[objectstack-fleet]

Requested by Leehom · project thread
Part of #28292

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：glob 从 13 升到 14.0.3（@objectstack/metadata、@object-ui/cli 两个已发布包），follow-redirects 升到 1.16.2、joi 升到 18.3.1（只改锁文件）；@object-ui/cli 去掉已废弃的 @types/glob 存根。
• 为什么改：每日 OSV 扫描在 4 条新公告上转红；本 PR 清掉其中 3 条。第 4 条 minimatch 只在 11 修复，而所有父包都还不接受 11，按台账惯例要单独开豁免 PR。
• 风险与回滚：低。两处调用点只用 glob/globSync 加 cwd、ignore、nodir、absolute，14 里没变；Node 引擎下限不变。回滚即还原本 PR。
• 先看：ui/packages/cli/package.json（依赖行与 @types/glob 删除）、packages/metadata/package.json、pnpm-lock.yaml（只动 glob、path-scurry、minimatch 11、follow-redirects、joi）。
• 两分钟验证：grep -E "^ (glob|follow-redirects|joi)@" pnpm-lock.yaml，应只见 glob@14.0.3、glob@7.2.3、follow-redirects@1.16.2、joi@18.3.1。
• 需要你做的：无，席位落地。

What changes

• glob ^13.0.6 → ^14.0.3 in the dependencies of @objectstack/metadata and @object-ui/cli (GHSA-3g3m-2fjr-6pw4: affected 9.0.0 to 14.0.1, fixed in 14.0.2). The lockfile moves glob 13.0.6 → 14.0.3, path-scurry 2.0.2 → 3.0.0, and adds minimatch 11.0.3 plus @isaacs/nonrecursive-glob-match 1.0.3 for glob's own copy.
• @object-ui/cli drops @types/glob 9.0.0 from dependencies. It is a deprecated stub ("glob provides its own type definitions") whose only content is a glob: * dependency, which kept glob 13.0.6 in the tree. tsc --noEmit stays green without it.
• follow-redirects 1.16.1 → 1.16.2 (GHSA-mrwp-f3q8-3g9p) and joi 18.3.0 → 18.3.1 (GHSA-4528-x5fx-h6hg): lockfile only, inside their parents' ranges (axios, wait-on). Nine lockfile lines; no other package moved. A plain pnpm update -r follow-redirects joi was measured first and moved unrelated packages (@inquirer/*, seroval, a driver peer set), so it was discarded; the two entries were re-resolved by pnpm alone and pnpm install --frozen-lockfile passes on the result.
• One changeset, patch for both published packages.

Why

The scheduled Validate Dependencies OSV scan on main is red on four new advisories (#28292). Triage graded it p1 because glob ships at runtime in two published packages, and granted a one-PR cross-domain exception for ui/packages/cli/package.json.

Remainder: minimatch (GHSA-g3hv-75wg-m249) is NOT cleared here

• Every minimatch before 11.0.1 is affected. 11 is a breaking major: its type surface drops makeRe, AST and two options.
• No parent's latest release accepts 11: eslint 10.14.0 (^10.2.6), @eslint/config-array 0.23.5, @typescript-eslint/typescript-estree 8.72.1, @microsoft/api-extractor 7.60.1 (exact 10.2.3), @oclif/core 5.1.10, @ts-morph/common 0.29.0, typedoc 0.28.20 and readdir-glob all declare ^10 (glob 7.2.3 declares ^3).
• The existing pnpm-workspace.yaml override that lifts every minimatch below 11.0.0 to ^10.2.3 already holds every copy on 10.2.6, the newest 10.x. Retargeting it to 11 would force a major outside every parent's range, which the route rules out.
• So, per the ledger's convention 3 and triage, minimatch needs its own osv-exemption PR with a dated entry. This PR adds no exemption. The seat routes that PR. Until it lands, the scheduled scan stays red on minimatch alone.

Tests

Run at head 6100dd77.

• Build: pnpm --filter '@objectstack/metadata...' --filter '@object-ui/cli...' build under the verify lock: VERDICT command-exit 0.
• @objectstack/metadata: vitest run: Test Files 64 passed (64), Tests 906 passed (906). tsc --noEmit: exit 0. The glob call sites in src/loaders/filesystem-loader.ts (loadMany/list) are reached by the existing filesystem-loader-*.test.ts suites.
• @object-ui/cli: vitest run packages/cli/ from ui/: Test Files 31 passed (31), Tests 418 passed (418). tsc --noEmit: exit 0. The globSync call sites are reached by workspace-vite.test.ts and the check-*.test.ts suites.
• The suites resolve glob 14.0.3 from both packages (require('glob/package.json').version), and the built dist/node.cjs and dist/node.js of @objectstack/metadata load with it.
• Lint: eslint packages/metadata --no-inline-config exit 0; ui/packages/cli pnpm lint exit 0 (5 pre-existing no-explicit-any warnings, 0 errors).

Acceptance notes

• No new tests: the diff changes no tested behaviour, only dependency versions, and existing suites reach every call site. There is no ablation, since config is not ablated.
• @types/glob was in dependencies (not devDependencies) of the published @object-ui/cli; removing it also drops it from consumers' installs.
• The remaining minimatch 10.2.6 copies are not dev-only: @objectstack/cli ships @oclif/core and ts-morph, and @objectstack/rest ships exceljs (archiver 5 → readdir-glob / glob 7). That bears on the exemption PR's review, not on this one.

Verification

OSV scan reproduction: NOT MEASURED

The OSV-Scanner binary download and api.osv.dev are both refused by this container's egress policy. The closest measurement is the lockfile's versions against each advisory's fixed version:

Package	base 57f8ca2f0	head	fixed in
follow-redirects	1.16.1	1.16.2	1.16.2
joi	18.3.0	18.3.1	18.3.1
glob (9 to 14.0.1 affected)	13.0.6, 7.2.3	14.0.3, 7.2.3	14.0.2
minimatch	10.2.6	10.2.6, 11.0.3	11.0.1

The PR's own base-relative OSV step judges it in CI.

Derived gates: 66 derived, 65 run green, 1 NOT MEASURED

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 66 families over the 4 changed paths. 65 end with exit 0; two notes:

• node scripts/check-plugin-teardown-shape.mjs --self-test first exited 3 on the shallow clone; after git fetch --depth=1 of its pinned fixture commit it exits 0.
• pnpm check:dual-build-cjs-loads exits 3 (PREREQUISITE NOT MET: about 34 unrelated packages have no dist/). Narrowed locally to loading @objectstack/metadata's CJS and ESM entries with glob 14 (both load). CI runs the full gate.

--ran reconciliation: 66 derived famil(ies) accounted for — 65 run, 1 NOT-MEASURED. pnpm check:published-files and node scripts/check-osv-exemptions.mjs are among the green ones.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5pWbjNiQvAXymrfTHX

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/metadata/package.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/metadata/package.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 16 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b33946512c9f968432cb8b094961424220da4bc6 → packageMentionDocs.

[objectstack-fleet]

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-10-31T05:08Z · head 6100dd77 · #28292

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」. Security card: 「所有的安全卡不要创建issue，直接派发处理修复」.

1. Shape:
   • A draft against main with no assignees and a patch changeset for @objectstack/metadata and @object-ui/cli.
   • It says Part of #28292. The minimatch remainder is the exemption PR chore(osv): dated exemption for minimatch GHSA-g3hv-75wg-m249 until 2026-11-30 #28328, which lands right after this one; the seat closes the card once both are merged.
   • check-governed-merges --pr 28324 reads NOT governed, 83 changed lines.
   • The claim (6538901035) names this PR's branch, claude/project-thread-n94g89.
   • The one ui/** file, ui/packages/cli/package.json, falls under triage's one-PR cross-domain exception.
2. Against triage's route (6538684656):
   • glob (GHSA-3g3m-2fjr-6pw4). It moves to ^14.0.3 in both packages that ship it. The call sites use only glob/globSync with cwd, ignore, nodir and absolute, which 14 keeps, and existing suites reach every call site: metadata 906 of 906 and @object-ui/cli 418 of 418 passed. @types/glob, a deprecated stub, is dropped because glob ships its own types. The metadata CJS and ESM builds load with it.
   • follow-redirects (GHSA-mrwp-f3q8-3g9p) and joi (GHSA-4528-x5fx-h6hg). These are a nine-line lockfile-only re-resolve inside their parents' ranges, to 1.16.2 and 18.3.1. A plain pnpm update -r was tried first; it moved unrelated packages, so it was discarded.
   • minimatch (GHSA-g3hv-75wg-m249). It is not moved, as the route says: the fix is only in the 11 major, and no parent accepts that yet. It goes to its own exemption PR.
3. Contract review: not owed. There is no spec path and no governed path, the PR declares Clause-②: no, and no API or export changes.
4. Gates:
   • Locally, the dev ran 66 derived families: 65 exit 0, and 1 NOT-MEASURED, check:dual-build-cjs-loads. That one was narrowed locally to the metadata CJS/ESM load, and CI ran the full build.
   • The dev could not run the OSV scan locally: the scanner download and api.osv.dev are blocked from the container. CI's Validate Package Dependencies ran it on this head and is green.
   • CI on head 6100dd77: 57 success, 7 skipped, 0 red. The state is clean.
5. Overlap: git merge-tree reports no conflict against main b1e1dcf2. chore(osv): dated exemption for minimatch GHSA-g3hv-75wg-m249 until 2026-11-30 #28328 touches only osv-scanner.toml.
6. Proof owed after landing: the next scheduled Validate Dependencies run, with chore(osv): dated exemption for minimatch GHSA-g3hv-75wg-m249 until 2026-11-30 #28328 in, must be green. The landing record names that run.

---

Generated by Claude Code