objectstack-fleet · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026 · Oct 1, 2026
diff --git a/.changeset/21125-oclif-core-5.md b/.changeset/21125-oclif-core-5.md
@@ -0,0 +1,9 @@
+---
+'@objectstack/cli': patch
+---
+
+`@objectstack/cli` moves to the `@oclif/core` 5 line: its `@oclif/core` dependency goes from `^4.13.3` to `^5.1.2`. The Command classes the package exports (`CompileCommand`, `ValidateCommand`, `ServeCommand` and the rest) now build on `@oclif/core` 5, so code that extends one of them or runs it beside its own oclif setup should use `@oclif/core` 5 as well.
+
+Node.js 22 or later is required. Every `@oclif/core` 5 release declares `engines.node` `>=22.0.0`, the same floor this package already declared.
+
+The `os` commands, flags and output are unchanged. On 5.1.2 every help page renders byte-for-byte as it did on 4.13.3. The published entry also answers `--version`, `--help`, an unknown command, an unknown flag and a refused `--port` with the same exit codes and the same bytes.
diff --git a/packages/cli/bin/run-dev.js b/packages/cli/bin/run-dev.js
@@ -5,7 +5,7 @@
 // having been built. Not published (`files` does not name `bin/`, and only the
 // `bin` target itself is packed automatically).
 //
-// The body is `execute({ development: true })` from @oclif/core 4.13.3 inlined,
+// The body is `execute({ development: true })` from @oclif/core 5.1.2 inlined,
 // for the reason `bin/run.js` states: `execute` hands the error straight to
 // `handle()`, which prints a usage dump, and #10111 needs one unmistakable line
 // to land on stderr before it. `NODE_ENV` and `settings.debug` are what

diff --git a/packages/cli/bin/run.js b/packages/cli/bin/run.js
@@ -5,7 +5,7 @@
 // `files` never names the directory — see scripts/check-published-files.mjs).
 //
 // It used to be `await execute({ type: 'esm', dir: import.meta.url })`. What is
-// inlined below IS `execute()` from @oclif/core 4.13.3, verbatim apart from the
+// inlined below IS `execute()` from @oclif/core 5.1.2, verbatim apart from the
 // added lines, because `execute` swallows the error into `handle()` and
 // there is no hook between the two. `handle()` writes the parse error and then
 // a full usage dump; #10111 needs one unmistakable line to reach stderr FIRST,
@@ -31,7 +31,7 @@ import { flush, handle, run, settings } from '@oclif/core';
  * `development`/`test`, with no baseline and only two declared exceptions.
  *
  * What was missing is that **this file never asserted it about itself.**
- * `@oclif/core@4.13.3`'s `lib/config/ts-path.js` skips its TypeScript path
+ * `@oclif/core@5.1.2`'s `lib/config/ts-path.js` skips its TypeScript path
  * lookup only when `isProd()`, which `lib/util/util.js` defines as
  * `['development', 'test'].includes(process.env.NODE_ENV ?? '')` negated. So an
  * ambient `NODE_ENV` — exported by a developer, or inherited by any child this

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -108,7 +108,7 @@
     "@objectstack/trigger-schedule": "workspace:*",
     "@objectstack/types": "workspace:*",
     "@objectstack/verify": "workspace:*",
-    "@oclif/core": "^4.13.3",
+    "@oclif/core": "^5.1.2",
     "bundle-require": "^5.1.0",
     "chalk": "^6.0.1",
     "chokidar": "^5.0.0",
@@ -137,8 +137,8 @@
     "@objectstack/connector-rest": "workspace:*",
     "@objectstack/driver-turso": "workspace:*",
     "@objectstack/plugin-dev": "workspace:*",
-    "@oclif/plugin-help": "^6.2.58",
-    "@oclif/plugin-plugins": "^5.4.87",
+    "@oclif/plugin-help": "^7.0.2",
+    "@oclif/plugin-plugins": "^7.0.3",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^26.6.3",
     "typescript": "^6.0.3",

diff --git a/packages/cli/src/utils/port-contract.ts b/packages/cli/src/utils/port-contract.ts
@@ -35,7 +35,7 @@
  * ## ⚠️ Why the doors call this module EXPLICITLY, before spawning
  *
  * Not from an oclif flag `parse`, and not from `Flags.integer({ min, max })`.
- * MEASURED against this checkout's `@oclif/core` 4.13.3 — see
+ * MEASURED against this checkout's `@oclif/core` 5.1.2 — see
  * {@link describePortSource} for the runtime probe and its numbers — a flag's
  * `parse` never runs over that flag's `default`, and `Flags.integer`'s
  * `min`/`max` never runs over one either. `serve` reads `$OS_PORT`/`$PORT`
@@ -95,13 +95,13 @@ export type PortInputSource = '--port' | 'OS_PORT' | 'PORT' | 'the built-in defa
  * signal that separates `--port` from the environment here, because
  * `PORT`/`OS_PORT` never reach flag parsing at all — they are read by the
  * `default` expression on the flag. MEASURED against this checkout's
- * `@oclif/core` (4.13.3), both in `lib/parser/parse.js` and at runtime: the
+ * `@oclif/core` (5.1.2), both in `lib/parser/parse.js` and at runtime: the
  * default branch's value function is `async () => flag.default`, and unlike
  * the argv and `flag.env` branches it never calls `parseFlagOrThrowError`. A
  * flag's own `parse` therefore cannot see a default, which is exactly why the
  * validation this function feeds lives at the consumer instead of on the flag.
  *
- * ⚠️ RE-MEASURED for #12673 against the same `@oclif/core` 4.13.3, by driving
+ * ⚠️ RE-MEASURED for #12673 against the same `@oclif/core` 5.1.2, by driving
  * `Parser.parse` directly. Two results, and the second closes off the cheap
  * repair the issue asked about:
  *
@@ -372,7 +372,7 @@ export function strictPortReading(raw: string): number | null {
  * that fails silently when a future author forgets to pass it.
  *
  * `os start` normalises before forwarding — its `--port` is a `Flags.integer`
- * (parser `/^-?\d+$/` in `@oclif/core` 4.13.3), so the child receives
+ * (parser `/^-?\d+$/` in `@oclif/core` 5.1.2), so the child receives
  * `PORT=8080` for an `--port 08080`, and a spelling this notice fires on can
  * only reach it through the environment, under its own name.
  *

diff --git a/packages/cli/test/published-entry-node-env-source-reroute.test.ts b/packages/cli/test/published-entry-node-env-source-reroute.test.ts
@@ -6,7 +6,7 @@
  *
  * ## The defect
  *
- * `@oclif/core@4.13.3`'s `lib/config/ts-path.js` skips its TypeScript path
+ * `@oclif/core@5.1.2`'s `lib/config/ts-path.js` skips its TypeScript path
  * lookup only when `isProd()`, which `lib/util/util.js` defines as a negated
  * `['development', 'test'].includes(process.env.NODE_ENV ?? '')`. So an ambient
  * `NODE_ENV=development` — exported by a developer, or inherited by any child

diff --git a/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts b/packages/cli/test/serve-mcp-capability-collision.e2e.test.ts
@@ -63,7 +63,7 @@ const HERE = resolve(fileURLToPath(import.meta.url), '..');
  * genuinely reaches it (#11707).
  *
  * Both halves of that are load-bearing and neither works alone. @oclif/core
- * 4.13.3 skips its TypeScript path lookup only when `isProd()` —
+ * 5.1.2 skips its TypeScript path lookup only when `isProd()` —
  * `!['development', 'test'].includes(process.env.NODE_ENV ?? '')` — so under a
  * child `NODE_ENV` of `development` or `test` it rewrites the command target
  * from the declared `./dist/commands` to `./src/commands` and transpiles, and

diff --git a/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts b/packages/cli/test/serve-mcp-stdio-answers.e2e.test.ts
@@ -62,7 +62,7 @@ const HERE = resolve(fileURLToPath(import.meta.url), '..');
  * genuinely reaches it (#11707).
  *
  * Both halves of that are load-bearing and neither works alone. @oclif/core
- * 4.13.3 skips its TypeScript path lookup only when `isProd()` —
+ * 5.1.2 skips its TypeScript path lookup only when `isProd()` —
  * `!['development', 'test'].includes(process.env.NODE_ENV ?? '')` — so under a
  * child `NODE_ENV` of `development` or `test` it rewrites the command target
  * from the declared `./dist/commands` to `./src/commands` and transpiles, and

diff --git a/packages/cli/test/serve-stdio-stdout-purity.e2e.test.ts b/packages/cli/test/serve-stdio-stdout-purity.e2e.test.ts
@@ -59,7 +59,7 @@ const HERE = resolve(fileURLToPath(import.meta.url), '..');
  * genuinely reaches it (#11707).
  *
  * Both halves of that are load-bearing and neither works alone. @oclif/core
- * 4.13.3 skips its TypeScript path lookup only when `isProd()` —
+ * 5.1.2 skips its TypeScript path lookup only when `isProd()` —
  * `!['development', 'test'].includes(process.env.NODE_ENV ?? '')` — so under a
  * child `NODE_ENV` of `development` or `test` it rewrites the command target
  * from the declared `./dist/commands` to `./src/commands` and transpiles, and

diff --git a/packages/cli/test/unbuilt-workspace-lead.test.ts b/packages/cli/test/unbuilt-workspace-lead.test.ts
@@ -25,6 +25,12 @@
  * `isInvocationError` requires both) answers `undefined` for this failure and
  * why it could not be the place this lands.
  *
+ * Each fixture's `module:` line names the `@oclif/core` its run loaded
+ * (4.13.3) and stays as recorded, because a transcript is evidence of one run.
+ * Nothing here reads that line — the classifier works off `message:` — and
+ * `@oclif/core` 5.1.2 builds the detail from the same lines in the same order,
+ * re-measured when the CLI moved to the 5 line.
+ *
  * ⚠️ This file pins the decision only. Whether `bin/run-dev.js` actually asks
  * the question and prints the answer is a different fact with its own test —
  * `run-dev-unbuilt-workspace.e2e.test.ts` drives the real binary, and deleting