Skip to content

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935) #29646

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935)

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935) #29646

Triggered via pull request September 30, 2026 22:40
Status Success
Total duration 1m 0s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
17s
Check PR Size
Check Changeset
56s
Check Changeset
Auto Label
18s
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

4 notices
Check PR Size
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Auto Label
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"
Check Changeset: .changeset/20935-analytics-masked-field-not-queryable.md#L0
ADR-0087 exemption (no-migration-prescription): No authorable key, export or stored shape is removed or renamed. The change refuses analytics queries that group, aggregate, filter or sort by a field the caller may only see masked, which the engine already refuses on the data API and on the ObjectQL strategy, so there is nothing for `objectstack migrate meta` to rewrite. The one public-surface addition is a new optional service hook.
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"