❌

Normale weergave

Ontvangen — 1 Juli 2026 ⏭

v12.1.0

✇Directus
Door: github-actions[bot]
13 Juli 2026 om 20:27

Note

Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

⚠️ Potential Breaking Changes

  • @directus/api
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
    • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
    • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
    • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
  • @directus/specs
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • @directus/sdk
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

🐛 Bug Fixes & Optimizations

  • @directus/app
    • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
    • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
    • Added clearable indicator to input hash field (#27729 by @robluton)
    • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
    • Bumped version of @directus/license package (#27785 by @AlexGaillard)
    • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
    • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
    • Added interface settings for collection status field (#27781 by @robluton)
  • @directus/api
  • @directus/extensions-sdk
  • @directus/system-data
  • @directus/composables
  • @directus/validation
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • @directus/env
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • @directus/utils
    • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
  • License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

  • @directus/app@16.2.0
  • @directus/api@37.0.0
  • @directus/composables@11.5.1
  • create-directus-extension@12.1.1
  • @directus/env@6.1.0
  • @directus/extensions@4.0.1
  • @directus/extensions-registry@4.0.1
  • @directus/extensions-sdk@18.0.1
  • @directus/memory@4.0.1
  • @directus/pressure@4.0.1
  • @directus/specs@15.0.0
  • @directus/storage-driver-azure@13.0.1
  • @directus/storage-driver-cloudinary@13.0.1
  • @directus/storage-driver-gcs@13.0.1
  • @directus/storage-driver-s3@13.0.1
  • @directus/storage-driver-supabase@4.0.1
  • @directus/system-data@4.5.1
  • @directus/themes@2.0.1
  • @directus/utils@13.5.1
  • @directus/validation@3.0.1
  • @directus/sdk@23.0.0

  •  
  • ↗️
❌