Skip to content
PR Automation

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935) #29656

Sign in to view logs

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935)

fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935) #29656

Triggered via pull request September 30, 2026 23:17
@objectstack-fleetobjectstack-fleet[bot]
edited #20955
claude/issue-20935-masked-not-queryable
Status Success
Total duration 1m 0s
Artifacts –

pr-automation.yml

on: pull_request
Check PR Size
0s
Check PR Size
Check Changeset
56s
Check Changeset
Auto Label
0s
Auto Label
Fit to window
Zoom out
Zoom in

Annotations

2 notices
Check Changeset: .changeset/20935-analytics-masked-field-not-queryable.md#L0
ADR-0087 exemption (no-migration-prescription): No authorable key, export or stored shape is removed or renamed. The change refuses analytics queries that group, aggregate, filter or sort by a field the caller may only see masked, which the engine already refuses on the data API and on the ObjectQL strategy, so there is nothing for `objectstack migrate meta` to rewrite. The one public-surface addition is a new optional service hook.
Check Changeset
"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026. For more information, see https://github.com/actions/runner-images/issues/14748"