objectstack-ai · hotlong · May 23, 2026 · May 23, 2026
diff --git a/.changeset/bump-dompurify-security.md b/.changeset/bump-dompurify-security.md
diff --git a/apps/console/CHANGELOG.md b/apps/console/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/console
 
+## 5.2.1
+
 ## 5.2.0
 
 ## 5.1.1

diff --git a/apps/console/package.json b/apps/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/console",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "ObjectStack Console - The standard runtime UI for ObjectStack applications",
   "type": "module",
   "main": "./plugin.js",

diff --git a/packages/app-shell/CHANGELOG.md b/packages/app-shell/CHANGELOG.md
@@ -1,5 +1,36 @@
 # @object-ui/app-shell — Changelog
 
+## 5.2.1
+
+### Patch Changes
+
+- 9ccda28: security: force DOMPurify to `^3.4.5` via pnpm override
+
+  Resolves 8 moderate-severity GHSA advisories against the transitive
+  `dompurify@3.2.7` pulled in by `monaco-editor`. Vulnerabilities covered:
+  - SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
+  - FORBID_TAGS bypassed by function-based ADD_TAGS predicate
+  - Prototype Pollution to XSS via CUSTOM_ELEMENT_HANDLING fallback
+  - ADD_TAGS function-form short-circuit bypass of FORBID_TAGS
+  - ADD_ATTR predicate skipping URI validation
+  - USE_PROFILES prototype pollution enabling event handlers
+  - mutation-XSS via Re-Contextualization
+  - Generic XSS vector
+
+  No API changes; override is transparent to consumers.
+  - @object-ui/types@5.2.1
+  - @object-ui/core@5.2.1
+  - @object-ui/i18n@5.2.1
+  - @object-ui/react@5.2.1
+  - @object-ui/components@5.2.1
+  - @object-ui/fields@5.2.1
+  - @object-ui/layout@5.2.1
+  - @object-ui/data-objectstack@5.2.1
+  - @object-ui/auth@5.2.1
+  - @object-ui/permissions@5.2.1
+  - @object-ui/collaboration@5.2.1
+  - @object-ui/providers@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/app-shell/package.json b/packages/app-shell/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/app-shell",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "Minimal application shell for ObjectUI - framework-agnostic rendering engine",

diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @object-ui/auth
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/auth/package.json b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @object-ui/cli
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/cli",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "Standalone CLI for Object UI — scaffold, develop, build and validate JSON/YAML schema-driven applications.",
   "type": "module",
   "homepage": "https://www.objectui.org/docs/utilities/cli",

diff --git a/packages/collaboration/CHANGELOG.md b/packages/collaboration/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @object-ui/collaboration
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/collaboration/package.json b/packages/collaboration/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/collaboration",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "Real-time collaboration for Object UI with presence tracking, live cursors, conflict resolution, and comment threads.",

diff --git a/packages/components/CHANGELOG.md b/packages/components/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @object-ui/components
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/i18n@5.2.1
+- @object-ui/react@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/components/package.json b/packages/components/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/components",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "Standard UI component library for Object UI, built with Shadcn UI + Tailwind CSS",

diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @object-ui/core
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",

diff --git a/packages/create-plugin/CHANGELOG.md b/packages/create-plugin/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/create-plugin
 
+## 5.2.1
+
 ## 5.2.0
 
 ## 5.1.1

diff --git a/packages/create-plugin/package.json b/packages/create-plugin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/create-plugin",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "CLI tool to scaffold ObjectUI plugins",
   "type": "module",
   "license": "MIT",

diff --git a/packages/data-objectstack/CHANGELOG.md b/packages/data-objectstack/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @object-ui/data-objectstack
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/data-objectstack/package.json b/packages/data-objectstack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/data-objectstack",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "ObjectStack Data Adapter for Object UI",
   "license": "MIT",
   "type": "module",

diff --git a/packages/fields/CHANGELOG.md b/packages/fields/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @object-ui/fields
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/i18n@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+- @object-ui/providers@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/fields/package.json b/packages/fields/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/fields",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "description": "Field renderers and registry for Object UI",
   "license": "MIT",
   "type": "module",

diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/i18n
 
+## 5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/i18n/package.json b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/i18n",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",

diff --git a/packages/layout/CHANGELOG.md b/packages/layout/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @object-ui/layout
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+
 ## 5.2.0
 
 ### Minor Changes

diff --git a/packages/layout/package.json b/packages/layout/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/layout",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "sideEffects": false,
   "main": "dist/index.umd.cjs",

diff --git a/packages/mobile/CHANGELOG.md b/packages/mobile/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @object-ui/mobile
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/mobile/package.json b/packages/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/mobile",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "Mobile optimization for Object UI with responsive components, PWA support, and touch gesture handling.",

diff --git a/packages/permissions/CHANGELOG.md b/packages/permissions/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @object-ui/permissions
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/permissions/package.json b/packages/permissions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/permissions",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "RBAC permission system for Object UI with object/field/row-level access control, permission guards, and hooks.",

diff --git a/packages/plugin-aggrid/CHANGELOG.md b/packages/plugin-aggrid/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @object-ui/plugin-aggrid
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+- @object-ui/fields@5.2.1
+- @object-ui/data-objectstack@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/plugin-aggrid/package.json b/packages/plugin-aggrid/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-aggrid",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "license": "MIT",
   "description": "AG Grid data grid plugin for Object UI, powered by AG Grid Community",

diff --git a/packages/plugin-ai/CHANGELOG.md b/packages/plugin-ai/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @object-ui/plugin-ai
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes

diff --git a/packages/plugin-ai/package.json b/packages/plugin-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-ai",
-  "version": "5.2.0",
+  "version": "5.2.1",
   "type": "module",
   "main": "dist/index.umd.cjs",
   "module": "dist/index.js",

diff --git a/packages/plugin-calendar/CHANGELOG.md b/packages/plugin-calendar/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @object-ui/plugin-calendar
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+- @object-ui/core@5.2.1
+- @object-ui/i18n@5.2.1
+- @object-ui/react@5.2.1
+- @object-ui/components@5.2.1
+- @object-ui/fields@5.2.1
+- @object-ui/mobile@5.2.1
+- @object-ui/plugin-detail@5.2.1
+
 ## 5.2.0
 
 ### Patch Changes