⚠️ Potential Breaking Changes

Fixed TFA enforcement to use effective permissions (#28176)
Policies with an IP allow list are now accounted for when enforcing TFA within the allowed range.

Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331)
The /server/license response no longer includes downgrade_reason. Read invalid_reason instead, which also reports why a license that is still in effect could not be renewed.

@directus/errors no longer exports LicenseManagedByEnvError, LicenseOfflineUnsupportedError, LicenseResolveIncompleteError or LicenseServiceUnavailableError, or their error codes. License request failures now surface as LICENSE_INVALID with a failure extension, or as the standard FORBIDDEN, INVALID_PAYLOAD, REQUESTS_EXCEEDED and SERVICE_UNAVAILABLE errors.

Removed the ip-matching dependency (#28243)
Policy ip_access and IMPORT_IP_DENY_LIST values are now more strictly validated. Subnets with a malformed prefix such as 10.0.0.0/ 24 or 10.0.0.0/+24, are no longer accepted.

Existing policies that already store such a value will fail every request for users with that policy.

Fixed requests failing after a process was stopped during schema building (#28316)
CACHE_SCHEMA_MAX_ITERATIONS has been removed. CACHE_SCHEMA_SYNC_TIMEOUT now also limits the schema build itself and defaults to 60000 ms.

If you have configured a lower value, make sure it is long enough for your schema to finish building.

Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072)
Breaking changes in @directus/sdk:

• DirectusNotification.id is now correctly typed as number.
• DirectusField.schema is now nullable.
• FieldMetaConditionOptionType has been removed; condition options is now Record<string, any>.
• FieldMetaConditionType.hidden, readonly, required, and options are now optional, and rule is typed as a filter.
• All ExtensionSchema properties are now optional, and DirectusExtension.schema can also be an ExtensionSchemaEntry.

Breaking changes in @directus/types:

• Notification.id is now correctly typed as number.

• Notification.status and timestamp are now nullable.

• @directus/api

  • Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
  • Removed the ip-matching dependency (#28243 by @Nitwel)
  • Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)

• @directus/errors

  • Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)

• @directus/utils

  • Removed the ip-matching dependency (#28243 by @Nitwel)

• @directus/types

  • Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)

• @directus/sdk

  • Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
  • Added header bar buttons to set multiple selected Flows to active or inactive (#28321 by @robluton)
  • Added a confirmation dialog when saving Public policy permission changes on system collections (#28311 by @robluton)
  • Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
  • Added support for linking images in the WYSIWYG editor: select an image and use the link toolbar button (or Mod+K) to wrap it in an anchor; stored <a href><img></a> markup now survives loading without triggering the normalization warning (#28289 by @alvarosabu)
• @directus/api
  • Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
• @directus/memory
  • Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
  • Added optional lock settings to usingLock to override the lock's duration and retry count. A signal is now passed to the callback that aborts if the lock is lost before it finishes (#28331 by @ComfortablyCoding)
• @directus/system-data
  • Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
• @directus/types
  • Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
• @directus/sdk
  • Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
• @directus/constants
  • Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
• @directus/env
  • Exported the default environment values as DEFAULTS (#28077 by @br41nslug)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
  • Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
  • Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
  • Fixed tooltips not appearing on keyboard focus (#28263 by @robluton)
  • Fixed Norwegian time format patterns that displayed raw timestamps instead of times in datetime fields (#28332 by @u12206050)
  • Fixed the module navigation scrolling back to the top when navigating to another page (#28269 by @khanahmad4527)
  • Fixed AI translations creating duplicate target language rows when streaming multiple fields. (#28074 by @xmflsct)
  • Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
  • Cleaned unsupported markup from pasted content in the WYSIWYG editor and flagged it inline, with a view of what was removed and the choice to undo the paste or redo it raw in the raw HTML editor (#28238 by @alvarosabu)
• @directus/api
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
  • Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
  • Fixed OpenAPI spec version to only change when the generated spec does (#28109 by @kheiner)
  • Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
  • Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
  • Fixed license boot holding a lock for the entirety of startup (#28331 by @ComfortablyCoding)
  • Fixed GraphQL marking not-null fields with a default value as nullable in queries and fields with falsey default values as required in create mutations (#28280 by @Dextheking1)
  • Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
  • Fixed TFA enforcement to use effective permissions (#28176 by @psang39)
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
  • Fixed GraphQL fragments on the union type of one M2A field returning no data when spread into another M2A field (#28305 by @Nitwel)
  • Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
  • Fixed a GraphQL query with a __proto__ field alias being able to write a property onto Object.prototype. (#28211 by @datrixlab)
  • Improved validation of storage locations and paths for files (#28077 by @br41nslug)
• @directus/extensions-sdk
  • Fixed directus-extension validate passing or crashing on missing extension paths (#28320 by @PINYOPATTANAWASANPORN)
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
• @directus/composables
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/extensions
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
• @directus/stores
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
• @directus/themes
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
• @directus/types
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/utils
  • Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
  • Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
  • Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
• @directus/specs
  • Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
• @directus/cli
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/storage-driver-cloudinary
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/storage-driver-supabase
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/update-check
  • Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
• @directus/env
  • Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
• @directus/sdk
  • Fixed readActivity, deletePermission, readPermission, updatePermission, readItemPermissions, readNotification, and readRevision not rejecting a null or undefined key or collection (#28072 by @kheiner)

📦 Published Versions

• @directus/app@18.1.0
• @directus/api@40.0.0
• @directus/cli@12.3.1
• @directus/composables@11.6.4
• @directus/constants@14.5.0
• create-directus-extension@12.1.6
• @directus/env@6.4.0
• @directus/errors@3.0.0
• @directus/extensions@4.0.6
• @directus/extensions-registry@4.0.5
• @directus/extensions-sdk@18.0.6
• @directus/memory@4.1.0
• @directus/pressure@4.0.6
• @directus/schema-builder@1.0.4
• @directus/specs@15.2.1
• @directus/storage-driver-azure@13.0.6
• @directus/storage-driver-cloudinary@14.0.3
• @directus/storage-driver-gcs@13.0.6
• @directus/storage-driver-s3@14.0.3
• @directus/storage-driver-supabase@5.0.3
• @directus/stores@3.0.2
• @directus/system-data@4.8.0
• @directus/themes@3.0.1
• @directus/types@18.0.0
• @directus/update-check@14.0.1
• @directus/utils@14.0.0
• @directus/validation@3.0.6
• @directus/sdk@27.0.0

1.13.0 (2026-10-07)

1.13.0 turns the vacation settings into an Out of Office page that can also forward mail, lets filter rules run only for a date range, and copies messages into another connected account. Files from the Files app can be attached in the composer, tags can be set on many messages at once and folders moved in bulk. Messages whose sender can't be verified now carry a warning. It also stops one account's settings and templates from carrying over to the next account signed in on the same browser.

Thank you for your donations:

• You? Become a sponsor!

One-time

• Anonymous
• Anonymous
• Anonymous

Monthly

• @naokton
• @yerTools
• @jsaathof
• @berkersal
• @NABarnes
• @felixzieger
• @pr0ton11
• @fpauser
• @proxforge
• @spss20
• @elgringoYan
• @pauladams8
• @djpriest
• @umakers
• @zplizzi
• @jeremiah
• @Theoretisch1337
• @svandive
• @HiltMundell

Security

• Settings: Signing out and then signing in with another account in the same browser no longer shows the previous account's settings, tags and templates, and no longer saves them to the new account's synced settings (#1185)

Features

• Mail: A message whose sender fails the From domain's checks, or that passes neither SPF nor DKIM, shows a warning above the message and a badge next to the sender. "Always trust this sender" is not offered for it
• Mail: "Copy to account..." in the message menu files a copy in a folder of another connected account and leaves the original where it is. Copies keep their original date (#1150, thanks @lucamzanon)
• Mail: The selection toolbar and the right-click menu put a tag on, or take it off, every selected message at once (#1077)
• Out of office: The vacation settings are now an Out of Office page: the period on top, then the automatic reply and forwarding, each with its own switch. Forwarding works with or without the reply, never forwards spam and can keep a copy in the inbox. The reply can go to all senders, internal senders only or external senders only (#1152, thanks @dealerweb)
• Filters: A rule can be limited to a period, and the rule list shows whether it is scheduled, active or expired (#1152, thanks @dealerweb)
• Filters: The new "All messages" condition matches every message (#1154, thanks @dealerweb)
• Composer: "Attach from Files" attaches files from the Files app, including files shared with you, without downloading and uploading them again (#1179)
• Composer: Typing @ in the message body offers the To and Cc recipients and inserts the chosen one's first name. Bcc recipients are never offered. "Mention recipients with @" in the composer settings turns it off (#1134, thanks @dealerweb)
• Folders: The folder settings can select several folders, with Shift+click for a range, and move them together under another folder or to the top level (#1173)
• Calendar: The day and week views can be limited to working hours, and the week view can leave out non-working days. Events outside the visible hours are counted at the top and bottom of each day and open from there, and a button in the view shows all hours (#1164)
• Login: LOGIN_SHOW_TOKEN_LOGIN=true offers "Sign in with an access token", for JMAP servers that take API tokens instead of passwords, such as Fastmail
• Login: A server in JMAP_SERVERS whose oauth block has both a clientId and a buttonLabel gets its own sign-in button on the login page, even while OAuth is off globally. This allows a "Sign in with Google" button for a Gmail bridge next to servers that use passwords (#1135, thanks @lucamzanon)
• UI: The browser tab title names the active account, as in "Inbox - alice@example.com - Webmail", and Settings, Calendar, Contacts and Files set their own title. Turning off "Subject in Tab Title" under Admin > Policy keeps message subjects out of the title, and with it out of the browser history (#1186, thanks @oguzyilmaznet)
• Unified: While logins reconnect after a page load, the "All accounts" header shows how many are already counted, such as "4/10" (#1140, thanks @lucamzanon)
• Push: A message that reaches several of your accounts rings once. For 30 seconds after an alert, notifications from your other accounts arrive silently (#1141, thanks @lucamzanon)
• Server: SOURCE_CODE_URL points the source code link in Settings > About at the code of a modified build, as AGPL section 13 asks of anyone running one (#1161)

Changes

• Calendar: The day and week views show 08:00 to 20:00 by default. "Limit visible hours" in the calendar settings changes the range or turns it off (#1164)
• Tags: Tag views and their counts leave out messages in Trash and Spam (#1156)
• Mail: In a shared mailbox, the Move menus list that mailbox's folders first and your own folders after them, under your account name (#1149)
• Dependencies: sharp 0.35.5 and source-map-js 1.2.2 (npm audit)
• Docs: CONTRIBUTING.md explains what belongs in core and what in a plugin, and which changes need an agreed issue before a pull request

Fixes

• Mail: Attachments, inline images and .eml downloads of messages in shared folders are fetched from the account that owns them. On Cyrus they failed with "failed to find blob by id" (#1188, thanks @VasilisNtovolos)
• Mail: Archive creates an Archive folder when the account has none, instead of only reporting that it is missing (#1176, thanks @cybersmurf)
• Mail: Opening the webmail starts in the inbox instead of a folder from an earlier visit, such as Trash
• Mail: Opening another folder, tag, account or search starts the message list at the top instead of where the last one was scrolled to (#1138, thanks @dealerweb)
• Mail: Previews no longer start with a style sheet ("@media screen and ...") in the message list and in push notifications (#1136, thanks @lucamzanon)
• Search: Searching from the unified All mail view finds sent mail too
• Send: A draft saved without a subject reopens with an empty subject, so Send warns about it again instead of sending "(No Subject)" (#1189)
• Send: When the server does not confirm that a message was sent, the draft is kept and the composer asks you to check Sent before sending again (#1019, thanks @lucamzanon)
• Send: A message the server refuses shows the server's reason instead of "Invalid reference to non-existing object"
• Send: A forward sent from another account's address no longer fails with blobNotFound. Its attachments and inline images are copied to the sending account first (#1142, thanks @lucamzanon)
• Push: Push turns itself back on when the browser lost its subscription, retrying at most every 15 minutes (#1147, thanks @lucamzanon)
• Push: The notification settings check push again when you come back to the tab, so push turned off in the browser or another tab no longer shows as on (#1148, thanks @lucamzanon)
• Push: When the new message cannot be read, the notification no longer announces another unread message from the Inbox in its place, and a failed lookup shows a generic notification instead of none (#1041, thanks @lucamzanon)
• Filters: "Stop processing further rules" also stops after "Delete silently" and "Reject", so later rules no longer file the message. Rules whose name contains double spaces, a tab or a trailing space no longer gain a copy on every save, and the copies earlier saves left are removed (#1153, thanks @dealerweb)
• Filters: The forwarding limit counts the forwards one message can collect, instead of adding up every enabled rule, and warns when the rule order lets one message go over it (#1155, thanks @dealerweb)
• Filters: A condition with several values wraps inside its card in the expanded rule view (#1139, thanks @dealerweb)
• Filters: An open rule dialog or Sieve editor, and what was typed in it, survives a filter change from another tab or device (#1162, thanks @dealerweb)
• Templates: A tab or device that had not reloaded no longer deletes templates created elsewhere when it saves its settings
• Calendar: Duplicating an event keeps its meeting link (#1170)
• Calendar: The Calendar Agenda plugin shows events from shared and group calendars (#1175, thanks @cybersmurf)
• Files: Folders shared with you can be opened, and your own folders shared, in both folder layouts (#1181)
• Files: Office editing works behind a reverse proxy where the editor and the browser reach the webmail at different addresses. The WOPI client URL may be an internal address (#1130)
• Login: When Stalwart accepts a password and TOTP code but refuses to issue tokens, the login page points at the OAuth client settings instead of opening the browser's own sign-in dialog and reporting a wrong code
• Branding: With APP_NAME set, the authenticator app entry for two-factor sign-in, the About card and the Files preview use the configured name and logo (#1177, thanks @cybersmurf)
• UI: Text fields in dialogs keep the focus when the page behind updates, which happened every 30 seconds and on new mail (#1162, thanks @dealerweb)
• UI: Buttons, menu items, tabs and other controls show the pointer cursor again (#1184, thanks @gwku)
• UI: The account group labels in the From dropdown are readable in dark themes (#1157, thanks @dealerweb)
• Translations: Czech is fully translated (#1174, thanks @cybersmurf), and missing placeholders are restored in Persian, Hebrew, Hungarian, Mongolian and Slovak (#1165, thanks @owgreen-dev)

5.57.0 (2026-10-07)

🚀 New feature

• cli: add strapi enterprise install command (#27849)
• content-type-builder: Preserve data on renaming attributes (#26749)
• review-workflows: record workflow and review actions in audit logs (#27814)

🔥 Bug fix

• updating xhmikosr/decompress (#27885)
• documentId upload in content API (#27834)
• admin: media library banner appears on every admin page instead of only the media library (9012e0ad5a)
• admin: upsell banner stacked with the media library banner when both were shown (349aaea5ba)
• admin: upsell banner briefly mounted and queried its trial data on the media library (ba5482ce21)
• admin: guard RelativeTime against invalid dates (#27472)
• admin: enumeration placeholder shown twice in select trigger (#27785)
• admin: add strapi version to admin telemetry events (#27922)
• admin|upload: stamp legacy media events and send login telemetry once (#27932)
• content-manager: warn before discard removes relations to draft entries (#27815)
• content-manager: preview click-to-edit breaks when the preview script is injected twice (#27796)
• content-manager: relation list loses pages after opening the same document in a modal (#27831)
• content-manager: stop relation fields rendering a full page loader (#27682)
• core: strip empty documentId from create/update data to prevent … (#27766)
• documentation: prevent relation schema generation from exhausting memory (#27780)
• i18n: globe tooltip displays [object object] (#27890)
• lint: make oxlint override globs match repo paths (#27863)
• upload: add rotate to the media library image editor (#27714)
• upload: open asset and folder actions on right-click (#27816)
• upload: stamp mediaLibraryVersion v1 on legacy media library events (#27900)
• utils: explain that status is root-only when used in nested populate (#27857)

📚 Documentation Changes

• architecture modeling (#26927)

⚙️ Chore

• fix package version alignment on develop (#27871)
• remove lodash/fp and prefer native javascript (#27819)
• deps: bump @radix-ui/react-toolbar from 1.1.11 to 1.1.19 (5dc5ad318d)
• email: migrate unit tests from jest to vitest (#27391)
• graphql: migrate backend unit tests from jest to vitest (#27389)
• i18n: remove type exports from server entry (#27817)

💅 Enhancement

• core: accept localization behavior from registered providers (#27806)
• strapi: stop loading the admin build toolchain on every cli command (#27910)

🚨 Security

• document DTS transfer-token trust model as a specific exclusion (#27483)
• deps: upgrade vite to fix server.fs.deny bypass on windows (eadb0c9d82)
• deps: resolve every qs copy in the lockfile to 6.16.0 (3be284aab1)

❤️ Thank You

• Adrien L @Adzouz
• Akshay Iyer @MrAi0
• Andrei L @unrevised6419
• Arthur Moreau @kibwashere
• Bassel Kanso @Bassel17
• Ben Irvin @innerdvations
• DMehaffy @derrickmehaffy
• Gonzalo Andres Garcia @gonbaum
• HichamELBSI @HichamELBSI
• Jamie Howard @jhoward1994
• kensukekikuchi-uh
• mathildeleg @mathildeleg
• Nico André @nclsndr
• Simon Norris @cache-your-dreams
• Valentin @valfur03
• Ziyi @butcherZ

Compose and updates

• Interpolate variables in Compose include paths (#4298) — @kmendell
• Preserve Compose image spelling during project updates and self-updates (#4330) — @kmendell
• Keep the selected tag during self-updates and refresh stale project update status (commit e862615fc4e47c8bf7fbfc089254bf509d0a82c7) — @kmendell

Environments, notifications, and authentication

• Resolve webhook target names in remote environments (#4299) — @kmendell
• Default notifySelf to true and add a setting for Signal notifications (#4302) — @Shraymonks
• Prevent logout from hanging on permission errors after OIDC login (#4309) — @kmendell
• Navigate to the selected environment on environment-scoped routes (#4320) — @kmendell

Backups and maintenance

• Prevent system backups from failing when project files are in use (#4311) — @kmendell
• Allow deleting backups when their S3 repository no longer exists (#4319) — @kmendell
• Report accurate reclaimed space in scheduled pruning (#4317) — @kmendell
• Store Francis actor state in its own SQLite database (commit 93a740597df7a6aa47d5925d9d8dc5499934af05) — @kmendell
• Use persistent Git storage for SSH host keys on native installs (#4300) — @kmendell

Interface and platform

• Remove table header blur (commit 4d9bca092d6006b7265a6ce07928860b47ab84a5) — @kmendell
• Release arcane-cli only for Apple Silicon (arm64), dropping amd64 support (commit b3acb52dd02f39e39489203ce04ab316b47de8f6) — @kmendell

Internal changes

• Move the Docker utils package to go.getarcane.app/docker (#4296) — @kmendell
• Inline logic in project services (commit 73b43dba1e83f9a630b81e21381b533e50cdc57d) — @kmendell

2.15.1

2.15.1

2.15.1