Overview

ObjectStack ships as a single release train: all @objectstack/* packages are version-locked, so one version number describes the whole platform. The Console UI (built from the objectui repository) is frozen into @objectstack/console at release time, so each release note here also covers what changed in Studio/Console. ObjectStack Cloud (the hosted service) versions independently and deploys continuously — developer-facing Cloud changes are summarized in the release note for the framework version they accompany.

Each release page is written for third-party developers building apps, plugins, or clients on ObjectStack. It leads with breaking changes and migration steps, then covers new capabilities and notable fixes.

Versions

• v18 — The line that carries ADR-0131, total organization ownership with no NULL organization_id; its breaking changes landed in stages through the 18.0.0-next.N prereleases on npm's next tag, each with its own changeset and migration, and its GA release, 18.0.0, publishes to npm's latest tag and moves it from 17.x to 18 (current series: 18.2.0, released 2026-10-27).
• v17.0.0 — Files become owned sys_file records with server-enforced accept/maxSize and a governed download path, bulk export becomes its own opt-in privilege, the SDK is reconciled against the routes the server actually mounts (21 dead methods out, 40+ real ones in), approval nodes route approvers dynamically via CEL expressions and decision outputs, a datasource that cannot connect fails the boot, and Node 22 becomes the supported floor; 17.1 adds partial field masking, record-view auditing on sys_audit_log, and a per-object read-only approval visibility tier — and makes a deactivated permission set or position actually stop granting access, withdraws the bulk-export wildcard from the shipped admin sets, and gives all three flow doors one honest HTTP status table; 17.2 tightens by-id update/delete against a silently-dropped where predicate or a mismatched id, retires sys_position.permissions and other dead ADR-0049 surfaces, and stops analytics from answering the wrong number on a cross-object filter (final release: 17.7.0).
• v16.0.0 — One org identifier (organizationId) across hooks and actions, quorum + per-group sign-off (会签) approvals with metadata-declared decision actions, time-relative automations, filtered roll-ups, strict dashboard widgets, an identity-scoped MCP stdio transport, and a platform-wide enforce-or-remove sweep that makes dead metadata loud; 16.1 adds a requires capability-provider preflight, two more dashboard build gates, and runAs:'user' automations that run with the triggering user's real grants (final release: 16.1.0).
• v15.0.0 — Explain record access layer by layer, a docked AI workspace in the Console, project-ready Gantt charts, and phone sign-in; 15.1 adds permission-following attachments, no-code third-party connectors, dashboard-wide filters, pinyin search, and whole-record inline editing — with materially safer multi-tenant and write-path defaults (final release: 15.1.1).
• v14.0.0 — ADR-0090 vocabulary convergence completed, object enable.* flags become real gates, admin user management, phone/SMS auth, book-audience enforcement, data-lifecycle contract, and effective-dated grants (final release: 14.8.0).
• v13.0.0 — Permission Model v2 (ADR-0090): Roles and Profiles converge on Positions, custom objects default to private, plus an explain engine, delegated administration, and self-serve MCP OAuth.
• v12.0.0 — Anonymous data access denied by default (ADR-0056 D2), adaptive record surfaces, an enforced protocol-version handshake, and build-gating author-time lints.
• v9.0.0 — Analytics single-form cutover (ADR-0021), honest chart taxonomy, canonical OS_* settings env vars, Google sign-in, AI build experience.

Curated notes for v10 and v11 are not yet written; consult the per-package CHANGELOG.md files for those versions in the meantime.

Where the fine-grained changelogs live

These pages are curated summaries. For exhaustive, per-package detail:

• Framework packages — every package ships a CHANGELOG.md generated from changesets, visible on npm and in the framework repository.
• Console UI — the objectui CHANGELOG follows Keep a Changelog.
• Design decisions — breaking changes reference their ADRs, which record the rationale.

Versioning policy

ObjectStack follows Semantic Versioning. All @objectstack/* packages version in lockstep, so a single major bump promotes the whole platform, and which version a breaking change ships in depends on the line.

The 17.x minors ran under a launch-window override: a breaking change shipped as a minor release. It landed in a minor alongside a changeset entry marked **BREAKING**, and scripts/check-changeset-no-major.mjs failed a pull request that declared a major bump.

The v18 line is a major, and 18.0.0 is its GA release. While Changesets was in pre mode with the tag next, check-changeset-no-major.mjs stood aside, so a pull request could declare a major bump, and every release cut from main was the next 18.0.0-next.N on npm's next tag while latest stayed on 17.x. Changesets has left pre mode for the 18.0.0 cut, which publishes to npm's latest tag, and the guard again fails a pull request that declares a major bump. See how a breaking stage lands on the v18 line.

After 18.0.0, the level follows the metadata protocol. The maintainer's 2026-10-21 ruling (#25105) keeps the no-major guard and grades every changeset by what it does to the metadata protocol: a key, value or metadata type added, narrowed or given a new meaning takes minor, and every other change takes patch — a REST door, a driver, a boot refusal, the CLI or the Console — breaking or not. A non-protocol breaking change keeps its **BREAKING** banner and its ADR-0087 disposition. 18.1.0 is the first release cut under the rule: a minor carrying 91 changesets declared breaking, 43 of them graded patch.

What that means when you read a version number:

• A major release may remove or change schemas in @objectstack/spec, public APIs, CLI flags, or environment variables — always with a migration path documented in the release notes.
• A minor release adds capabilities, and may also remove or change those same surfaces. 17.2.0 retired http_request_errors_total and sys_position.permissions; 15.1.0 removed tenancy.strategy and tenancy.crossTenantAccess — all in minor releases. As the v17 notes put it, 17.1.0 and 17.2.0 are minors by version number, not by blast radius.
• A patch release fixes bugs. On the v18 line after 18.0.0 it may also carry a breaking change to anything that is not the metadata protocol: a REST response, a boot refusal, a CLI exit status, a removed runtime export.

⚠️ The version number is not the upgrade-safety signal. Read the release note for the version you are moving to — each one leads with breaking changes and migration steps — and see Backward Compatibility for the full policy.