This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area in some revision views, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Alex Dan (@windbreaker555 on GitHub) for their responsible discovery and reporting of this issue.
Full List of Changes
Updated page revision diffs to use content filtering.
Updated preference change redirect with stronger origin checks.
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New feautures
Sidebar trees keep track of page navigations. If you open a certain category, the treenode will be hightlighted
Show a "Show password" toggle on all password inputs, including login form
Made form fields wider on large monitors, to remove useless whitespace
Reset opcache after update manager update (thanks @Sebbeben, PR #1288)
Allow to create manual backups and download them from the WebUI (thanks @Sebbeben, PR #1255)
Added user_barcode_filter to API (thanks @MayNiklas, PR #1280)
Show manufacturing status in project BOM table (thanks @mkne, #1289)
Create a part lot with quantity, user barcode and order number based on digikey, lcsc or mouser barcode, to reduce amount of manual input
Bug fixes
Do not scroll sidebar to top, when clicking a tree node
Fixed description field on KiCAD 9.0.5 and 9.0.6 (#1289)
Generate correct url for part lots barcode content label placeholders (#1268)
Correctly import files, where only children elements are specified and no parent field (#1272)
Clear the input after selecting an option in tomselect (#1264)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Bug fixes
Security hardening for some endpoints
Fixed minor unauthorized information leackage in IPN generation endpoint (#1283)
Fixed problem with creating digikey parts from barcode when it contained a CREF (#1283)
Use cache:pool:clear --all for more thorough cache clearing in update process
Moved settings cache to cache.system adapter, to ensure its cleared on cache:clear (prevents #1279)
Fixed problem that flash messages were not shown in admin pages
Added support for a global draft version that is automatically available for all items when versioning is enabled (#26772)
Backward Compatibility: If you have an existing version with the key draft and a custom name other than “Draft”, the display name will be standardized to “Draft” (i.e. transformed) to support the new global versioning feature. The version content and functionality remain unchanged.
Added field permission and version access checks to Visual Editor (#26772)
The field access checks require an update of the @directus/visual-editing library to v2.0.0.
Fixed password reset sending emails to external auth provider users (#26627) requestPasswordReset now throws a Forbidden error for external auth provider users.
✨ New Features & Improvements
@directus/app
Added support for a global draft version that is automatically available for all items when versioning is enabled (#26772 by @formfcw)
Persisted table column widths to localStorage (#26767 by @HZooly)
Added field permission and version access checks to Visual Editor (#26772 by @formfcw)
Added image and PDF upload support to Directus AI Assistant with a provider adapter pattern for 3 major providers (#26722 by @bryantgillespie)
(OpenAI, Anthropic, Gemini).
Added version support for visual editing in live preview (#26772 by @formfcw)
Supported provider webhooks for deployment real-time updates (#26683 by @gaetansenn)
Added version support to Visual Editor (#26772 by @formfcw)
Added lower_case_table_names support for mysql (#26736 by @licitdev)
Added image and PDF upload support to Directus AI Assistant with a provider adapter pattern for 3 major providers (#26722 by @bryantgillespie)
(OpenAI, Anthropic, Gemini).
Supported provider webhooks for deployment real-time updates (#26683 by @gaetansenn)
Supported provider webhooks for deployment real-time updates (#26683 by @gaetansenn)
@directus/ai
Added image and PDF upload support to Directus AI Assistant with a provider adapter pattern for 3 major providers (#26722 by @bryantgillespie)
(OpenAI, Anthropic, Gemini).
@directus/utils
Added image and PDF upload support to Directus AI Assistant with a provider adapter pattern for 3 major providers (#26722 by @bryantgillespie)
(OpenAI, Anthropic, Gemini).
Fixed v-select group click handler to respect item-level selectable property (#26650 by @alvarosabu)
Fixed license modal is not responsive on mobile screens (#26758 by @powerseed)
Fixed unsaved changes dialog showing collaborative variant when not in a collaborative session (#26713 by @formfcw)
Updated vue-split-panel dependency (#26709 by @HZooly)
Fixed datetime picker not closing after selecting a date (#26719 by @alvarosabu)
Added some missing translation keys for directus_settings and directus_roles. (#26744 by @powerseed)
Upgraded reka-ui to 2.8.2 for timefield two-digit hour fix (#26724 by @alvarosabu)
Fixed password reset sending emails to external auth provider users (#26627 by @dstockton)
Enabled “Navigate to Item” button for non-editable relational fields (#26711 by @HZooly)
Fixed auto-refresh on mobile by preserving sidebar state via Teleport (#26731 by @HZooly)
Fixed an issue where duplicated fields kept validation rules referencing the original field name. (#26602 by @vizzv)
Fixed drawer not scrolling to top when validation errors occur (#26741 by @robluton)
Fixed reset confirm state after flow error (#26803 by @HZooly)
Fixed performance degradation when editing forms with large GeoJSON geometry fields by using selective shallow cloning for geometry values. (#26560 by @alvarosabu)
Fixed extra tab stop in AI assistant header caused by a focusable VIcon inside VButton. (#26796 by @Mugesh13102001)
Guarded nav-bar and sidebar size stores against non-finite values (#26695 by @HZooly)
Added lower_case_table_names support for mysql (#26736 by @licitdev)
Prevented encrypted field decryption failures from crashing settings reads when the SECRET has changed. Fields that can't be decrypted now return null and log a warning instead of throwing. (#26764 by @bryantgillespie)
@directus/specs
Fixed password reset sending emails to external auth provider users (#26627 by @dstockton)
:::notice requestPasswordReset now throws a Forbidden error for external auth provider users.
:::
@directus/env
Increased the default QUERYSTRING_ARRAY_LIMIT from 100 to 500 (#26737 by @AlexGaillard)
@directus/utils
Replaced ip-matching dependency with node blocklist (#26806 by @br41nslug)
@directus/sdk
Updated ReadProviderOutput type to include the label field (#26645 by @kheiner)
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Allow to add parts from barcode scans of LCSC, digikey and other vendor labels (thanks @swdee)
Allow to scan LCSC labels
Added Amazon info provider via Canopy API
Added an optional HTML sandbox for attachments, allowing to view interactive BOM HTML files inside Part-DB (#1150)
Add option to disable special character keybindings (#1251, thanks @MayNiklas)
Improve working with an external barcode scanner, allow scanning barcodes from everywhere
Make KiCad API better cachable (#1241, thanks @Sebbeben)
Make parameters and order informations visible in KiCad (#1241, thanks @Sebbeben)
Show EDA value and reference in part tables (#1266, thanks @hrueger)
This release specifically addresses a scenario, introduced in v25.12.4, where loading the editor of a page, last updated/created by a different user with blank content, would result in an error.
This release specifically addresses issues introduced in v25.12.4, where drawings could become non-editable in certain scenarios due to content filtering rules.
This release specifically addresses folder permission issues (often showing as an error when attempting to access content) which could occur from changes introduced in v25.12.4.
This is a security release to address a vulnerability where style code in page content could be used to manipulate the page beyond the expected content area, opening up risk of potential phishing and/or tracking by bad page editors.
We advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to SeongYun Moon (@Moonster8282 on GitHub) for their responsible discovery and reporting of this issue.
Additional Update Notices
Page Content - As of this release, extra layers of filtering have been applied to page content. While we have tried to ensure this has minimal impact on content, it's possible this will lead to extra elements being filtered.
Option Change - The ALLOW_CONTENT_SCRIPTS env option is now considered deprecated. It's advised to use the APP_CONTENT_FILTERING option, as documented here, instead if needed.
If you experience issues with your page content being over-filtered feel free to raise an issue on GitHub where we can check if the behaviour is intentional or something which needs to be patched.
You can use the new page content filtering option, with a value of jhf which should match the prior version filtering, but this will remove a layer of content filtering security so is not recommend.
Full List of Changes
Added new option for more granular page filter control.
Updated page content filtering to detect extra cases, and to apply a more aggressive allow-list style filter.
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Bug fixes
Fixed problem that stocktake date of part lot was required when editing part (#1250)
Fixed problem that part tables had wrong sorting on initial loading
Fixed german translations related to update manager
After upgrade, you need to run php bin/console doctrine:migrations:migrate (or equivalent) as webserver user after upgrade.. If you are running a docker container, use sudo docker exec --user=www-data partdb php bin/console doctrine:migrations:migrate, or sudo -E inside the docker container, to ensure that the migrations are applied to the correct database.
Tip
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Allow to set GTIN / EAN numbers for parts
Some info providers allow to provide GTIN infos
Allow to mark if supplier prices contain VAT or not. This is especially useful in combination with info providers
Allow to restrict on which element types attachment types can be applied. For example the "Avatars" attachmen type can only be shown on user attachments
Added ability to stocktake part lots from info page. This easily allows for setting a specific amount, instead of just adding/removing from an database value. The stocktake date is stored, to give a hint on how reliable the amount left is.
Delegate part retrieval to buerklin info provider when an buerklin URL is given (@mkne, PR #1235)
Added API endpoint for label generation (@MayNiklas, PR #1234)
Added functions to twig labels to retrieve associated parts. This allows to print all parts contained in a storage location (#1239)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
Fixed metric list labels to no longer be cut off by bar value labels (#26527 by @Prasad7007)
@directus/api
Fixed asset transformation error when using withoutEnlargement with focal point and dimensions larger than the original image. Target dimensions are now clamped to the original image dimensions. (#26608 by @wotan-allfather)
Preserved SQL parameterization in relational count subquery and used content-disposition library for folder zip download header (#26592 by @dstockton)
@directus/extensions-sdk
Fixed linking scoped extensions created nested folders (#25957 by @Nitwel)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Experimental update manager, to update Part-DB from the web interface (thanks to @Sebbeben, PR #1217)
Added Conrad info provider
Added a generic info provider, to retrieve basic part infos from many shop URLs
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
To use this feature, update @directus/visual-editing to v1.2.0+ on your website.
Disabled interfaces are not interactive anymore, which includes opening disabled read-only fields in a drawer (#26470 by @formfcw)
✨ New Features & Improvements
@directus/app
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
Added toggle to allow comparing revision to previous revision (#26480 by @robluton)
Added relational field support on x-axis of bar chart (#26489 by @JamesW1)
Added visual editing support to the live preview split pane, including display options menu, full-width mode with drag-to-expand, and quick access to the Visual Editor module. (#26463 by @bryantgillespie)
Changed permission-blocked fields from disabled to non-editable appearance (#26572 by @HZooly)
@directus/api
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
@directus/sdk
Fixed race condition and allow accessing the connected state (#26511 by @Nitwel)
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
@directus/system-data
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
@directus/types
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
@directus/errors
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
@directus/env
Added deployment module for triggering deployments from Directus with Vercel as first supported provider (#26473 by @gaetansenn)
Attached prompts, content items, and visual editor elements to AI Assistant Context (#26512 by @bryantgillespie)
Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
Added multi-provider AI support with Google and OpenAI-compatible providers. Extracted shared AI types into new @directus/ai package. (#26481 by @bryantgillespie)
Changed users.last_access display mode to absolute (#26548 by @JamesW1)
The Windows agent's updated version of LibreHardwareMonitorLib now uses PawnIO instead of WinRing0. If you lose temperature sensors, make sure PawnIO is installed. (See #1657 and #1697.)
Container NetworkSent and NetworkRecv fields have been deprecated in favor of Bandwidth. Agents will stop populating those fields in 0.19.0, so please update any integrations to prefer Bandwidth. It's available for all containers on hubs >= 0.18.3.
This is a security release to address a vulnerability where form elements in page content could be used to trick more privileged users into making API requests.
We strongly advise that you update your instance if you allow untrusted users to create or edit pages.
Thanks to Joud Zakharia of zentrust partners GmbH for the discovery of this vulnerability, and thanks to Sven Faßbender of zentrust partners GmbH for their responsible disclosure and great communication of this issue.
Additional Update Notices
Page Content - As of this release, most types of form content are now removed from page content on render. If you applied customizations which made use of in-page form content, you may now need to find alternative methods.
Full List of Changes
Updated application PHP dependencies.
Updated session-based API authentication to only be active for GET requests.
Updated page content filtering to remove many common form elements & attributes.
Updated translations with latest Crowdin changes. (#5997)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Improvements
When using the "upload files" button automatically determine a fitting attachment type based on extension
Support SPN columns for all suppliers as columns in BOM imports, not only LCSC (PR#1208, thanks @MayNiklas)
Bug fixes
Disable the ID search by default, like intended in PR #1184
Use correct language for sidebar trees, even if no user is logged in
Prevent ordering of extra column in log tables, as this errors on Postgres and has no real use
Show an error popup instead of a 500 page when info provider retrieval fails
Added clear button for part select input in BOMs (#1156)
If you like Part-DB, consider donating to support the development. Press the sponsor button on the main github page, for more info.
Important
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
New features
Added console command to change database platform (e.g. from sqlite to mysql, or mysql to postgresql)
Added a ability to search for part IDs from searchfields (thanks @kernchen-brc, #1184)
Improvements
Do not mark new categories excluded from simulation in KiCAD, to avoid annoying symbols in KiCad (thanks @lukas-runge , #1192)
Log in
