This release specifically addresses issues introduced in v25.12.4, where drawings could become non-editable in certain scenarios due to content filtering rules.
This release contains the following fixes and changes:
This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
This release contains the following fixes and changes:
Log in@directus/app@15.4.0@directus/api@33.3.1
BookStack v25.12.4 has been released.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
ALLOW_CONTENT_SCRIPTS env option is now considered deprecated. It's advised to use the APP_CONTENT_FILTERING option, as documented here, instead if needed.If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of jhf which should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.
Warning
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
group (#26626 by @dstockton)@directus/app@15.3.0@directus/api@33.3.0@directus/composables@11.2.13@directus/constants@14.1.0create-directus-extension@11.0.29@directus/env@5.5.3@directus/extensions@3.0.19@directus/extensions-registry@3.0.19@directus/extensions-sdk@17.0.9@directus/memory@3.1.2@directus/pressure@3.0.17@directus/schema-builder@0.0.14@directus/storage-driver-azure@12.0.17@directus/storage-driver-cloudinary@12.0.17@directus/storage-driver-gcs@12.0.17@directus/storage-driver-s3@12.1.3@directus/storage-driver-supabase@3.0.17@directus/themes@1.2.4@directus/types@14.2.1@directus/utils@13.2.2@directus/validation@2.0.17
Warning
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.6.0...v2.7.0
Note
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
withoutEnlargement with focal point and dimensions larger than the original image. Target dimensions are now clamped to the original image dimensions. (#26608 by @wotan-allfather)node:assert usage from shared utils (#26614 by @ComfortablyCoding)@directus/app@15.2.0@directus/api@33.2.0@directus/composables@11.2.12create-directus-extension@11.0.28@directus/env@5.5.2@directus/extensions@3.0.18@directus/extensions-registry@3.0.18@directus/extensions-sdk@17.0.8@directus/memory@3.1.1@directus/pressure@3.0.16@directus/schema-builder@0.0.13@directus/storage-driver-azure@12.0.16@directus/storage-driver-cloudinary@12.0.16@directus/storage-driver-gcs@12.0.16@directus/storage-driver-s3@12.1.2@directus/storage-driver-supabase@3.0.16@directus/themes@1.2.3@directus/types@14.2.0@directus/utils@13.2.1@directus/validation@2.0.16
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.5.1...v2.6.0
@directus/app@15.1.1@directus/api@33.1.1@directus/composables@11.2.11create-directus-extension@11.0.27@directus/env@5.5.1@directus/extensions-sdk@17.0.7
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
To use this feature, update @directus/visual-editing to v1.2.0+ on your website.
Disabled interfaces are not interactive anymore, which includes opening disabled read-only fields in a drawer (#26470 by @formfcw)
@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)@directus/ai package. (#26481 by @bryantgillespie)ldapjs with ldapts (#26363 by @dstockton)v-template-input when typing or updating content. (#26520 by @mustafaazad03)@directus/ai package. (#26481 by @bryantgillespie)@directus/app@15.1.0@directus/api@33.1.0@directus/ai@1.1.0@directus/composables@11.2.10create-directus-extension@11.0.26@directus/env@5.5.0@directus/errors@2.2.0@directus/extensions@3.0.17@directus/extensions-registry@3.0.17@directus/extensions-sdk@17.0.6@directus/memory@3.1.0@directus/pressure@3.0.15@directus/schema-builder@0.0.12@directus/storage-driver-azure@12.0.15@directus/storage-driver-cloudinary@12.0.15@directus/storage-driver-gcs@12.0.15@directus/storage-driver-s3@12.1.1@directus/storage-driver-supabase@3.0.15@directus/system-data@4.1.0@directus/themes@1.2.2@directus/types@14.1.0@directus/utils@13.2.0@directus/validation@2.0.15@directus/sdk@21.1.0
The Windows agent's updated version of LibreHardwareMonitorLib now uses PawnIO instead of WinRing0. If you lose temperature sensors, make sure PawnIO is installed. (See #1657 and #1697.)
Container NetworkSent and NetworkRecv fields have been deprecated in favor of Bandwidth. Agents will stop populating those fields in 0.19.0, so please update any integrations to prefer Bandwidth. It's available for all containers on hubs >= 0.18.3.
SHARE_ALL_SYSTEMS for system_details, smart_devices, and systemd_services. (#1660)/dev/shm instead of /tmp if available. (#1455)smartctl --scan timeout to 10 seconds. (#1465)Full Changelog: v0.18.2...v0.18.3
BookStack v25.12.3 has been released.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.5.0...v2.5.1
This is a release focussing on bug fixing, in particular regressions from the release 1.28.0.
Selected new features ✨:
Improved performance 🏎️:
Many bug fixes 🐛
This release has been made by @Alkarex, @Frenzie, @Inverle and newcomers @ciro-mota, @eveiscoull, @hackerman70000, @Hufschmidt, @johan456789, @martgnz, @mmeier86, @netsho, @neuhaus, @RobLoach, @rupakbajgain.
Full changelog:
transliterator_transliterate fallback (when the php-intl extension is unavailable) #8427lastUserModified database column also during mark-as-read action #8346session.cookie-lifetime #8446CURLOPT_ACCEPT_ENCODING #8376, simplepie#960, simplepie#962<template> element #8443.gitignore to ignore installed extensions #8372
This release contains the following fixes and changes:
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.4.0...v2.5.0
Added multi-domain support for OAuth/OpenID (#26312)
SSO callback URL generation and redirect validation now includes port matching to ensure redirects target the correct server.
Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905)
getAsset / GET /assets/:id now respects directus_files permissions when returning file based fields.
/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)getAsset returning all file fields instead of only those allowed by the users permissions (#25905 by @gaetansenn)AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)/webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)aws:kms Server Side Encryption (#26377 by @Joey92)datetime, file, select-dropdown-m2o & collection-item dropdowns interfaces (#26365 by @ComfortablyCoding)nodemailer dependency from 7.0.10 to 7.0.11 (#26288 by @dependabot)cockroachdb failing on "Add Marketplace" migration (#26467 by @ComfortablyCoding)CACHE_SYSTEM_TTL (#26295 by @clintmoyer)nodemailer dependency from 7.0.10 to 7.0.11 (#26288 by @dependabot)AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)CACHE_SYSTEM_TTL (#26295 by @clintmoyer)AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)fields from object notation to dot syntax in SDK subscription queries (#26397 by @bruno-costa)@directus/app@15.0.0@directus/api@33.0.0@directus/composables@11.2.9create-directus-extension@11.0.25@directus/env@5.4.0@directus/extensions@3.0.16@directus/extensions-registry@3.0.16@directus/extensions-sdk@17.0.5@directus/memory@3.0.14@directus/pressure@3.0.14@directus/schema@13.0.5@directus/schema-builder@0.0.11@directus/specs@12.0.0@directus/storage-driver-azure@12.0.14@directus/storage-driver-cloudinary@12.0.14@directus/storage-driver-gcs@12.0.14@directus/storage-driver-s3@12.1.0@directus/storage-driver-supabase@3.0.14@directus/system-data@4.0.0@directus/themes@1.2.1@directus/types@14.0.0@directus/utils@13.1.1@directus/validation@2.0.14@directus/sdk@21.0.0
This release fixes a regression that resulted in the agent binary being dynamically linked, causing it to fail on musl-based Linux distributions like Alpine and OpenWrt. If you were affected by this, see below for instructions to fix.
update command now detects your system's C library and downloads the optimal binary (static or glibc) on Linux.If you updated to a version that currently fails to start (./beszel-agent: not found), you can restore your agent by running the following commands:
# 1. Download latest static binary (replace 'amd64' with your arch if different) curl -L https://github.com/henrygd/beszel/releases/latest/download/beszel-agent_linux_amd64.tar.gz | tar -xz # 2. Replace the broken binary mv beszel-agent /opt/beszel-agent/beszel-agent chmod +x /opt/beszel-agent/beszel-agent # 3. Restart the service # For Alpine: rc-service beszel-agent restart # For OpenWRT: /etc/init.d/beszel-agent restart
Full Changelog: v0.18.1...v0.18.2
Fixes bug in 0.18.0 release where all containers were cleared from the "All Containers" page when any system returned no containers.
Additionally, there was a temporary problem with the :latest Docker image which may have caused your agents to report as down. This is fixed now and you can re-pull the image if necessary: #1618 (comment)
--url and --token command line arguments to the agent. (#1524)SMART_INTERVAL environment variable to customize S.M.A.R.T. data collection interval.system_details collection to store infrequently updated system information.smartctl timeout to 15 seconds. (#1465)Full Changelog: v0.17.0...v0.18.0
Note
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Note
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Full Changelog: v2.3.0...v2.4.0
BookStack v25.12.1 has been released.
This is a security release which adds limits to search operations, and adds size checks to ZIP import files before they are extracted.
These changes help prevent potential abuse to host disk space usage and/or service availability.
We recommended to update your instance if untrusted users have ZIP import permissions, or if untrusted users can perform searches.
Thanks to Jeong Woo Lee (@eclipse07077-ljw) and Gabriel Rodrigues (aka TEXUGO) for reporting these vulnerabilities.
Note
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
This is a major release, just in time for the holidays 🎄
Selected new features ✨:
userdate:PT1H for the past hourImproved performance 🏎️:
Selected bug fixes 🐛:
Breaking changes 💥:
This release has been made by @Alkarex, @Frenzie, @Inverle, @aledeg, @andris155, @horvi28, @math-GH, @minna-xD and newcomers @Darkentia, @FollowTheWizard, @GreyChame1eon, @McFev, @jocmp, @larsks, @martinhartmann, @matthew-neavling, @pudymody, @raspo, @scharmach, @scollovati, @stag-enterprises, @vandys, @xtmd, @yzx9.
Full changelog:
userdate:PT1H for the past hour #8093\b and \B for regex search using PostgreSQL #8141~ subsequent-sibling #8154
Retry-After rules for proxies #8029, #8218data: to CSP in subscription controller #8253Retry-After #8195f.kind to ease migrations from FreshRSS versions older than 1.20.0 #8148config.custom.php during install #8033window.bcrypt object #8166chart.js v4 update #8298WordPress.com HTTP duplicates with WebSub Automattic/pushpress#16cli/health.php compatibility with OpenID Connect #8040cli/access-permissions.sh to detect the correct permission Web group such as www-data, apache, or httpexec() function for git update #8228DOMDocument::saveHTML() scrambling charset encoding in some versions of libxml2 #8296php-intl #8334<select> #8190Promise to async/await: #8182move #8214lib_rss.php with potential breaking changes for some extensions #8193,#[Deprecated] #8325--no-progress #8315
fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)files.upload when TUS is enabled (#26247 by @br41nslug)fetchRolesTree,fetchGlobalAccess, fetchGlobalAccessForUser and fetchGlobalAccessForRoles to the public utility package (#26248 by @ComfortablyCoding)esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)esbuild dependency from 0.25.12 to 0.26.0 (#26215 by @dependabot)@directus/app@14.4.0@directus/api@32.2.0@directus/composables@11.2.8create-directus-extension@11.0.24@directus/env@5.3.3@directus/errors@2.1.0@directus/extensions@3.0.15@directus/extensions-registry@3.0.15@directus/extensions-sdk@17.0.4@directus/memory@3.0.13@directus/pressure@3.0.13@directus/schema-builder@0.0.10@directus/storage-driver-azure@12.0.13@directus/storage-driver-cloudinary@12.0.13@directus/storage-driver-gcs@12.0.13@directus/storage-driver-s3@12.0.13@directus/storage-driver-supabase@3.0.13@directus/stores@2.0.0@directus/system-data@3.5.0@directus/themes@1.2.0@directus/types@13.5.0@directus/utils@13.1.0@directus/validation@2.0.13@directus/sdk@20.3.0
