marketplace update leaves CE0066 (entity access out of date) unresolved — no headless fix available

[ArjenLammers]

Summary

After mxcli marketplace update upgrades a module that introduces new entities with module security roles, the model is left with CE0066 ("Entity access is out of date. Please update security…") that cannot be resolved headlessly. The only fix requires clicking Update security in Studio Pro's domain model editor — breaking fully unattended upgrade pipelines.

mxcli version

v0.21.0 (2026-09-06T15:33:18Z)

Mendix project version

11.12.4

Steps to reproduce

# UserCommons 2.1.3 → 2.2.0 (content-id 223053)
mxcli marketplace update 223053 \
  --to 2.2.0 \
  --no-baseline \
  -p "/path/to/App.mpr"

mxcli output (exits 0 — no warning about CE0066)

--no-baseline: skipping the local-edit check for UserCommons.

Updating UserCommons 2.1.3 → 2.2.0...

UserCommons updated 2.1.3 → 2.2.0
  81 units copied, 45 element identities preserved, 6 role grant(s) restored.
  19 bundled file(s) replaced (widgets, themesource, ...).

  Next, repair what a headless update leaves behind (expected, not a fault):
      mxcli fix widgets -p <project.mpr>             # CE0463
      mxcli fix design-properties -p <project.mpr>   # CE6087

  Then validate and review:
      mxcli docker check -p <project.mpr>
      mxcli diff-local -p <project.mpr>

mx check output after update

[error] [CE0066] "Entity access is out of date. Please update security by clicking
        the 'Update security' button in the domain model editor."
        at Domain model of module 'UserCommons'

(Plus the expected CE0463 widget errors, fixable via mxcli fix widgets.)

Root cause

UserCommons 2.2.0 introduces new persistent entities (or new attributes on existing entities). When a module is replaced headlessly, Mendix marks entity-level access rules as "out of date" because the module's security configuration no longer matches the domain model. The only documented fix is the interactive Update security button in Studio Pro's domain model editor — there is no mxcli fix equivalent.

Expected behaviour

One of:

1. mxcli fix security -p <project.mpr> (new command) — recompute/regenerate entity access rules headlessly after a module upgrade, the same way mxcli fix widgets handles CE0463.
2. marketplace update applies the fix automatically — detect stale module security after import and regenerate it before returning, keeping the update atomic.
3. Post-update hint — at minimum, include CE0066 in the "Next, repair what a headless update leaves behind" section so pipeline authors know this currently requires Studio Pro.

Actual behaviour

mxcli marketplace update exits 0, prints no warning about CE0066, and mx check fails with exit 1 due to the stale entity access. The follow-up instructions only mention CE0463/CE6087 — CE0066 is not mentioned anywhere in the output.

Impact

Any fully-unattended upgrade pipeline (CI, Docker build, scripted batch upgrade) that calls mxcli marketplace update followed by mx check will fail when the upgraded module introduces new entities with security roles. The pipeline cannot recover without human Studio Pro interaction.

Workaround

Stay on the previous module version (UserCommons 2.1.3) until a headless fix is available, or open Studio Pro after the update, click Update security in the domain model, commit, and push manually.