fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #10835
os-zhuangpr-automation.yml
on: pull_request
Check PR Size
16s
Check Changeset
41s
Auto Label
7s
Annotations
11 notices
|
Check Changeset:
.changeset/aggregate-driver-query-and-alias-retirement.md#L0
pending major in .changeset/aggregate-driver-query-and-alias-retirement.md: @objectstack/driver-sql, @objectstack/driver-turso
|
|
Check Changeset:
.changeset/adr-0122-phase-2-bare-name-flip.md#L0
pending major in .changeset/adr-0122-phase-2-bare-name-flip.md: @objectstack/spec
|
|
Check Changeset:
.changeset/adr-0114-field-errors-rename.md#L0
pending major in .changeset/adr-0114-field-errors-rename.md: @objectstack/spec
|
|
Check Changeset:
.changeset/adr-0113-required-write-contract.md#L0
pending major in .changeset/adr-0113-required-write-contract.md: @objectstack/spec, @objectstack/objectql, @objectstack/driver-sql
|
|
Check Changeset:
.changeset/adr-0110-action-declaration-admission.md#L0
pending major in .changeset/adr-0110-action-declaration-admission.md: @objectstack/runtime
|
|
Check Changeset:
.changeset/adr-0104-d2-strict-by-default.md#L0
pending major in .changeset/adr-0104-d2-strict-by-default.md: @objectstack/runtime
|
|
Check Changeset:
.changeset/actions-failures-speak-http.md#L0
pending major in .changeset/actions-failures-speak-http.md: @objectstack/runtime
|
|
Check Changeset:
.changeset/action-session-positions-runtime-dual-emit.md#L0
pending major in .changeset/action-session-positions-runtime-dual-emit.md: @objectstack/runtime
|
|
Check Changeset:
.changeset/action-param-option-visible-when.md#L0
pending major in .changeset/action-param-option-visible-when.md: @objectstack/spec
|
|
Check Changeset:
.changeset/action-location-dual-source-c17.md#L0
pending major in .changeset/action-location-dual-source-c17.md: @objectstack/spec
|
|
Check Changeset:
.changeset/member-default-explicit-allow.md#L0
ADR-0087 exemption (no-migration-prescription): what this change removes is a VALUE in one platform-seeded sys_permission_set row, not an authorable key. No spec schema key is retired: object_permissions['*'] stays fully authorable, and admin_full_access / organization_admin / viewer_readonly still ship one. Nothing an app authored becomes invalid, nothing stored fails to parse, and the seeded row itself is rewritten by the boot seeder, so there is no stored shape for `objectstack migrate meta` to rewrite and nothing for the ledger to carry. The Migration section below prescribes a DEPLOYMENT action -- declare the object access you were relying on -- not a consumer code or metadata rewrite.
|