v12.5.0

7 Oktober 2026 om 20:54

⚠️ Potential Breaking Changes

Fixed TFA enforcement to use effective permissions (#28176)
Policies with an IP allow list are now accounted for when enforcing TFA within the allowed range.

Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331)
The /server/license response no longer includes downgrade_reason. Read invalid_reason instead, which also reports why a license that is still in effect could not be renewed.

@directus/errors no longer exports LicenseManagedByEnvError, LicenseOfflineUnsupportedError, LicenseResolveIncompleteError or LicenseServiceUnavailableError, or their error codes. License request failures now surface as LICENSE_INVALID with a failure extension, or as the standard FORBIDDEN, INVALID_PAYLOAD, REQUESTS_EXCEEDED and SERVICE_UNAVAILABLE errors.

Removed the ip-matching dependency (#28243)
Policy ip_access and IMPORT_IP_DENY_LIST values are now more strictly validated. Subnets with a malformed prefix such as 10.0.0.0/ 24 or 10.0.0.0/+24, are no longer accepted.

Existing policies that already store such a value will fail every request for users with that policy.

Fixed requests failing after a process was stopped during schema building (#28316)
CACHE_SCHEMA_MAX_ITERATIONS has been removed. CACHE_SCHEMA_SYNC_TIMEOUT now also limits the schema build itself and defaults to 60000 ms.

If you have configured a lower value, make sure it is long enough for your schema to finish building.

Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072)
Breaking changes in @directus/sdk:

DirectusNotification.id is now correctly typed as number.
DirectusField.schema is now nullable.
FieldMetaConditionOptionType has been removed; condition options is now Record<string, any>.
FieldMetaConditionType.hidden, readonly, required, and options are now optional, and rule is typed as a filter.
All ExtensionSchema properties are now optional, and DirectusExtension.schema can also be an ExtensionSchemaEntry.

Breaking changes in @directus/types:

Notification.id is now correctly typed as number.
Notification.status and timestamp are now nullable.
@directus/api
- Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
- Removed the ip-matching dependency (#28243 by @Nitwel)
- Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/errors
- Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
@directus/utils
- Removed the ip-matching dependency (#28243 by @Nitwel)
@directus/types
- Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
@directus/sdk
- Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)

✨ New Features & Improvements

@directus/app
- Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
- Added header bar buttons to set multiple selected Flows to active or inactive (#28321 by @robluton)
- Added a confirmation dialog when saving Public policy permission changes on system collections (#28311 by @robluton)
- Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
- Added support for linking images in the WYSIWYG editor: select an image and use the link toolbar button (or Mod+K) to wrap it in an anchor; stored <a href><img></a> markup now survives loading without triggering the normalization warning (#28289 by @alvarosabu)
@directus/api
- Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/memory
- Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
- Added optional lock settings to usingLock to override the lock's duration and retry count. A signal is now passed to the callback that aborts if the lock is lost before it finishes (#28331 by @ComfortablyCoding)
@directus/system-data
- Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/types
- Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/sdk
- Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL (#28227 by @robluton)
@directus/constants
- Added a persistent warning notice when editing the Public policy (#28310 by @robluton)
@directus/env
- Exported the default environment values as DEFAULTS (#28077 by @br41nslug)

🐛 Bug Fixes & Optimizations

@directus/app
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
- Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
- Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses (#28331 by @ComfortablyCoding)
- Fixed tooltips not appearing on keyboard focus (#28263 by @robluton)
- Fixed Norwegian time format patterns that displayed raw timestamps instead of times in datetime fields (#28332 by @u12206050)
- Fixed the module navigation scrolling back to the top when navigating to another page (#28269 by @khanahmad4527)
- Fixed AI translations creating duplicate target language rows when streaming multiple fields. (#28074 by @xmflsct)
- Updated outdated type definitions for directus_notifications, directus_permissions, directus_extensions, directus_fields, directus_activity, directus_collections, and directus_revisions (#28072 by @kheiner)
- Cleaned unsupported markup from pasted content in the WYSIWYG editor and flagged it inline, with a view of what was removed and the choice to undo the paste or redo it raw in the raw HTML editor (#28238 by @alvarosabu)
@directus/api
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
- Update license validation to only accept Directus keys and tokens (#28331 by @ComfortablyCoding)
- Fixed OpenAPI spec version to only change when the generated spec does (#28109 by @kheiner)
- Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
- Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
- Fixed license boot holding a lock for the entirety of startup (#28331 by @ComfortablyCoding)
- Fixed GraphQL marking not-null fields with a default value as nullable in queries and fields with falsey default values as required in create mutations (#28280 by @Dextheking1)
- Added opt-in hash option to redis memory, improving cache clear performance (#28214 by @Nitwel)
- Fixed TFA enforcement to use effective permissions (#28176 by @psang39)
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
- Fixed GraphQL fragments on the union type of one M2A field returning no data when spread into another M2A field (#28305 by @Nitwel)
- Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
- Fixed a GraphQL query with a __proto__ field alias being able to write a property onto Object.prototype. (#28211 by @datrixlab)
- Improved validation of storage locations and paths for files (#28077 by @br41nslug)
@directus/extensions-sdk
- Fixed directus-extension validate passing or crashing on missing extension paths (#28320 by @PINYOPATTANAWASANPORN)
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/composables
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/extensions
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/stores
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/themes
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
@directus/types
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/utils
- Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs (#28334 by @br41nslug)
- Fixed filtering and GraphQL typing of geometry subtype fields (e.g. geometry.Point) (#28308 by @PINYOPATTANAWASANPORN)
- Unified related collection lookups to use getRelationInfo (#28246 by @Nitwel)
@directus/specs
- Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error (#28258 by @kheiner)
@directus/cli
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-cloudinary
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/storage-driver-supabase
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/update-check
- Updated undici, axios, nodemailer, basic-ftp, ip-address, and fast-uri to address CVEs (#28330 by @br41nslug)
@directus/env
- Fixed requests failing after a process was stopped during schema building (#28316 by @Nitwel)
@directus/sdk
- Fixed readActivity, deletePermission, readPermission, updatePermission, readItemPermissions, readNotification, and readRevision not rejecting a null or undefined key or collection (#28072 by @kheiner)

📦 Published Versions

@directus/app@18.1.0
@directus/api@40.0.0
@directus/cli@12.3.1
@directus/composables@11.6.4
@directus/constants@14.5.0
create-directus-extension@12.1.6
@directus/env@6.4.0
@directus/errors@3.0.0
@directus/extensions@4.0.6
@directus/extensions-registry@4.0.5
@directus/extensions-sdk@18.0.6
@directus/memory@4.1.0
@directus/pressure@4.0.6
@directus/schema-builder@1.0.4
@directus/specs@15.2.1
@directus/storage-driver-azure@13.0.6
@directus/storage-driver-cloudinary@14.0.3
@directus/storage-driver-gcs@13.0.6
@directus/storage-driver-s3@14.0.3
@directus/storage-driver-supabase@5.0.3
@directus/stores@3.0.2
@directus/system-data@4.8.0
@directus/themes@3.0.1
@directus/types@18.0.0
@directus/update-check@14.0.1
@directus/utils@14.0.0
@directus/validation@3.0.6
@directus/sdk@27.0.0

Lees weergave

⚠️ Potential Breaking Changes

✨ New Features & Improvements

🐛 Bug Fixes & Optimizations

📦 Published Versions