chore(deps): upgrade @objectstack/* 17.0.0-rc.5 → 17.0.0-rc.6

[huangyiirene]

Fixes #1059

Description

Upgrades every @objectstack/* dependency from 17.0.0-rc.5 to 17.0.0-rc.6 per the maintainer order on #1059, and carries the app's metadata and pinned upstream expectations across with it.

Premise verified first. The card noted only create-objectstack@17.0.0-rc.6 was confirmed as a git tag at filing. All 12 @objectstack/* packages this app depends on are published at 17.0.0-rc.6 on npm (pnpm view … versions), so the upgrade proceeded.

Six upstream behavior changes reached this app. Each was measured against an rc.5 baseline before being followed — the six affected test files were re-run on rc.5 with the bumped files stashed, and all 164 tests in them passed, confirming every failure was rc.6-induced rather than pre-existing.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code refactoring
• Performance improvement
• CI/CD update

Related Issues

Fixes #1059
Related to #728 (config/manifest/build must not diverge), #901 (rc.2 → rc.3 precedent), #973 (the zh-CN view-label guard released below)

Changes Made

• Pins + both lockfiles — all 12 @objectstack/* entries in package.json to 17.0.0-rc.6. This repo maintains two lockfiles: pnpm-lock.yaml for development (regenerated, 402 rc.6 refs) and package-lock.json for the StackBlitz demo (regenerated via npm install --package-lock-only --ignore-scripts in a temp dir off package.json alone, 360 rc.6 refs). Zero rc.5 references remain in either.

• Metadata consistency ([17.0-rc2验收] objectstack.config.ts 的 engines.protocol 仍是 ^17.0.0-rc.1,与 objectstack.manifest.json(rc.2)及 build 产物不一致 #728) — objectstack.config.ts engines.protocol and objectstack.manifest.json specVersion + engines.protocol moved to ^17.0.0-rc.6.

• filter-empty-node, a new author-time error — an empty filter node ({}) reduces to TRUE and matches every row, so it is indistinguishable from an absent key. forecast_snapshot's "find every user" query declared one; the key is deleted, which is what the rule prescribes and what the node already meant. This one failed the build, not just a test.

• $regex is retired upstream — never declared by the Filter Protocol; it compiled to a substring LIKE on SQL and a real RegExp in memory. No app metadata uses it (only three explanatory comments). The premise block in test/account-name-normalized-match.test.ts now measures the retirement itself and reaches the same conclusion through $icontains, the declared replacement: still a substring match, so still no way to express normalize-then-exact. The stored normalized column remains the answer.

• Restrict-delete message now speaks in display labels — "… 1 Event Attendee record(s) through “Event” …" instead of API names. The refusal itself is unchanged, so the two assertions follow the wording while still pinning that the message names the blocking object and field.

• ctx.permissions now enumerates member_default — the platform baseline set, alongside the app-declared profile. It is the set every member already carried (see src/sharing/demo-staffing.ts), and every reach assertion in that file is untouched, so this is enumeration, not a new grant. The negative control now pins the absence of admin_full_access directly instead of an exact one-element list.

• Approvals plugin relabelled my_pending in zh-CN — 我的待办 → 待我审批. The four docs pages that quote it follow. The guides/search-and-navigation 的《内置 vs 个人 vs 共享》(:56，三语) 举的两个"内置视图"例子都不存在：*All Open Opportunities* 与 *Pending My Approval* 在 src/ 双双零命中 #973 guard that retired 待我审批 here as "a sidebar label, not a view" is released with its reasoning recorded: the string now occurs exactly once in the shipped bundle, as that view's label, so the collision the pin guarded against is gone.

• ReportInput is retired from @objectstack/spec/ui, and Report now means the opposite shape. Not a plain rename — read from the installed .d.mts:

  	rc.5	rc.6
  ReportInput	z.input<typeof ReportSchema>	removed
  Report	z.infer (parsed)	z.input (authoring)
  ReportParsed	z.infer	z.infer (parsed)

  rc.6 moved the bare name onto the authoring shape under the ADR-0122 convention (X = input, XParsed = post-parse). The five src/reports/*.report.ts annotations follow; the underlying type is identical to what ReportInput named, so each report's typing intent is preserved. The trap worth knowing: Action, Dashboard and Page swapped the same way, and because those names survived, an annotation already saying Report / Action / Dashboard / Page changed meaning silently instead of failing to compile. Only ReportInput, removed outright, announced itself. This app uses all four on authoring literals — the side the swap made more correct — so nothing broke behaviourally. Recorded in src/reports/index.ts.

• Docs stating the installed platform version — docs/STATUS.md and content/docs/whats-new.mdx + zh-Hans/zh-Hant twins move to rc.6. docs/MAINTENANCE.md's "17.0.0-rc.5 adds os migrate summary-nulls" is left alone: it is a historical fact about which release added a migration, not a current-version claim.

• Changeset added.

Testing

• Unit tests pass — pnpm test: 80 files, 1875 passed, 1 skipped, 0 failed
• Linting passes — pnpm lint exit 0 (warnings all pre-existing advisory)
• Build succeeds — pnpm build exit 0
• Manual testing completed — see dev-server smoke check below
• New tests added (if applicable) — existing pins re-aimed at rc.6 behavior rather than new files

pnpm typecheck → exit 0
pnpm build     → exit 0  ✓ Build complete
pnpm validate  → exit 0  ✓ Validation passed
pnpm lint      → exit 0
pnpm test      → 80 files | 1875 passed | 1 skipped

On typecheck. It was missing from the first pass's verification list, and that is exactly how the ReportInput breakage reached CI: objectstack build does not typecheck app sources, so build, validate, lint, the full suite and a dev-server boot all passed green while tsc --noEmit had five errors. Type-level upstream changes are invisible to every other gate in this repo. It is in the list now and runs first.

Dev-server boot smoke check — pnpm start on a reset datastore: ✓ Server is ready, GET /_console/login → HTTP 200, SqlDriver(better-sqlite3), 38 plugins loaded, 24 flows, 18 bound to triggers. One pre-existing boot warning (inline seed exceeding its 8s budget, continuing in background); no rc.6-related boot error.

Tracked upstream-mirror re-probe

One cheap probe per card, as the issue asks — no deep dives. Probes are static (shipped schema / bundle / engine source) or in-process driver runs; nothing here required a browser or a multi-user token matrix, and the cards that do are marked skipped rather than guessed at.

Card	Verdict on rc.6
#703 permissions wildcard	behavior changed: member_default's * C/R/E wildcard is gone — objectPermissions is now {} at runtime; rc.6 source states "#5491 removed that wildcard and the platform baseline is explicit-allow"
#705 write-widening inert	behavior changed in part, needs live re-measure: the owner_only_writes / owner_only_deletes wildcard RLS floor (created_by == current_user.id) still ships, but access_level is now ['read','edit'] and the source states read and write gates match it; static evidence only
#706 campaign RLS widener regression	no cheap repro, skipped (needs a marketing_user token + live PATCH)
#700 system-insert leaves owner/org NULL	no cheap repro, skipped (needs a live scheduled-flow run)
#698 autonumber counter behind	behavior changed (platform half): counter seeding is now a complete keyset scan computing the numeric MAX per scope (#6249), replacing the arbitrary 5000-row window that seeded below the real max. Burn-on-failure not separately measured
#664 address renders as raw JSON	behavior changed: the console now ships an AddressField with a readonly formatter joining street / city / state+postal / country, instead of stringifying the object. Browser confirmation not run
#651 FlowVariableSchema.defaultValue	behavior changed: both halves closed — the schema now carries defaultValue: z.ZodOptional<z.ZodUnknown>, and the engine seeds it (else if (v.defaultValue !== void 0) variables.set(v.name, v.defaultValue))
#779 ctx.previous empty on multi: true	behavior changed: fixed — sys_fetch_previous_update is retired, and predicate writes now dispatch per-row before* hooks with previous bound to that row's pre-image (#5574 / ADR-0058 Addendum II)
#1004 page component i18n	behavior changed: the translation contract's pages gained a components face — Record(id, { title, description, label, placeholder, emptyText, submitLabel }), mirroring dashboards.widgets
#520 datetime window filter empty	unchanged on rc.6 in the good direction — defect not reproduced. In-process sqlite-wasm probe: 4 rows, last_30_days window on a datetime column returned 3/3 expected rows; date control also 3
#521 script action body FORBIDDEN	no cheap repro, skipped (needs live action dispatch under an admin session)
#522 global action not dispatched	behavior changed (dispatch half): object-less actions now have explicit machinery — GLOBAL_ACTION_OBJECT_KEY = "global", isObjectLessActionKey treating absent / "global" / "*" alike, and actionHandlerObjectKeys resolving across [objectName, "global", "*"]. The UI-swallows-failure half was not probed
#524 flow action menu / no UI echo	no cheap repro, skipped (browser)
#525 multi-tab form loses values	no cheap repro, skipped (browser)

Short measurement comments have been left on the eight cards whose behavior clearly changed.

Checklist

• I have added a changeset — .changeset/objectstack-17-0-0-rc-6.md
• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

Scope kept tight per the card. e2e/** is untouched by this branch's own commits (the merge of #1065 brings its e2e work in, unmodified). Dependabot PRs #1057 / #1058 were neither merged nor rebased — they touch package.json and are expected to self-rebase after this lands. No unrelated riders.

origin/main merged (#1064, #1065, #1067) with no conflicts. #1067 shares docs/STATUS.md and both approvals.zh-Hans/Hant.mdx with this diff; both sides' intent was verified intact line-by-line rather than trusted to the clean auto-merge.

On the test edits. Every one of them re-aims a pin at rc.6's behavior; none weakens what its test was written to establish. The two that change an assertion's shape rather than its wording — the member_default enumeration and the released #973 guard — each carry an in-file comment recording the measurement that justified it, so the next reader does not have to re-derive it.

One pre-existing docs inaccuracy noted, deliberately not fixed here (out of scope for a dependency PR, no test enforces it): content/docs/revenue/approvals.zh-Hans.mdx:86 and its Hant twin state that the Inbox sidebar entry displays as 待我审批 in zh-CN. On rc.6 that string occurs exactly once in the shipped bundle — as the my_pending view label — so the sidebar claim is now stale. It predates this branch and was presumably true on rc.5.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hotcrm	Ignored		Aug 11, 2026 6:14am