From d2be3a215589a1c691f5e6f86cf92958a2e5f47c Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 30 Jul 2026 00:53:51 +0000 Subject: [PATCH] =?UTF-8?q?chore:=20bump=20objectui=20to=20a136322f8723=20?= =?UTF-8?q?=E2=80=94=20the=20console=20must=20carry=20the=20ADR-0110=20D1?= =?UTF-8?q?=20fix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pin was at 4a4829d0ef39, which predates objectui#2970 (the D1 client fix). build-console.sh builds the shipped SPA at the PINNED sha, so v17 would have gone out with a console that still posts action.target to /actions/:object/:action. A v17 server resolves the declaration by name and refuses an unresolvable one (ADR-0110 D3), so every target-bound script action would 404 from the shipped console — a hard regression on a path that worked (ungated) before. The ADR and both PRs called for lockstep; the mechanism that actually enforces it is this pin, which merging the objectui PR does not touch. Range also carries objectui#2973 (modal actions are client-only) and eight other fixes since the last bump. Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_01DTTKgYriDB6RVrkYjxxnG1 --- .changeset/console-a136322f8723.md | 26 ++++++++++++++++++++++++++ .objectui-sha | 2 +- 2 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 .changeset/console-a136322f8723.md diff --git a/.changeset/console-a136322f8723.md b/.changeset/console-a136322f8723.md new file mode 100644 index 0000000000..fe6c70b016 --- /dev/null +++ b/.changeset/console-a136322f8723.md @@ -0,0 +1,26 @@ +--- +"@objectstack/console": minor +--- + +Console (objectui) refreshed to `a136322f8723`. Frontend changes in this range: + +- fix(app-shell)!: a modal action is client-side only — drop the server fallthrough (objectstack#3959) (#2973) +- fix(app-shell)!: the server-action URL identifies an action by `name`, not `target` (ADR-0110 D1) (#2970) +- fix(form): a server rejection that names fields now marks those fields (#2966) +- fix(actions): one source for the /actions envelope rule, and redirectUrl finally works (#2967) +- fix(actions): apply the ADR-0066 D4 capability gate on every action surface (framework#3923) (#2965) +- fix(detail): multi-value lookup is selectable in inline edit (#2957) +- fix(actions): a failed server action no longer reports as success (green toast) (#2963) +- fix(fields): the criteria builder stops calling an empty criteria "All records" (#2962) +- feat(report): carry a report's `order` into the dataset selection (framework#3916) (#2964) +- feat(views): the list toolbar speaks one vocabulary — `userActions` (#2890) (#2948) + +objectui range: `4a4829d0ef39...a136322f8723` + +**Release-critical for v17.** The previous pin (`4a4829d0ef39`) predates the +ADR-0110 D1 client fix, so the console it builds still posts `action.target` +to `/api/v1/actions/:object/:action`. Against a v17 server — which resolves +the declaration by `name` and refuses an unresolvable one (D3) — every +target-bound script action would return 404 from the shipped console. The +lockstep the ADR called for is enforced by THIS pin, not by merging the +objectui PR, so v17 must not ship without this bump. diff --git a/.objectui-sha b/.objectui-sha index 91efad8815..9dbc85e7c3 100644 --- a/.objectui-sha +++ b/.objectui-sha @@ -1 +1 @@ -4a4829d0ef3926e9b55757bfb1e369d6dca61ac2 +a136322f872314a74462ac7e7142f424e1124400