[dependabot]

Bumps objectstack-ai/objectstack/.github/actions/half-state-patrol from 0c5a71b0942d54e56ad365f0b2a173fd84c1c5e1 to ba9e0c37492cd65abb19651829910959219d5e01.

Changelog

Sourced from objectstack-ai/objectstack/.github/actions/half-state-patrol's changelog.

Changelog

All notable changes to the ObjectStack Protocol will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Where release history now lives. The platform ships as one version-locked train (changesets fixed group), so the update history is maintained in three layers rather than by hand-editing this file:

• Per-package detail — each package's CHANGELOG.md is generated by changesets from the .changeset/ entries every PR adds (including @objectstack/console, which now carries a changeset for each bundled objectui/frontend bump).
• Platform, developer-facing narrative — the curated per-major pages under https://github.com/objectstack-ai/objectstack/blob/main/content/docs/releases/ lead with breaking changes + migration and cover backend and Console (frontend). Start there.
• This file is retained for its historical entries. The [Unreleased] backlog below predates the per-major release pages; its items are released in 12.x–14.x and are being migrated into those pages — prefer them for anything new. See docs/releases-maintenance.md for the full maintenance model.

[Unreleased]

Changed — Security: anonymous access denied by default (BREAKING) + destructive-op RBAC gates

• api.requireAuth now defaults to true (ADR-0056 D2 flip): anonymous requests to /data/* CRUD + batch endpoints are rejected with HTTP 401 unless the deployment explicitly opts out with api: { requireAuth: false } (the REST plugin logs a boot warning for the explicit opt-out). Share-links, public forms (via the declaration-derived publicFormGrant), and the control plane (/auth, /health, /discovery) keep working with no action. objectstack serve passes an explicit false only for stacks with no auth tier (nothing could authenticate against them). Conformance row requireAuth-default-flip → enforced.
• transfer / restore / purge are RBAC-gated ahead of the ops (#1883): the permission evaluator maps them to allowTransfer / allowRestore / allowPurge (with the modifyAllRecords super-user bypass), so when the M2 operations ship there is no ungated window. Unmapped destructive operations keep failing closed (ADR-0049).

Added — ObjectUI one-month frontend scan + backend alignment summary

Scanning ../objectui from 2026-05-08 through 2026-06-08 shows a broad Studio and renderer push, not just the most recent commits. Major frontend changes include live field-level conditional rules in forms (visibleWhen, readonlyWhen, requiredWhen), row-scoped inline-grid rules, required-on-submit handling, spreadsheet-style master-detail line-item editing, atomic parent+child form saves, derived related lists, record-page authoring,

... (truncated)

Commits

• ba9e0c3 ci: pin credential-holding third-party actions by sha, and pass the Turbo cac...
• 35d5060 refactor(plugin-auth): move the createAuthInstance body into auth-manager-aut...
• 1361a5a fix(rest)!: compare the credential's environment with the resolved environmen...
• 025f6de docs(spec): the runAs description names a system run's refused identity-assig...
• 6abee03 fix(plugin-auth, driver-sql)!: fail closed on a missing auth secret outside d...
• ce18e73 fix(metadata-protocol): a widget probe refused by read admission names the ca...
• 9c43e19 docs(releases): fold #25541, #25550 and #25429 into the 18.1.0 notes (#25562)
• 041a120 feat(pm): the queue guard refuses a project-thread Tier S record reviewed fro...
• 03243fc ci: prune each Test Core Turbo seed to its own run's tasks before saving it (...
• 0949fe5 docs(skills): objectstack-data's security rules name the risk of renaming or ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[objectstack-fleet]

Closing: the workflow this pin lives in no longer runs. objectui's workflows were imported as files under objectstack ui/.github/workflows/, where GitHub does not execute them, and they are removed by objectstack#25712's next PR. The half-state patrol for the UI code runs from objectstack's own root workflows, and action pins there are bumped by objectstack's root Dependabot (github-actions ecosystem). Repository archive: objectstack#25854.

Closed 2026-10-26T01:39Z.

---

Generated by Claude Code

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.