Skip to content

chore(deps): bump the objectstack group with 11 updates#78

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/objectstack-408b1ae6e8
Closed

chore(deps): bump the objectstack group with 11 updates#78
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/objectstack-408b1ae6e8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 28, 2026

Copy link
Copy Markdown

Bumps the objectstack group with 11 updates:

Package From To
@objectstack/account 10.2.0 11.1.0
@objectstack/cli 10.2.0 11.1.0
@objectstack/driver-sqlite-wasm 10.2.0 11.1.0
@objectstack/runtime 10.2.0 11.1.0
@objectstack/driver-memory 10.2.0 11.1.0
@objectstack/driver-sql 10.2.0 11.1.0
@objectstack/metadata 10.2.0 11.1.0
@objectstack/objectql 10.2.0 11.1.0
@objectstack/service-analytics 10.2.0 11.1.0
@objectstack/service-automation 10.2.0 11.1.0
@objectstack/spec 10.2.0 11.1.0

Updates @objectstack/account from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/account's releases.

@​objectstack/account@​11.1.0

Patch Changes

  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/platform-objects@​11.1.0
    • @​objectstack/spec@​11.1.0
Changelog

Sourced from @​objectstack/account's changelog.

11.1.0

Patch Changes

  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/platform-objects@​11.1.0
    • @​objectstack/spec@​11.1.0

11.0.0

Patch Changes

  • Updated dependencies [9b5bf3d]
  • Updated dependencies [cb5b393]
  • Updated dependencies [ab5718a]
  • Updated dependencies [4845c12]
  • Updated dependencies [c1a754a]
  • Updated dependencies [6fbe91f]
  • Updated dependencies [715d667]
  • Updated dependencies [5eef4cf]
  • Updated dependencies [72759e1]
  • Updated dependencies [6c4fbd9]
  • Updated dependencies [ef3ed67]
  • Updated dependencies [cd51229]
  • Updated dependencies [7697a0e]
  • Updated dependencies [e7e04f1]
  • Updated dependencies [cfd5ac4]
  • Updated dependencies [2be5c1f]
  • Updated dependencies [ad143ce]
  • Updated dependencies [5c4a8c8]
  • Updated dependencies [3afaeed]
  • Updated dependencies [5737261]
  • Updated dependencies [a619a3a]
  • Updated dependencies [f44c1bd]
  • Updated dependencies [8801c02]
  • Updated dependencies [3d04e06]
  • Updated dependencies [4a84c98]
  • Updated dependencies [d980f0d]

... (truncated)

Commits

Updates @objectstack/cli from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/cli's releases.

@​objectstack/client@​11.1.0

Minor Changes

  • 7087cfe: Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the Hono adapter only.

    The express / fastify / nextjs / nestjs / nuxt / sveltekit adapters and @objectstack/plugin-msw had zero internal consumers and were not dogfooded — pure release/maintenance surface (and an untested-integration liability). They are removed; @objectstack/hono (the adapter actually used, via @objectstack/client) is kept.

    • Deleted packages: @objectstack/express, @objectstack/fastify, @objectstack/nextjs, @objectstack/nestjs, @objectstack/nuxt, @objectstack/sveltekit, @objectstack/plugin-msw (fixed group 73 → 66).
    • @objectstack/client: dropped the plugin-msw / msw dev usage (MSW test removed).
    • HttpDispatcher (the dispatch engine) is now used only by the Hono adapter + the internal dispatcher-plugin, so its misleading @deprecated → createDispatcherPlugin note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected.

    Anyone needing another framework adapter can build one on the public HttpDispatcher / createDispatcherPlugin API or maintain it out-of-tree.

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0

@​objectstack/client-react@​11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
  • Updated dependencies [7087cfe]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/client@​11.1.0

@​objectstack/cli@​11.1.0

Minor Changes

... (truncated)

Changelog

Sourced from @​objectstack/cli's changelog.

11.1.0

Minor Changes

  • fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay.

    The framework's renamed env vars no longer accept their old ObjectStack names — rename them:

    removed legacy name use
    OS_MULTI_TENANT OS_MULTI_ORG_ENABLED
    OBJECTSTACK_METADATA_WRITABLE OS_METADATA_WRITABLE
    OS_AUTH_BASE_URL, AUTH_BASE_URL OS_AUTH_URL

    Ecosystem-standard names are NOT removed — they remain accepted (and no longer emit a deprecation warning, since they are permanent conventions, not legacy): DATABASE_URL, AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_URL, PORT, CORS_*, LOG_LEVEL, ROOT_DOMAIN, MCP_SERVER_*. The generic readEnvWithDeprecation helper is unchanged.

Patch Changes

  • Updated dependencies [574e7a3]
  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [18f9713]
  • Updated dependencies [7cf81a7]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [8c84c97]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [13dbcf2]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [dc2990f]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [fdb41c0]
  • Updated dependencies [63d5403]
  • Updated dependencies [7087cfe]
  • Updated dependencies [69ae136]
    • @​objectstack/plugin-security@​11.1.0
    • @​objectstack/plugin-auth@​11.1.0
    • @​objectstack/platform-objects@​11.1.0
    • @​objectstack/core@​11.1.0

... (truncated)

Commits
  • 89e80b4 chore: version packages
  • fdb41c0 feat(types)!: remove ObjectStack's own legacy env-var aliases (11.0, #2379) (...
  • 80fe2ef chore: version packages (#2382)
  • ab5718a feat(plugin-auth): reject breached passwords via HIBP (ADR-0069 D1, P1) (#2361)
  • 914aaa9 fix(cli): redirect Console on a bare/reserved platform host to the cloud cons...
  • d980f0d feat: add a first-class user field type (person picker) (#2351)
  • 795b6d1 refactor: single-source the multi-org (OS_MULTI_ORG_ENABLED) flag (#2350)
  • a6f0b7f feat(serve): thread api.enforceProjectMembership to the dispatcher (ADR-0024 ...
  • 21d4f89 feat(framework)!: remove service-ai — open edition is MCP-only (ADR-0025 S2) ...
  • 4845c12 feat(cli): make the AI service opt-in via a declared dependency (Community-Ed...
  • Additional commits viewable in compare view

Updates @objectstack/driver-sqlite-wasm from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/driver-sqlite-wasm's releases.

@​objectstack/driver-sqlite-wasm@​11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/driver-sql@​11.1.0
Changelog

Sourced from @​objectstack/driver-sqlite-wasm's changelog.

11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/driver-sql@​11.1.0

11.0.0

Patch Changes

  • Updated dependencies [ab5718a]
  • Updated dependencies [4845c12]
  • Updated dependencies [c1a754a]
  • Updated dependencies [6fbe91f]
  • Updated dependencies [715d667]
  • Updated dependencies [5eef4cf]
  • Updated dependencies [72759e1]
  • Updated dependencies [6c4fbd9]
  • Updated dependencies [ef3ed67]
  • Updated dependencies [cd51229]
  • Updated dependencies [7697a0e]
  • Updated dependencies [e7e04f1]
  • Updated dependencies [cfd5ac4]
  • Updated dependencies [2be5c1f]
  • Updated dependencies [ad143ce]
  • Updated dependencies [5c4a8c8]
  • Updated dependencies [3afaeed]
  • Updated dependencies [8801c02]
  • Updated dependencies [3d04e06]
  • Updated dependencies [98a1535]
  • Updated dependencies [bc22a89]
  • Updated dependencies [8a7e9f1]
  • Updated dependencies [4a84c98]
  • Updated dependencies [c715d25]
  • Updated dependencies [aa33b02]
  • Updated dependencies [d980f0d]
  • Updated dependencies [a658523]
  • Updated dependencies [82ff91c]
  • Updated dependencies [638f472]
    • @​objectstack/spec@​11.0.0
    • @​objectstack/driver-sql@​11.0.0
    • @​objectstack/core@​11.0.0

... (truncated)

Commits

Updates @objectstack/runtime from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/runtime's releases.

@​objectstack/runtime@​11.1.0

Minor Changes

  • e011d42: Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story

    Two follow-ups that make enforced MFA total:

    • Per-org sys_organization.require_mfa — an org may require MFA above the global floor. computeAuthGate now treats the active org's require_mfa as an effective MFA requirement even when the global mfa_required is off; isAuthGateActive() stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries.
    • Dispatcher/MCP gate — the auth-policy gate now also runs in the runtime dispatcher (after resolveExecutionContext), so MCP / GraphQL / embedded data paths enforce PASSWORD_EXPIRED / MFA_REQUIRED consistently with the REST seam (reusing the shared evaluateAuthGate allow-list). Previously only the REST surface (the Console) was gated.

    Default-off / additive. Per ADR-0049 each setting ships with its enforcement.

Patch Changes

  • 7087cfe: Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the Hono adapter only.

    The express / fastify / nextjs / nestjs / nuxt / sveltekit adapters and @objectstack/plugin-msw had zero internal consumers and were not dogfooded — pure release/maintenance surface (and an untested-integration liability). They are removed; @objectstack/hono (the adapter actually used, via @objectstack/client) is kept.

    • Deleted packages: @objectstack/express, @objectstack/fastify, @objectstack/nextjs, @objectstack/nestjs, @objectstack/nuxt, @objectstack/sveltekit, @objectstack/plugin-msw (fixed group 73 → 66).
    • @objectstack/client: dropped the plugin-msw / msw dev usage (MSW test removed).
    • HttpDispatcher (the dispatch engine) is now used only by the Hono adapter + the internal dispatcher-plugin, so its misleading @deprecated → createDispatcherPlugin note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected.

    Anyone needing another framework adapter can build one on the public HttpDispatcher / createDispatcherPlugin API or maintain it out-of-tree.

  • 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0)

    Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS recipes are rewritten from Fastify to Hono (the shipped adapter; the old @objectstack/fastify import was broken), CSRF guidance points at hono/csrf, and stale @objectstack/plugin-msw references are dropped from the driver-memory and driver-turso docs. README framework lists narrowed to Hono.

  • Updated dependencies [574e7a3]

  • Updated dependencies [cbc8c02]

  • Updated dependencies [18f9713]

  • Updated dependencies [7cf81a7]

  • Updated dependencies [d7a88df]

  • Updated dependencies [4f8f108]

  • Updated dependencies [ce0b4f6]

  • Updated dependencies [90bce88]

  • Updated dependencies [3209ec6]

... (truncated)

Changelog

Sourced from @​objectstack/runtime's changelog.

11.1.0

Minor Changes

  • e011d42: Auth: per-org MFA + dispatcher/MCP gate — complete the ADR-0069 enforced-MFA story

    Two follow-ups that make enforced MFA total:

    • Per-org sys_organization.require_mfa — an org may require MFA above the global floor. computeAuthGate now treats the active org's require_mfa as an effective MFA requirement even when the global mfa_required is off; isAuthGateActive() stays cheap via a 60s-TTL "any org requires MFA" cache (lazy background refresh), so a brand-new per-org requirement activates the gate on the next request without per-request org queries.
    • Dispatcher/MCP gate — the auth-policy gate now also runs in the runtime dispatcher (after resolveExecutionContext), so MCP / GraphQL / embedded data paths enforce PASSWORD_EXPIRED / MFA_REQUIRED consistently with the REST seam (reusing the shared evaluateAuthGate allow-list). Previously only the REST surface (the Console) was gated.

    Default-off / additive. Per ADR-0049 each setting ships with its enforcement.

Patch Changes

  • 7087cfe: Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the Hono adapter only.

    The express / fastify / nextjs / nestjs / nuxt / sveltekit adapters and @objectstack/plugin-msw had zero internal consumers and were not dogfooded — pure release/maintenance surface (and an untested-integration liability). They are removed; @objectstack/hono (the adapter actually used, via @objectstack/client) is kept.

    • Deleted packages: @objectstack/express, @objectstack/fastify, @objectstack/nextjs, @objectstack/nestjs, @objectstack/nuxt, @objectstack/sveltekit, @objectstack/plugin-msw (fixed group 73 → 66).
    • @objectstack/client: dropped the plugin-msw / msw dev usage (MSW test removed).
    • HttpDispatcher (the dispatch engine) is now used only by the Hono adapter + the internal dispatcher-plugin, so its misleading @deprecated → createDispatcherPlugin note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected.

    Anyone needing another framework adapter can build one on the public HttpDispatcher / createDispatcherPlugin API or maintain it out-of-tree.

  • 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0)

    Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS recipes are rewritten from Fastify to Hono (the shipped adapter; the old @objectstack/fastify import was broken), CSRF guidance points at hono/csrf, and stale @objectstack/plugin-msw references are dropped from the driver-memory and driver-turso docs. README framework lists narrowed to Hono.

  • Updated dependencies [574e7a3]

  • Updated dependencies [cbc8c02]

  • Updated dependencies [18f9713]

  • Updated dependencies [7cf81a7]

  • Updated dependencies [d7a88df]

  • Updated dependencies [4f8f108]

  • Updated dependencies [ce0b4f6]

  • Updated dependencies [90bce88]

... (truncated)

Commits
  • 89e80b4 chore: version packages
  • e011d42 feat(auth): per-org MFA + dispatcher/MCP gate (ADR-0069 D3) (#2395)
  • 69ae136 docs: align hardening + driver docs with Hono-only adapters (#2392, 12.0) (#2...
  • 7087cfe chore!: remove unused HTTP adapters (keep Hono only) + MSW plugin (12.0) (#2391)
  • fdb41c0 feat(types)!: remove ObjectStack's own legacy env-var aliases (11.0, #2379) (...
  • 80fe2ef chore: version packages (#2382)
  • c715d25 chore(license): unify framework repo to single Apache-2.0 (#2353)
  • 795b6d1 refactor: single-source the multi-org (OS_MULTI_ORG_ENABLED) flag (#2350)
  • aa33b02 fix(security): single-source the request authorization resolver (REST dropped...
  • 6ad6bf6 fix(runtime): accept integer ai_access (Turso) in the AI-seat synthesis (#2336)
  • Additional commits viewable in compare view

Updates @objectstack/driver-memory from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/driver-memory's releases.

@​objectstack/driver-memory@​11.1.0

Patch Changes

  • 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0)

    Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS recipes are rewritten from Fastify to Hono (the shipped adapter; the old @objectstack/fastify import was broken), CSRF guidance points at hono/csrf, and stale @objectstack/plugin-msw references are dropped from the driver-memory and driver-turso docs. README framework lists narrowed to Hono.

  • Updated dependencies [ce0b4f6]

  • Updated dependencies [9ccfcd6]

  • Updated dependencies [ecf193f]

  • Updated dependencies [51bec81]

  • Updated dependencies [3e593a7]

  • Updated dependencies [63d5403]

    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
Changelog

Sourced from @​objectstack/driver-memory's changelog.

11.1.0

Patch Changes

  • 69ae136: docs: align hardening / driver docs with the Hono-only adapter surface (12.0)

    Follow-up to the adapter trim (#2391): the hardening guide's rate-limit/CORS recipes are rewritten from Fastify to Hono (the shipped adapter; the old @objectstack/fastify import was broken), CSRF guidance points at hono/csrf, and stale @objectstack/plugin-msw references are dropped from the driver-memory and driver-turso docs. README framework lists narrowed to Hono.

  • Updated dependencies [ce0b4f6]

  • Updated dependencies [9ccfcd6]

  • Updated dependencies [ecf193f]

  • Updated dependencies [51bec81]

  • Updated dependencies [3e593a7]

  • Updated dependencies [63d5403]

    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0

11.0.0

Patch Changes

  • Updated dependencies [ab5718a]
  • Updated dependencies [4845c12]
  • Updated dependencies [c1a754a]
  • Updated dependencies [6fbe91f]
  • Updated dependencies [715d667]
  • Updated dependencies [5eef4cf]
  • Updated dependencies [72759e1]
  • Updated dependencies [6c4fbd9]
  • Updated dependencies [ef3ed67]
  • Updated dependencies [cd51229]
  • Updated dependencies [7697a0e]
  • Updated dependencies [e7e04f1]
  • Updated dependencies [cfd5ac4]
  • Updated dependencies [2be5c1f]
  • Updated dependencies [ad143ce]
  • Updated dependencies [5c4a8c8]
  • Updated dependencies [3afaeed]
  • Updated dependencies [8801c02]
  • Updated dependencies [3d04e06]
  • Updated dependencies [4a84c98]
  • Updated dependencies [c715d25]
  • Updated dependencies [aa33b02]
  • Updated dependencies [d980f0d]
  • Updated dependencies [a658523]
  • Updated dependencies [82ff91c]

... (truncated)

Commits
  • 89e80b4 chore: version packages
  • 69ae136 docs: align hardening + driver docs with Hono-only adapters (#2392, 12.0) (#2...
  • 3e593a7 feat(spec)!: remove deprecated DriverInterface alias — use IDataDriver (11.0,...
  • 80fe2ef chore: version packages (#2382)
  • c715d25 chore(license): unify framework repo to single Apache-2.0 (#2353)
  • 23c0f9a chore: version packages (#2245)
  • See full diff in compare view

Updates @objectstack/driver-sql from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/driver-sql's releases.

@​objectstack/driver-sqlite-wasm@​11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/driver-sql@​11.1.0

@​objectstack/driver-sql@​11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [fdb41c0]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/types@​11.1.0
Changelog

Sourced from @​objectstack/driver-sql's changelog.

11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [fdb41c0]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/types@​11.1.0

11.0.0

Minor Changes

  • d980f0d: feat: add a first-class user field type (person picker)

    A new user field type — the equivalent of Airtable's Collaborator / Notion's Person / Salesforce's Lookup(User). Authored as Field.user({ ... }); use { multiple: true } for collaborators/watchers and { defaultValue: 'current_user' } to auto-fill the acting user on create.

    Why a distinct type rather than telling authors to Field.lookup('sys_user'): selecting a person is table-stakes, but the value is in modelling discoverability — a "User" entry in the Studio/AI field palette instead of requiring authors (and AI) to know to reference the internal sys_user system object — plus current_user defaults and a user-search picker. Storage and runtime are unchanged.

    Deliberately NOT a new storage primitive. user is a semantic specialization of lookup with the target fixed to sys_user: it shares the exact lookup code path — same FK string column (multiple ⇒ JSON), same $expand resolution, same indexing — so referential integrity and fresh display names come for free, and nothing is re-implemented. An existing Field.lookup('sys_user') is therefore equivalent at the storage layer (zero data migration to adopt Field.user).

    Ownership semantics are unchanged: the existing owner_id convention + plugin-security auto-stamp/RLS still apply. A declarative owner flag is a possible future follow-up; intentionally not added here to avoid a second field type for what is a system role (rationale: keep the FieldType surface lean — see related ADR-0059 freeze discipline).

    Changes: FieldType gains 'user' + Field.user() builder; the SQL/Mongo drivers treat user exactly like lookup; the engine resolves $expand for user fields and honours a new defaultValue: 'current_user' token (resolved

... (truncated)

Commits
  • 89e80b4 chore: version packages
  • 3e593a7 feat(spec)!: remove deprecated DriverInterface alias — use IDataDriver (11.0,...
  • fdb41c0 feat(types)!: remove ObjectStack's own legacy env-var aliases (11.0, #2379) (...
  • 80fe2ef chore: version packages (#2382)
  • c715d25 chore(license): unify framework repo to single Apache-2.0 (#2353)
  • d980f0d feat: add a first-class user field type (person picker) (#2351)
  • 795b6d1 refactor: single-source the multi-org (OS_MULTI_ORG_ENABLED) flag (#2350)
  • bc22a89 fix(driver-sql): present Field.time as a wall-clock time-of-day on read (SQLi...
  • 8a7e9f1 fix(driver-sql): canonical ISO-8601-Z for user NOW()-default temporal fields ...
  • 98a1535 fix(driver-sql): canonical ISO-8601-Z audit timestamps on SQLite (ADR-0074) (...
  • Additional commits viewable in compare view

Updates @objectstack/metadata from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/metadata's releases.

@​objectstack/metadata-protocol@​11.1.0

Minor Changes

  • 13dbcf2: Extract metadata management into @objectstack/metadata-protocol (ADR-0076)

    protocol.ts (the ObjectStackProtocol implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its sys-metadata-repository, metadata-diagnostics, seed-loader, and build-probes helpers were metadata-domain code that lived inside @objectstack/objectql for historical reasons. They now live in a dedicated @objectstack/metadata-protocol package.

    The protocol no longer depends on the concrete ObjectQL class — it is typed against an injected MetadataHostEngine interface (the engine is still injected at runtime). Dependency direction is now one-way (objectql → metadata-protocol); there is no cycle.

    Non-breaking: @objectstack/objectql re-exports every previously public symbol (ObjectStackProtocolImplementation, SysMetadataRepository, SysMetadataEngine, SeedLoaderService, runBuildProbes, …), so existing imports keep working.

    This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so objectql itself stops depending on it (making the engine lean by construction).

    Also adds a lean @objectstack/objectql/core entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull @objectstack/metadata-protocol into its bundle. A boundary ratchet test guards the entry.

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [fdb41c0]
  • Updated dependencies [63d5403]
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/types@​11.1.0
    • @​objectstack/formula@​11.1.0
    • @​objectstack/metadata-core@​11.1.0

@​objectstack/metadata-fs@​11.1.0

Patch Changes

  • @​objectstack/metadata-core@​11.1.0

@​objectstack/metadata@​11.1.0

Patch Changes

  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]

... (truncated)

Changelog

Sourced from @​objectstack/metadata's changelog.

11.1.0

Patch Changes

  • Updated dependencies [cbc8c02]
  • Updated dependencies [07c2773]
  • Updated dependencies [d7a88df]
  • Updated dependencies [4f8f108]
  • Updated dependencies [ce0b4f6]
  • Updated dependencies [90bce88]
  • Updated dependencies [3209ec6]
  • Updated dependencies [e011d42]
  • Updated dependencies [6e5bdd5]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [ecf193f]
  • Updated dependencies [51bec81]
  • Updated dependencies [3e593a7]
  • Updated dependencies [fdb41c0]
  • Updated dependencies [63d5403]
    • @​objectstack/platform-objects@​11.1.0
    • @​objectstack/core@​11.1.0
    • @​objectstack/spec@​11.1.0
    • @​objectstack/types@​11.1.0
    • @​objectstack/metadata-core@​11.1.0
    • @​objectstack/metadata-fs@​11.1.0

11.0.0

Patch Changes

  • 4b5ec6e: fix(automation): re-bind scheduled-flow jobs on os dev hot-reload

    Editing a schedule-triggered flow under objectstack dev silently kept firing the OLD definition until a full server restart. The dev watcher recompiles dist/objectstack.json and MetadataPlugin reloads it into the MetadataManager (so GET /meta reads + UI HMR are fresh), but the AutomationEngine pulls its flow definitions and trigger/job bindings ONCE at boot — nothing re-registered them on reload. So the scheduled job bound at boot kept running the pre-edit flow (old runAs, schedule, or logic) on its timer, with no signal that the edit had no effect.

    Fix: MetadataPlugin now fires a generic metadata:reloaded hook after each artifact reload (the HMR POST handler and the server-side artifact-file watcher; never on the initial boot load). AutomationServicePlugin subscribes and re-syncs the engine from the metadata service — re-registering every current flow (idempotent: registerFlow re-binds the trigger, and ScheduleTrigger.start cancels + reschedules the job) and unregistering flows removed from the artifact so their jobs stop firing. This covers all auto-triggered flow types (schedule / record-change / api), not just scheduled ones, since record-change flows were also executing their boot-time definitions after an edit. Production

... (truncated)

Commits

Updates @objectstack/objectql from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/objectql's releases.

@​objectstack/objectql@​11.1.0

Minor Changes

  • 13dbcf2: Extract metadata management into @objectstack/metadata-protocol (ADR-0076)

    protocol.ts (the ObjectStackProtocol implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its sys-metadata-repository, metadata-diagnostics, seed-loader, and build-probes helpers were metadata-domain code that lived inside @objectstack/objectql for historical reasons. They now live in a dedicated @objectstack/metadata-protocol package.

    The protocol no longer depends on the concrete ObjectQL class — it is typed against an injected MetadataHostEngine interface (the engine is still injected at runtime). Dependency direction is now one-way (objectql → metadata-protocol); there is no cycle.

    Non-breaking: @objectstack/objectql re-exports every previously public symbol (ObjectStackProtocolImplementation, SysMetadataRepository, SysMetadataEngine, SeedLoaderService, runBuildProbes, …), so existing imports keep working.

    This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so objectql itself stops depending on it (making the engine lean by construction).

    Also adds a lean @objectstack/objectql/core entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull @objectstack/metadata-protocol into its bundle. A boundary ratchet test guards the entry.

  • 3e593a7: Remove the deprecated DriverInterface type alias — use IDataDriver (11.0).

    DriverInterface was a @deprecated alias of IDataDriver (the authoritative driver contract). It is removed from @objectstack/spec/contracts and @objectstack/core; objectql's engine now types drivers as IDataDriver directly (a type-identical change, since the alias was IDataDriver).

    Driver authors: replace DriverInterface with IDataDriver (same shape).

    Note: this is unrelated to the live IDataEngine interface (engine-layer contract, not deprecated) and to the separate zod-derived DriverInterface / DriverInterfaceSchema in @objectstack/spec/data (the runtime driver schema), both of which are unchanged.

  • fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay.

    The framework's renamed env vars no longer accept their old ObjectStack names — rename them:

    removed legacy name use
    OS_MULTI_TENANT OS_MULTI_ORG_ENABLED
    OBJECTSTACK_METADATA_WRITABLE OS_METADATA_WRITABLE
    OS_AUTH_BASE_URL, AUTH_BASE_URL OS_AUTH_URL

    Ecosystem-standard names are NOT removed — they remain accepted (and no longer emit a deprecation warning, since they are permanent conventions, not legacy): DATABASE_URL, AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_URL, PORT, CORS_*, LOG_LEVEL, ROOT_DOMAIN, MCP_SERVER_*. The generic readEnvWithDeprecation helper is unchanged.

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [13dbcf2]

... (truncated)

Changelog

Sourced from @​objectstack/objectql's changelog.

11.1.0

Minor Changes

  • 13dbcf2: Extract metadata management into @objectstack/metadata-protocol (ADR-0076)

    protocol.ts (the ObjectStackProtocol implementation — sys_metadata CRUD, draft/publish, locks, package ownership, diagnostics) plus its sys-metadata-repository, metadata-diagnostics, seed-loader, and build-probes helpers were metadata-domain code that lived inside @objectstack/objectql for historical reasons. They now live in a dedicated @objectstack/metadata-protocol package.

    The protocol no longer depends on the concrete ObjectQL class — it is typed against an injected MetadataHostEngine interface (the engine is still injected at runtime). Dependency direction is now one-way (objectql → metadata-protocol); there is no cycle.

    Non-breaking: @objectstack/objectql re-exports every previously public symbol (ObjectStackProtocolImplementation, SysMetadataRepository, SysMetadataEngine, SeedLoaderService, runBuildProbes, …), so existing imports keep working.

    This is Step 1 of ADR-0076. A later step turns the protocol into a capability plugin so objectql itself stops depending on it (making the engine lean by construction).

    Also adds a lean @objectstack/objectql/core entry — the engine/registry/hooks/validation surface only, with no kernel plugin or metadata protocol — so a thin embedder can import just the engine and never pull @objectstack/metadata-protocol into its bundle. A boundary ratchet test guards the entry.

  • 3e593a7: Remove the deprecated DriverInterface type alias — use IDataDriver (11.0).

    DriverInterface was a @deprecated alias of IDataDriver (the authoritative driver contract). It is removed from @objectstack/spec/contracts and @objectstack/core; objectql's engine now types drivers as IDataDriver directly (a type-identical change, since the alias was IDataDriver).

    Driver authors: replace DriverInterface with IDataDriver (same shape).

    Note: this is unrelated to the live IDataEngine interface (engine-layer contract, not deprecated) and to the separate zod-derived DriverInterface / DriverInterfaceSchema in @objectstack/spec/data (the runtime driver schema), both of which are unchanged.

  • fdb41c0: Remove ObjectStack's own legacy env-var aliases (11.0); ecosystem-standard names stay.

    The framework's renamed env vars no longer accept their old ObjectStack names — rename them:

    removed legacy name use
    OS_MULTI_TENANT OS_MULTI_ORG_ENABLED
    OBJECTSTACK_METADATA_WRITABLE OS_METADATA_WRITABLE
    OS_AUTH_BASE_URL, AUTH_BASE_URL OS_AUTH_URL

    Ecosystem-standard names are NOT removed — they remain accepted (and no longer emit a deprecation warning, since they are permanent conventions, not legacy): DATABASE_URL, AUTH_SECRET, BETTER_AUTH_SECRET, BETTER_AUTH_URL, PORT, CORS_*, LOG_LEVEL, ROOT_DOMAIN, MCP_SERVER_*. The generic readEnvWithDeprecation helper is unchanged.

Patch Changes

  • Updated dependencies [ce0b4f6]

... (truncated)

Commits
  • 89e80b4 chore: version packages
  • 13dbcf2 refactor(objectql): extract metadata-protocol + add lean ./core entry (ADR-00...
  • 3e593a7 feat(spec)!: remove deprecated DriverInterface alias — use IDataDriver (11.0,...
  • fdb41c0 feat(types)!: remove ObjectStack's own legacy env-var aliases (11.0, #2379) (...
  • 80fe2ef chore: version packages (#2382)
  • c584e21 fix(objectql): stamp the tenant org-key onto un-pinned business seed rows (#2...
  • c715d25 chore(license): unify framework repo to single Apache-2.0 (#2353)
  • d980f0d feat: add a first-class user field type (person picker) (#2351)
  • 795b6d1 refactor: single-source the multi-org (OS_MULTI_ORG_ENABLED) flag (#2350)
  • c224e18 feat(objectql): adopt orphaned metadata into a base — ADR-0070 D5 migration (...
  • Additional commits viewable in compare view

Updates @objectstack/service-analytics from 10.2.0 to 11.1.0

Release notes

Sourced from @​objectstack/service-analytics's releases.

@​objectstack/service-analytics@​11.1.0

Patch Changes

  • Updated dependencies [ce0b4f6]
  • Updated dependencies [9ccfcd6]
  • Updated dependencies [...

    Description has been truncated

Bumps the objectstack group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [@objectstack/account](https://github.com/objectstack-ai/framework/tree/HEAD/packages/apps/account) | `10.2.0` | `11.1.0` |
| [@objectstack/cli](https://github.com/objectstack-ai/framework/tree/HEAD/packages/cli) | `10.2.0` | `11.1.0` |
| [@objectstack/driver-sqlite-wasm](https://github.com/objectstack-ai/framework/tree/HEAD/packages/plugins/driver-sqlite-wasm) | `10.2.0` | `11.1.0` |
| [@objectstack/runtime](https://github.com/objectstack-ai/framework/tree/HEAD/packages/runtime) | `10.2.0` | `11.1.0` |
| [@objectstack/driver-memory](https://github.com/objectstack-ai/framework/tree/HEAD/packages/plugins/driver-memory) | `10.2.0` | `11.1.0` |
| [@objectstack/driver-sql](https://github.com/objectstack-ai/framework/tree/HEAD/packages/plugins/driver-sql) | `10.2.0` | `11.1.0` |
| [@objectstack/metadata](https://github.com/objectstack-ai/framework/tree/HEAD/packages/metadata) | `10.2.0` | `11.1.0` |
| [@objectstack/objectql](https://github.com/objectstack-ai/framework/tree/HEAD/packages/objectql) | `10.2.0` | `11.1.0` |
| [@objectstack/service-analytics](https://github.com/objectstack-ai/framework/tree/HEAD/packages/services/service-analytics) | `10.2.0` | `11.1.0` |
| [@objectstack/service-automation](https://github.com/objectstack-ai/framework/tree/HEAD/packages/services/service-automation) | `10.2.0` | `11.1.0` |
| [@objectstack/spec](https://github.com/objectstack-ai/framework/tree/HEAD/packages/spec) | `10.2.0` | `11.1.0` |


Updates `@objectstack/account` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/apps/account/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/account@11.1.0/packages/apps/account)

Updates `@objectstack/cli` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/cli@11.1.0/packages/cli)

Updates `@objectstack/driver-sqlite-wasm` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/plugins/driver-sqlite-wasm/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/driver-sqlite-wasm@11.1.0/packages/plugins/driver-sqlite-wasm)

Updates `@objectstack/runtime` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/runtime/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/runtime@11.1.0/packages/runtime)

Updates `@objectstack/driver-memory` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/plugins/driver-memory/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/driver-memory@11.1.0/packages/plugins/driver-memory)

Updates `@objectstack/driver-sql` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/plugins/driver-sql/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/driver-sql@11.1.0/packages/plugins/driver-sql)

Updates `@objectstack/metadata` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/metadata/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/metadata@11.1.0/packages/metadata)

Updates `@objectstack/objectql` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/objectql/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/objectql@11.1.0/packages/objectql)

Updates `@objectstack/service-analytics` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/services/service-analytics/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/service-analytics@11.1.0/packages/services/service-analytics)

Updates `@objectstack/service-automation` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/services/service-automation/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/service-automation@11.1.0/packages/services/service-automation)

Updates `@objectstack/spec` from 10.2.0 to 11.1.0
- [Release notes](https://github.com/objectstack-ai/framework/releases)
- [Changelog](https://github.com/objectstack-ai/framework/blob/main/packages/spec/CHANGELOG.md)
- [Commits](https://github.com/objectstack-ai/framework/commits/@objectstack/spec@11.1.0/packages/spec)

---
updated-dependencies:
- dependency-name: "@objectstack/account"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/cli"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-sqlite-wasm"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/runtime"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-memory"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/driver-sql"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/metadata"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/objectql"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/service-analytics"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/service-automation"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
- dependency-name: "@objectstack/spec"
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: objectstack
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 28, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 29, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/objectstack-408b1ae6e8 branch June 29, 2026 15:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants