[WIP] Upgrade to latest version of @objectstack with plugin-auth

[Copilot]

• Analyze current @objectstack dependency versions (all at ^2.0.3)
• Identify latest versions available (all at 2.0.5)
• Analyze @objectstack/plugin-auth package (new plugin to add)
• Upgrade @objectstack/spec from ^2.0.3 to ^2.0.5 in all 19 packages
• Upgrade @objectstack/core from ^2.0.3 to ^2.0.5 in all 7 packages
• Upgrade @objectstack/runtime from ^2.0.3 to ^2.0.5 in @objectql/core
• Upgrade @objectstack/objectql from ^2.0.3 to ^2.0.5 in @objectql/core
• Upgrade @objectstack/cli from 2.0.3 to 2.0.5 in root package.json
• Upgrade @objectstack/core from 2.0.3 to 2.0.5 in root package.json
• Upgrade @objectstack/plugin-hono-server from ^2.0.3 to ^2.0.5 in root package.json
• Upgrade @objectstack/studio from ^2.0.3 to ^2.0.5 in root package.json
• Add @objectstack/plugin-auth ^2.0.5 to root package.json devDependencies
• Add AuthPlugin import and configuration in objectstack.config.ts
• Run pnpm install to update lock file
• Verify build passes (34/34 packages)
• Verify tests pass (87/87 test files, 1845 passed, 101 skipped)
• Code review — no issues found
• Security scan (CodeQL) — no alerts

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectql	Ready	Preview, Comment	Feb 10, 2026 5:12pm

[Copilot]

Pull request overview

This PR upgrades the monorepo’s @objectstack/* dependencies from 2.0.3 to 2.0.5 and introduces @objectstack/plugin-auth, wiring it into the runtime configuration.

Changes:

• Bump @objectstack/{spec,core,runtime,objectql,cli,studio,plugin-hono-server} to 2.0.5 across affected packages.
• Add @objectstack/plugin-auth@^2.0.5 and register AuthPlugin in objectstack.config.ts.
• Update pnpm-lock.yaml to reflect the new versions and transitive dependency graph.

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Lockfile updates for @objectstack/*@2.0.5 and new @objectstack/plugin-auth transitive deps
package.json	Root dependency bumps and addition of @objectstack/plugin-auth
objectstack.config.ts	Registers AuthPlugin with basePath: '/api/v1/auth'
packages/protocols/odata-v4/package.json	Bumps @objectstack/spec and @objectstack/core to ^2.0.5
packages/protocols/json-rpc/package.json	Bumps @objectstack/spec and @objectstack/core to ^2.0.5
packages/protocols/graphql/package.json	Bumps @objectstack/spec and @objectstack/core to ^2.0.5
packages/foundation/types/package.json	Bumps @objectstack/spec to ^2.0.5
packages/foundation/plugin-workflow/package.json	Bumps @objectstack/{core,spec} to ^2.0.5
packages/foundation/plugin-validator/package.json	Bumps @objectstack/{core,spec} to ^2.0.5
packages/foundation/plugin-security/package.json	Bumps @objectstack/{core,spec} to ^2.0.5
packages/foundation/plugin-multitenancy/package.json	Bumps @objectstack/{core,spec} to ^2.0.5
packages/foundation/plugin-formula/package.json	Bumps @objectstack/{core,spec} to ^2.0.5
packages/foundation/platform-node/package.json	Bumps @objectstack/spec to ^2.0.5
packages/foundation/core/package.json	Bumps @objectstack/{core,objectql,runtime,spec} to ^2.0.5
packages/drivers/sqlite-wasm/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/sql/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/sdk/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/redis/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/pg-wasm/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/mongo/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/memory/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/fs/package.json	Bumps @objectstack/spec to ^2.0.5
packages/drivers/excel/package.json	Bumps @objectstack/spec to ^2.0.5

Files not reviewed (1)

• pnpm-lock.yaml: Language not supported

[Copilot]

better-auth@1.4.18 declares an (optional) peer dependency on vitest ^2 || ^3 || ^4, but the lockfile resolves it with vitest@1.6.1. Even if tests currently pass, this will produce a peer-dependency mismatch and can break any better-auth Vitest integrations/utilities; consider upgrading Vitest to a supported major or adjusting dependency resolution so vitest@1.x is not used to satisfy this peer.

[Copilot]

Adding @objectstack/plugin-auth pulls in transitive dependencies that require Node >= 20.19.0 (see lockfile entries like @noble/ciphers). If this repo intends to support earlier Node 20 minors (or Node 18+ as some tooling suggests), consider declaring/enforcing the actual minimum Node version at the root (e.g. package.json#engines / CI pinning) to prevent install/runtime surprises.

[Copilot]

The newly introduced transitive deps @noble/ciphers@2.1.1 and @noble/hashes@2.0.1 require Node >= 20.19.0 (per their engines fields). This effectively raises the minimum Node runtime for installs using this lockfile; please pin/communicate a compatible Node version (e.g. via package.json#engines and/or CI setup-node), otherwise contributors on older Node 20 minors will fail pnpm install.