❌

Lees weergave

v12.3.0

⚠️ Potential Breaking Changes

Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076)
exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.

Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759)
Nothing to target is a no-op

"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything β€” that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.

Contradictory options error

"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.

Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.

Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.

  • @directus/api
    • Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759 by @ComfortablyCoding)
  • @directus/storage-driver-cloudinary
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/storage-driver-s3
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/storage-driver-local
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/storage-driver-supabase
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/sdk
    • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

✨ New Features & Improvements

  • @directus/app
    • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
    • Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026 by @alvarosabu)
    • Added the collection name appended to display template in item and drawer headers (#28078 by @AlexGaillard)
  • @directus/api
    • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
  • @directus/cli
    • Introduced @directus/cli (d6s / directus-cli) β€” a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)
  • @directus/types
    • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

πŸ› Bug Fixes & Optimizations

  • @directus/app
    • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
    • Removed dead β€œSave and Quit” dropdown row outside the content item view (#28051 by @robluton)
    • Fixed relational items with unsaved nested values, such as newly added translated items in a content version, rendering as -- instead of their display template (#28010 by @alvarosabu)
    • Fixed the repeater interface options showing empty sub-fields, and dropping their key and type on save, when the sub-fields were created through the API without repeating the key and type inside their meta (#28041 by @lazerg)
    • Fixed relational fields showing stale values after a manual flow updated them (#28056 by @AlexGaillard)
    • Fixed the Markdown interface's Edit and Preview buttons not indicating which view is currently active (#28023 by @Aniket-a14)
    • Fixed silent failure of dragging & dropping files with an unrecognized extension into the file library (#28093 by @alvarosabu)
    • Fixed a request for a non-existent item when opening an item whose Many-to-One field references an unsaved parent (#27975 by @sourav-18)
    • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
    • Fixed field configuration appearing to close when selecting related collection that switches interface (#28118 by @robluton)
    • Fixed the translations interface AI translation button only showing for admins (#28089 by @AlexGaillard)
    • Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080 by @AlexGaillard)
    • Stopped the policy creation modal from writing app access permission rows to the database, matching the policy detail page where app access permissions are applied at runtime instead of stored (#28101 by @alvarosabu)
    • Added block-level custom formats to the WYSIWYG interface, so block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)
    • Fixed WYSIWYG content the editor can't represent being hidden and unrestorable in the comparison modal (#28067 by @alvarosabu)
  • @directus/api
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
    • Added a batch-import regression test pinning that a negative temporary key maps like any other non-existent auto-increment key in merge mode (#27861 by @bryantgillespie)
    • Updated MCP tool descriptions and safety annotations for connector clients. (#28090 by @bryantgillespie)
    • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
    • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
    • Updated various dependencies to address CVEs (#28110 by @br41nslug)
    • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
    • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
    • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
    • Fixed TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)
    • Fixed collection names with surrounding whitespace being accepted on creation (#28038 by @lazerg)
    • Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)
  • @directus/storage-driver-azure
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/storage-driver-gcs
    • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • @directus/release-notes-generator
  • @directus/schema
    • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
  • @directus/env
    • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
    • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
  • @directus/extensions-registry
  • @directus/composables
  • @directus/extensions
  • @directus/errors
  • @directus/stores
  • @directus/utils
    • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
    • Updated ESLint dependencies eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)
  • @directus/sdk
    • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
    • Fixed an unhandled rejection in the sdk realtime client when the socket errored or closed during the auth handshake (#28009 by @Deluvio)
  • @directus/specs
    • Fixed OpenAPI spec drift, added missing query parameters, and ensured consistent parameter ordering across list endpoints (#27938 by @kheiner)
  • @directus/types
    • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
  • @directus/extensions-sdk
    • Fixed extension validate crashing on extensions with a disabled sandbox due to an invalid findIndex call (#28087 by @dstockton)

πŸ“¦ Published Versions

  • @directus/app@17.1.0
  • @directus/api@39.0.0
  • @directus/cli@12.2.0
  • @directus/composables@11.6.1
  • create-directus-extension@12.1.3
  • @directus/env@6.2.1
  • @directus/errors@2.5.1
  • @directus/extensions@4.0.3
  • @directus/extensions-registry@4.0.3
  • @directus/extensions-sdk@18.0.3
  • @directus/memory@4.0.3
  • @directus/pressure@4.0.3
  • @directus/release-notes-generator@3.0.1
  • @directus/schema@14.0.2
  • @directus/schema-builder@1.0.2
  • @directus/specs@15.1.1
  • @directus/storage-driver-azure@13.0.3
  • @directus/storage-driver-cloudinary@14.0.0
  • @directus/storage-driver-gcs@13.0.3
  • @directus/storage-driver-local@14.0.0
  • @directus/storage-driver-s3@14.0.0
  • @directus/storage-driver-supabase@5.0.0
  • @directus/stores@3.0.1
  • @directus/themes@2.0.3
  • @directus/types@16.2.0
  • @directus/utils@13.5.3
  • @directus/validation@3.0.3
  • @directus/sdk@25.0.0

  •  

Release 2026.08.18

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.08.18

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.08.18

Changes

  • fix: let the download reach the PO token provider (closes #1064) (f3c464f)
  • feat: carry the SponsorBlock toggle into subscriptions (b10bb61)
  • feat: first-class SponsorBlock toggle (8c2990e)

  •  

v1.20.1

Fixes and improvements

General

  • prevent spamming of 'stream is closed' error during shutdown (#6062)
  • impose a minimum value to clock rate of always-available tracks (#6086) Clock rates below 10 caused the emission of empty samples. Fix the issue by imposing a minimum value of 8khz, that rises to 22khz in case of AAC.
  • fix race condition during sub-stream creation (#6075) (#6095) When a stream with always-available turned on switches from offline to online, or from a publisher to another, the reader mutex was not acquired during writing of codec parameters. This is now fixed.
  • restore ability to run the server in a read-only file system (#6098) This was temporarily lost after the introduction of the native MoQ QUIC listener.
  • fix deadlock when changing configuration through file and API (#6077) (#6101) When changing configuration in parallel by editing the configuration file and calling the API, the server could get into a deadlock that prevented any further action. This is fixed.
  • change default value of authHTTPExclude (#6103) by default, do not exclude any action from HTTP authentication. Old value triggered several security warnings.
  • add destFingerprint parameter (#6106) this allows to validate self-signed certificates of forward destinations.
  • pmp4: fix panic in case of bad input (bluenviron/mediacommon#354) the stsc box was not checked properly. This is now fixed.
  • pmp4: fix panic in case of bad input (bluenviron/mediacommon#355) The parser was not checking that the MP4 was properly sending addresses of samples, resulting in samples with invalid addresses. This is now fixed.
  • pmp4, fmp4: do not emit empty payloads (bluenviron/mediacommon#353)

API

  • redact password in responses (#6110) passwords are not exposed anymore through the API. They can only be set, not read.

Media-Over-QUIC

  • support pulling streams from other servers (#6111)
  • do not accept empty payloads (#6085)
  • limit maximum amount of published tracks (#6087) this prevents clients from consuming an excessive amount of memory.
  • make /moq URL suffix optional (#6107) In order to establish a MoQ session with WebTransport, a /moq suffix was required until now. This is now optional in order to allow connecting to the server with the standard MoQ URL format.
  • impose maximum size on pending reordered bytes (#6112) Decrease the maximum memory that clients can take by imposing a maximum size of 100MB on the pending reordered bytes.

RTSP

  • accept relative digest URI (bluenviron/gortsplib#1118) RFC 2617 section 3.2.2 allows the digest URI to be either an absolute URI or a relative path. Some clients use the latter, which was rejected with "wrong URL" since urlMatches only accepted an exact match against the absolute request URL.
  • send initial RTCP sender report without waiting for a period (bluenviron/gortsplib#1052) (bluenviron/gortsplib#1111) (bluenviron/gortsplib#1120) Reports were emitted only on the ticker, so the first one arrived Period after Initialize (10s by default) and later still when no RTP packet had been sent by that first tick, since report() returns nil until then and the next opportunity is another Period away.
  • ensure that decoders can produce only output that does not crash encoders (bluenviron/gortsplib#1123)
  • discard empty Opus and G722 RTP packets (bluenviron/gortsplib#1131)
  • improve error message when setting read buffer fails (bluenviron/gortsplib#1133)
  • server: fix race condition when recording (bluenviron/gortsplib#1134) state was not protected.

RTMP

  • inform about authentication failures (#5657) (#6072) Reply with NetStream.Play.Failed or NetStream.Publish.Unauthorized when a client is not authorized to play or publish. This makes clients like OBS to stop recreating the connection in case of authentication failures.

  • reader: do not emit empty frames (bluenviron/gortmplib#106)

  • parse video PTS delta as signed (bluenviron/gortmplib#88)
    HLS

  • prefer hls.js on iOS too (#6090) In the embedded HLS reader, use hls.js on iOS, that was previously disabled due to compatibility issues that should have been solved.

  • unlock the session-in-query+iOS combination (#6088) this was previously blocked because the session in query was meant to be dynamic, therefore incompatible with static playlists required by iOS. It is not anymore, so we can support that.

  • stop using cookies with plain HTTP (#6089) in case of plain HTTP, fall back to query parameters, which are safer than HTTP cookies because they are not shared between different pages/domains, although they are visible in the URL.

WebRTC

  • support forwarding streams (#6099)
  • fix warning when IPv6 is disabled (#5733) (#6048)
  • improve performance by ignoring mDNS candidates (#4963) (#6064) mDNS candidates sometimes require a large CPU portion, they are not involved in any connectivity method mentioned in the documentation, they work in local networks only.

SRT

  • apply UDP read buffer size from configuration (#6069) Use upstream datarhei/gosrt's ListenerControl config field (datarhei/gosrt#144) to set SO_RCVBUF on the SRT listener's UDP socket.

RPI Camera

  • fix crash when secondary stream is enabled (#6060) (#6061)
  • prevent invalid MJPEG sizes (#6080) width and height of MJPEG frames must be multiple of 8 and less than 2048, otherwise they cannot be routed with RTP/RTSP.

Dependencies

  • code.cloudfoundry.org/bytefmt updated from v0.83.0 to v0.85.0
  • github.com/alecthomas/kong updated from v1.16.0 to v1.16.1
  • github.com/asticode/go-astits updated from v1.15.0 to v1.16.0
  • github.com/bluenviron/gohlslib/v2 updated from v2.4.2 to v2.4.3
  • github.com/bluenviron/gortmplib updated from v1.0.0 to v1.0.1
  • github.com/bluenviron/gortsplib/v5 updated from v5.6.3 to v5.6.4
  • github.com/bluenviron/mediacommon/v2 updated from v2.9.2 to v2.9.3
  • github.com/datarhei/gosrt updated from v0.11.0 to v0.11.1-0.20260812091715-a77b40bb4b76
  • github.com/pion/ice/v4 updated from v4.4.0 to v4.4.1
  • github.com/pion/transport/v4 updated from v4.0.2 to v4.1.0
  • github.com/stretchr/testify updated from v1.11.1 to v1.12.0
  • golang.org/x/crypto updated from v0.54.0 to v0.55.0
  • golang.org/x/net updated from v0.57.0 to v0.58.0
  • github.com/davecgh/go-spew removed
  • github.com/pion/srtp/v3 updated from v3.0.12 to v3.0.13
  • github.com/pmezard/go-difflib removed
  • golang.org/x/text updated from v0.40.0 to v0.41.0
  • hls.js updated from v1.6.16 to v1.7.0

Security

Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.

Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:

ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx

You can verify checksums of binaries by downloading checksums.sha256 and running:

cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check

  •  
❌