Repository navigation
chore(core): upgrade to ObjectStack 18.3.0 and retire the fixed workarounds - #99
Merged
Merged
Conversation
…rounds - Pin every @objectstack/* package and the CLI overrides to 18.3.0 and require protocol ^18.3.0. - Translate positions, permission sets and the delivery report through the translation bundle (18.3.0 makes them translatable; objectstack#25652, objectui#13470). Drop the zh-CN bundle that only carried KPI help texts (objectstack#25683). - Retire the objectui#13436 id guard on the bank account and change request readonlyWhen conditions, hide risk_level from the portal again (objectstack#25672) and show the supplier as the audit calendar title (objectui#13471). - srm_admin no longer uses modifyAllRecords on performance reviews: 18.3.0 lets it override the set's own read-only field mask, so the admin could change scores. Deletion now comes from delete/update row policies on the admin set, and every field stays read-only. - Tests: file fields only take files the writer may open (objectstack#25692), so test uploads carry an owner; direct flow triggers name the record's object, and a portal user's trigger on another supplier's record is now refused at the door with 404 (objectstack#29050). Flow roster checks stay as a second line. - Import trials: rows sharing a match key are no longer written (objectstack#26133) and a second primary contact in one sheet is refused (objectstack#25579); re-pin both trials and update the import guides. - Record the 18.3.0 status of every platform dependency in 07 §6. Features that change behaviour are follow-ups: #96 (excludeSubmitter), #97 (import features), #98 (e-mail links, non-portal contacts, api heartbeat); #95 now uses referenceNameVisible per the director ruling. Claude-Session: https://claude.ai/code/session_017ihL2gLXX4axWXAm8MYCPE Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by 田騏 · project thread
What
Upgrade from ObjectStack 18.1.0 to 18.3.0 (released 2026-11-03), following the 18.1.0 upgrade (#84).
Upgrade
@objectstack/*pins, CLI overrides andengines.protocol→ 18.3.0.Workarounds retired (fixed in 18.3.0)
readonlyWhenid guard removed from bank account and change request (disposition keeps it, since "only on create" there means "saved").risk_levelagain; supplier search still works (new assertion intest/portal-isolation.test.ts).Behaviour changes in 18.3.0 handled here
modifyAllRecordsnow overrides the same set's read-only field mask (lintsecurity-superuser-field-mask-inert), sosrm_admincould edit performance-review scores. Replaced withallowEdit+allowDeleteand two row policies (delete, update) scoped to performance reviews; all fields stay read-only for the admin. Reviews are system-generated with no owner, so neither ownership norwriteScopecan admit the delete.test/support/files.ts).recordIdas the caller first; a portal user's direct trigger on another supplier's record is now a 404 before any run. Tests assert that; the in-flow roster checks stay as a second line (they still refuse internal users and plain portal users who can read the record). Direct triggers needobjectName, whichstack.flows.runcannot send, so tests usetest/support/flows.ts.Docs: 07 §6.1 / §6.3 status column now reflects 18.3.0 for every platform issue, plus a short list of 18.3.0 behaviour changes; 03/04/05/06 notes updated.
Not in this PR (platform feature available, adopting it changes behaviour): #96 approval
excludeSubmitter(PF5), #97 import create-only columns / ordered match keys / transforms (PF8, PF9, PF11), #98{{baseUrl}}links, mail to non-portal contacts, SCAR api heartbeat (PF20, PF3, #25675). #95 will usereferenceNameVisible(director ruling 2026-11-03, posted on #95) after this merges.How it was verified
pnpm verify(validate, lint --strict, typecheck, i18n --strict, 358 tests, build) green locally.pnpm setup:local(18.3.0): two portal users opened through the real invite → sign-up → accept → 开通门户 flow. 27 REST isolation checks passed: list/search/query across 12 portal objects show no other supplier's rows, by-id read of the other supplier is 404, direct trigger on the other supplier's record is 404 and withoutobjectName400,sys_usershows only self, material catalogue refused, and after the contact is deactivated the same session reads zero rows. Browser screenshots: create forms for bank account / change request / disposition / application are editable, the audit calendar shows supplier names, the delivery report renders in zh and en, the portal profile hides 风险等级, opening another supplier's record shows 未找到记录. Non-admin user search returns 200. Hosted recheck V6 is still outstanding, as before.Generated by Claude Code