docs: publish stable v3 migration playbook - #253
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fd7a949ce7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pnpm add --save-exact @btst/stack@3.0.0-rc.3 @btst/adapter-drizzle@2.2.3 | ||
| pnpm add --save-dev --save-exact @btst/codegen@0.2.0-rc.3 |
There was a problem hiding this comment.
Pin the core peer cohort in the install command
When the migrating app does not already declare the Better Auth/DB peers, this example does not actually pin the documented cohort: @btst/db@2.2.3 requires exact better-auth, @better-auth/core, and @better-auth/utils peers, while Stack requires better-call@1.3.6. With peer auto-installation disabled this command fails, and with it enabled pnpm repairs the graph implicitly, contrary to the surrounding exact-cohort guidance. The repository's CORE_DEPENDENCIES packed-consumer fixture installs these packages directly, so this command should include the non-companion core cohort too.
Useful? React with 👍 / 👎.
| execute: async ({ input }) => { | ||
| await adapter.delete({ | ||
| model: "post", | ||
| where: [{ field: "id", value: input.id }], |
There was a problem hiding this comment.
Make the authorization example enforce the authorized snapshot
When a post's ownership can change between facts() and execute()—for example through another administrative workflow—the caller is authorized using the old authorId, but this delete matches only id and can remove the newly transferred record. Since this is the representative example immediately following the warning about server-derived authoritative facts, copied implementations inherit a TOCTOU authorization flaw; the write should re-read and compare/claim the authorized snapshot inside an isolated transaction or include the authorized ownership state in an atomic write precondition.
Useful? React with 👍 / 👎.
Closes #175
Summary
Validation
pnpm buildpnpm typecheckpnpm lintpnpm --dir docs build