Skip to content

fix(plugin-security)!: refuse a sys_user_position write whose position names no sys_position row (#16712) #28724

fix(plugin-security)!: refuse a sys_user_position write whose position names no sys_position row (#16712)

fix(plugin-security)!: refuse a sys_user_position write whose position names no sys_position row (#16712) #28724

Triggered via pull request September 28, 2026 00:46
Status Success
Total duration 1m 4s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
Check PR Size
Check Changeset
1m 0s
Check Changeset
Auto Label
0s
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

2 notices
Check Changeset: .changeset/16712-position-catalog-refusal.md#L0
ADR-0087 exemption (no-migration-prescription): Nothing authorable is renamed, retired or re-typed: `sys_user_position.position` stays a `Field.text`, every object key and every stored row parse exactly as before, and no stored assignment is rewritten or refused on read, so `objectstack migrate meta` has nothing to act on. What narrows is the ACCEPT SET of one runtime write path: a non-system insert, or an update that changes `position`, whose value names no `sys_position` row in the writer's organization or among the organization-less rows is refused `400 VALIDATION_FAILED` with the envelope the row's sibling lookup columns already answer with. The refusal text names the value and its own fix, and the measured in-repo and consumer writers (hotcrm, hotclm) all write catalog names, so there is no document for a migration to act on.
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"