chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

The changelog information of each package has been omitted from this message, as the content exceeds the size limit.

@objectstack/cli@17.3.0

@objectstack/client@17.3.0

@objectstack/cloud-connection@17.3.0

@objectstack/console@17.3.0

@objectstack/core@17.3.0

create-objectstack@17.3.0

@objectstack/driver-memory@17.3.0

@objectstack/driver-mongodb@17.3.0

@objectstack/driver-sql@17.3.0

@objectstack/driver-sqlite-wasm@17.3.0

@objectstack/driver-turso@17.3.0

@objectstack/formula@17.3.0

@objectstack/lint@17.3.0

@objectstack/mcp@17.3.0

@objectstack/metadata@17.3.0

@objectstack/metadata-core@17.3.0

@objectstack/metadata-protocol@17.3.0

@objectstack/objectql@17.3.0

@objectstack/observability@17.3.0

@objectstack/platform-objects@17.3.0

@objectstack/plugin-approvals@17.3.0

@objectstack/plugin-audit@17.3.0

@objectstack/plugin-auth@17.3.0

@objectstack/plugin-email@17.3.0

@objectstack/plugin-hono-server@17.3.0

@objectstack/plugin-security@17.3.0

@objectstack/plugin-sharing@17.3.0

@objectstack/rest@17.3.0

@objectstack/runtime@17.3.0

@objectstack/sdui-parser@17.3.0

@objectstack/service-analytics@17.3.0

@objectstack/service-automation@17.3.0

@objectstack/service-cluster@17.3.0

@objectstack/service-datasource@17.3.0

@objectstack/service-messaging@17.3.0

@objectstack/service-settings@17.3.0

@objectstack/service-storage@17.3.0

@objectstack/spec@17.3.0

@objectstack/types@17.3.0

@objectstack/verify@17.3.0

@objectstack/hono@17.3.0

@objectstack/account@17.3.0

@objectstack/setup@17.3.0

@objectstack/studio@17.3.0

@objectstack/client-react@17.3.0

@objectstack/connector-mcp@17.3.0

@objectstack/connector-openapi@17.3.0

@objectstack/connector-rest@17.3.0

@objectstack/connector-slack@17.3.0

@objectstack/metadata-fs@17.3.0

@objectstack/embedder-openai@17.3.0

@objectstack/knowledge-memory@17.3.0

@objectstack/knowledge-ragflow@17.3.0

@objectstack/plugin-dev@17.3.0

@objectstack/plugin-pinyin-search@17.3.0

@objectstack/plugin-reports@17.3.0

@objectstack/plugin-webhooks@17.3.0

@objectstack/service-cache@17.3.0

@objectstack/service-cluster-redis@17.3.0

@objectstack/service-i18n@17.3.0

@objectstack/service-job@17.3.0

@objectstack/service-knowledge@17.3.0

@objectstack/service-package@17.3.0

@objectstack/service-queue@17.3.0

@objectstack/service-realtime@17.3.0

@objectstack/service-sms@17.3.0

@objectstack/trigger-api@17.3.0

@objectstack/trigger-record-change@17.3.0

@objectstack/trigger-schedule@17.3.0

@objectstack/docs@4.2.3

@objectstack/example-crm@4.0.95

@objectstack/example-multi-package@0.0.2

@objectstack/example-showcase@0.3.17

@objectstack/example-todo@4.0.95

@objectstack/example-embed-objectql@0.0.35

@objectstack/dogfood@0.0.43

@objectstack/downstream-contract@0.0.41

@objectstack/http-conformance@0.1.3

[os-musk]

⚠️ One changeset in this release states something that is false — worth a one-line fix before it compiles

Flagged by the domain:engine seat. ⛔ Not a request to hold the release, and ⛔ nothing here needs changing in this PR itself — the fix belongs in the changeset file on main, which is still editable until this merges.

File: .changeset/multi-update-hook-key-divergence-refusal.md (landed minutes ago with PR #14734 / card #14099, commit dee4dd4ba).

Line 10 reads, unconditionally:

update that succeeds today is REFUSED when its beforeUpdate handlers assign divergent key sets

Measured, on that PR's own head, by an isolated contract reviewer using a real ObjectQL + real SqlDriver + real QuickJSScriptRunner:

hook kind	dispatch order	refused?
in-process handler	either order	✅ yes
sandboxed hook body (the shipped path)	open → already	⛔ NO
sandboxed hook body	already → open	yes

So the sentence is true for in-process handlers and false for shipped hook bodies in one of two row orders. As written, the release notes would tell operators that a p1 data-corruption hazard — a multi: true update stamping rows that never transitioned — is closed, when for the hook-authoring path most consumers actually use it is not. hotcrm ships hook bodies; the card's original reporter (objectstack-ai/duly) hit this on published 17.2.0.

The cause is not in that PR's code: the sandbox write-back re-assigns every ctx.input key (quickjs-runner.ts:1302-1319 → body-runner.ts:559), so the divergence check cannot see the difference. That is filed separately as #14758, in packages/runtime/src/sandbox/**.

The ask

A qualifier on that one sentence — something like "…is refused when its beforeUpdate handlers assign divergent key sets; sandboxed hook bodies are not yet covered (#14758)" — so the published text matches what shipped.

⛔ Whoever owns this release decides whether that is worth a cycle or whether it ships as-is and is corrected in docs afterwards. This comment exists so the choice is made rather than made by default: after this PR merges the sentence is published text and costs a docs correction instead of a one-line edit.

⚠️ Context worth having: PR #14734's contract review returned FAIL on exactly this point, its card was pm:blocked, and this seat did not enqueue it — the attempt to dequeue lost to a GitHub rate limit on the disable_pr_auto_merge path. Full record on #14099 (comment 5518840824) and on PR #14734 (comments 5518180122 and 5518657324). ⛔ No revert is being proposed: what shipped is a genuine improvement for in-process handlers, and revert-or-forward-fix is triage's or the maintainer's call.

---

Generated by Claude Code