueness, $field cross-field comparison, closed query-parameter ingress (#7606), the audit trail's missing writers, and the three Console pin moves (0cf8f0f70d10 → 665661ab0932).

Extends the upgrade checklist with the new breaking work — credentials first, since it is the one item with no codemod, then driver names, memory-driver tenancy, unknown query parameters, MongoDB $contains case sensitivity, view.exportOptions, runtime field creation, cross-tenant uninstall, number scale, audit-log action enum.

Refreshes the release-status note and adds rc.2 / rc.6 reference lines.

Verification

• node scripts/check-release-notes.mjs → OK
• node scripts/check-doc-authoring.mjs → 377 files clean
• Headings checked for uniqueness — three of the new sub-headings initially collided with the rc.1 window's (Security corrections in this window, Protocol & wire changes, New backend capabilities in this window) and were renamed to … since rc.6 so anchors stay distinct. Code fences balanced; no new links.
• The 425 figure was cross-checked two ways: .changeset/pre.json consumption across the cut (1279 → 1704 = 425) and de-duplicated top-level entries across the 69 packages' ## 17.0.0-rc.6 changelog sections (419). The same script reproduces the previously published per-cut numbers within a few entries, and ranks rc.6 above rc.4 under both methods.
• check-doc-anchors.mjs could not run — it needs github-slugger and the worktree has no node_modules. No links were added, and no existing heading was renamed or removed, so no inbound anchor changes.

Notes

Releases nothing, so this needs the skip-changeset label.

The rc.6 window is described as open. If the exit-pre cut lands before this merges, its intro paragraph needs the same close-out treatment applied here to rc.5 — final counts and roll into 17.0.0.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 14, 2026 6:15am