🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
• @directus/api
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.2.1
• @directus/api@37.0.1

⚠️ Potential Breaking Changes

• @directus/api
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
  • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
  • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
• @directus/specs
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• @directus/sdk
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

• @directus/app
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • Replaced tooltip with Reka UI one (#27029 by @HZooly)
  • Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/api
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
• @directus/env
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
  • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
  • Added clearable indicator to input hash field (#27729 by @robluton)
  • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
  • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/api
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
  • Fixed Postgres value too long errors being misattributed to an unrelated field (#27768 by @MahinAnowar)
  • Added validation to restrict geometry types to known types (#27809 by @br41nslug)
  • Fixed batch update failures in the MCP files tool (#27121 by @aayushbaluni)
  • Updated dependencies to resolve security advisories and removed obsolete override pins (#27814 by @br41nslug)
  • Fixed accountability overrides in the graphql websocket (#27813 by @br41nslug)
  • Fixed MCP OAuth role resolution to use the users role instead of the root role (#27790 by @ComfortablyCoding)
  • Bumped hono and vite dependencies (#27820 by @br41nslug)
  • Fixed pre-validation side effects in services (#27800 by @br41nslug)
  • Fixed public websocket accountability handling (#27808 by @br41nslug)
• @directus/extensions-sdk
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/system-data
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/composables
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/validation
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
• @directus/env
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
• @directus/utils
  • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
• License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

• @directus/app@16.2.0
• @directus/api@37.0.0
• @directus/composables@11.5.1
• create-directus-extension@12.1.1
• @directus/env@6.1.0
• @directus/extensions@4.0.1
• @directus/extensions-registry@4.0.1
• @directus/extensions-sdk@18.0.1
• @directus/memory@4.0.1
• @directus/pressure@4.0.1
• @directus/specs@15.0.0
• @directus/storage-driver-azure@13.0.1
• @directus/storage-driver-cloudinary@13.0.1
• @directus/storage-driver-gcs@13.0.1
• @directus/storage-driver-s3@13.0.1
• @directus/storage-driver-supabase@4.0.1
• @directus/system-data@4.5.1
• @directus/themes@2.0.1
• @directus/utils@13.5.1
• @directus/validation@3.0.1
• @directus/sdk@23.0.0

New

• Node.js 24 LTS Support
• MariaDB 12.3 Support
• Ubuntu 26.04 Support

Bug Fixes

• #758 site:delete does not remove user crontab in /var/spool/cron/crontabs/
• #761 SitePhpSettingsType.php throws 500 error while managing PHP sites — TypeError: Unsupported operand types (string + int)
• #771 Font files missing correct mime type header in NGINX

New features

• add appearance toggles for blur and interface animations (#3091 by @othyn)

Bug fixes

• edge tunnel go routine leak (#3073 by @kmendell)
• users with env only scopes unable to access the UI (#3081 by @kmendell)
• use correct disabletlsverification parameter for ntfy (#3084 by @kmendell)
• dont create trivy cache in server/client mode (#3087 by @kmendell)
• stop phantom and duplicate projects from broken syncs (#3088 by @kmendell)
• image polling notifications context being canceled early or not registered at all (#3089 by @kmendell)

Dependencies

• bump svelte from 5.56.3 to 5.56.4 (#3067 by @dependabot[bot])
• align some backend dependencies to avoid tranisent imports (#3068 by @kmendell)
• bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 in /backend (#3044 by @dependabot[bot])
• bump gorm.io/gorm from 1.31.1 to 1.31.2 in /backend (#3046 by @dependabot[bot])
• bump prettier from 3.8.4 to 3.8.5 (#3064 by @dependabot[bot])
• bump @tanstack/virtual-core from 3.17.1 to 3.17.2 (#3047 by @dependabot[bot])
• bump @xyflow/svelte from 1.6.0 to 1.6.1 (#3066 by @dependabot[bot])
• bump react-email from 6.6.3 to 6.6.5 (#3059 by @dependabot[bot])
• bump @tanstack/svelte-query from 6.1.34 to 6.1.35 (#3049 by @dependabot[bot])
• bump actions/cache from 5.0.5 to 6.1.0 (#3071 by @dependabot[bot])
• bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.6 in /backend (#3070 by @dependabot[bot])
• bump @tanstack/svelte-table from 9.0.0-beta.17 to 9.0.0-beta.21 in the tanstack-svelte group across 1 directory (#3072 by @dependabot[bot])

Other

• use atomic file writes and atomic bools for tunnel connections (#3097 by @kmendell)

Full Changelog: v2.2.0...v2.3.0

2.3.0

2.3.0

2.3.0