merge: resolve CHANGELOG.md conflict with main

Co-authored-by: xuyushun441-sys <255036401+xuyushun441-sys@users.noreply.github.com>

Author: Copilot

CHANGELOG.md

@@ -27,6 +27,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - **Studio: Package switcher not filtering object list** — Fixed a bug where switching packages in the Studio left sidebar did not change the displayed object list. The root cause was in `ObjectStackProtocolImplementation.getMetaItems()`: after filtering items by `packageId` via `SchemaRegistry.listItems()`, the code merged in ALL runtime items from MetadataService without respecting the `packageId` filter, effectively overriding the filtered results. The same issue existed in `HttpDispatcher.handleMetadata()` where the MetadataService fallback path also ignored `packageId`. Both paths now correctly filter MetadataService items by `_packageId` when a package scope is requested.
+- **MetadataPlugin driver bridging fallback** — Fixed `MetadataPlugin.start()` so the driver service scan fallback (`driver.*`) is reached when ObjectQL returns `null` (not just when it throws). Previously, `setDatabaseDriver` was never called in environments where ObjectQL was not loaded.
+- **Auth trustedOrigins test alignment** — Updated `plugin-auth` tests to match the auto-default `http://localhost:*` behavior added in PR #1152 for better-auth CORS support. When no `trustedOrigins` are configured, the implementation correctly defaults to trusting all localhost ports for development convenience.
+- **Docs build: lucide-react module resolution** — Added Turbopack `resolveAlias` in `apps/docs/next.config.mjs` so MDX content files in `content/docs/` (outside the app directory) can resolve `lucide-react`. Turbopack starts module resolution from the file's directory, which doesn't have access to the app's `node_modules/`.
+- **Client Hono integration test timeout** — Fixed `afterAll` hook timeout in `client.hono.test.ts` by racing `kernel.shutdown()` against a 10s deadline. The shutdown can hang when pino's worker-thread flush callback never fires in CI, so the race ensures the hook completes within the 30s vitest limit.
 - **CI: Replace `pnpm/action-setup@v6` with corepack** — Switched all GitHub Actions workflows (`ci.yml`, `lint.yml`, `release.yml`, `validate-deps.yml`, `pr-automation.yml`) from `pnpm/action-setup@v6` to `corepack enable` to fix persistent `ERR_PNPM_BROKEN_LOCKFILE` errors. Corepack reads the exact `packageManager` field from `package.json` (including SHA verification), ensuring the correct pnpm version is used in CI. Also bumped pnpm store cache keys to v3 and added a pnpm version verification step.
 - **Broken pnpm lockfile** — Regenerated `pnpm-lock.yaml` from scratch to fix `ERR_PNPM_BROKEN_LOCKFILE` ("expected a single document in the stream, but found more") that was causing all CI jobs to fail. The previous merge of PR #1117 only included workflow cache key changes but did not carry over the regenerated lockfile.
 - **service-ai: Fix navigation item labels using deprecated i18n object format** — Replaced `{ key, defaultValue }` i18n objects with plain string labels in `AIServicePlugin`'s Setup App navigation contributions, completing the `I18nLabelSchema` migration from [#1054](https://github.com/objectstack-ai/framework/issues/1054).

apps/docs/next.config.mjs

@@ -9,6 +9,15 @@ const config = {
   typescript: {
     ignoreBuildErrors: false,
   },
+  turbopack: {
+    resolveAlias: {
+      // MDX content lives in ../../content/docs/ (outside the app directory).
+      // Turbopack resolves modules starting from the file's directory, so it
+      // can't find packages installed under this app's node_modules/.
+      // Alias lucide-react so external MDX files can import it.
+      'lucide-react': './node_modules/lucide-react',
+    },
+  },
   images: {
     remotePatterns: [
       {