What changed in Directus from 11 to 12

✨ New Features & Improvements

• @directus/api
  • Added countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed MCP OAuth clients settings pages concatenating breadcrumbs into the page title (#28115 by @MHJahanbakhsh)
• @directus/api
  • Fixed the WebSocket heartbeat leaking a websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)
  • Fixed GraphQL query fragments returning null fields (#28128 by @ComfortablyCoding)
  • Fixed public registration verification using the provided email instead of the stored one (#28144 by @br41nslug)
  • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/cli
  • Stripped project_id when pulling settings, so a sync no longer copies one instance's identity onto another (#28132 by @lazerg)
• @directus/sdk
  • Fixed unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)
• @directus/system-data
  • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
• @directus/storage-driver-s3
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
• @directus/storage-driver-supabase
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@17.1.1
• @directus/api@39.1.0
• @directus/cli@12.2.1
• @directus/composables@11.6.2
• create-directus-extension@12.1.4
• @directus/env@6.2.2
• @directus/extensions@4.0.4
• @directus/extensions-sdk@18.0.4
• @directus/memory@4.0.4
• @directus/pressure@4.0.4
• @directus/storage-driver-azure@13.0.4
• @directus/storage-driver-cloudinary@14.0.1
• @directus/storage-driver-gcs@13.0.4
• @directus/storage-driver-s3@14.0.1
• @directus/storage-driver-supabase@5.0.1
• @directus/system-data@4.6.1
• @directus/themes@2.0.4
• @directus/utils@13.5.4
• @directus/validation@3.0.4
• @directus/sdk@25.0.1

⚠️ Potential Breaking Changes

Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076) exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.

Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759) Nothing to target is a no-op

"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything — that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.

Contradictory options error

"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.

Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111) The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.

Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#28120) If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.

• @directus/api
  • Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-s3
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-local
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-supabase
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/sdk
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

✨ New Features & Improvements

• @directus/app
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
  • Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026 by @alvarosabu)
  • Added the collection name appended to display template in item and drawer headers (#28078 by @AlexGaillard)
• @directus/api
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797 by @bryantgillespie)
• @directus/cli
  • Introduced @directus/cli (d6s / directus-cli) — a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861 by @bryantgillespie)
• @directus/types
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Removed dead “Save and Quit” dropdown row outside the content item view (#28051 by @robluton)
  • Fixed relational items with unsaved nested values, such as newly added translated items in a content version, rendering as -- instead of their display template (#28010 by @alvarosabu)
  • Fixed the repeater interface options showing empty sub-fields, and dropping their key and type on save, when the sub-fields were created through the API without repeating the key and type inside their meta (#28041 by @lazerg)
  • Fixed relational fields showing stale values after a manual flow updated them (#28056 by @AlexGaillard)
  • Fixed the Markdown interface's Edit and Preview buttons not indicating which view is currently active (#28023 by @Aniket-a14)
  • Fixed silent failure of dragging & dropping files with an unrecognized extension into the file library (#28093 by @alvarosabu)
  • Fixed a request for a non-existent item when opening an item whose Many-to-One field references an unsaved parent (#27975 by @sourav-18)
  • Updated outdated type definitions for directus_files, directus_collections, directus_deployments, directus_settings, and directus_users (#27945 by @kheiner)
  • Fixed field configuration appearing to close when selecting related collection that switches interface (#28118 by @robluton)
  • Fixed the translations interface AI translation button only showing for admins (#28089 by @AlexGaillard)
  • Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080 by @AlexGaillard)
  • Stopped the policy creation modal from writing app access permission rows to the database, matching the policy detail page where app access permissions are applied at runtime instead of stored (#28101 by @alvarosabu)
  • Added block-level custom formats to the WYSIWYG interface, so block, selector and items entries in the Custom Formats option apply classes and attributes to paragraphs, headings and other block nodes from the Formats dropdown (#28044 by @alvarosabu)
  • Fixed WYSIWYG content the editor can't represent being hidden and unrestorable in the comparison modal (#28067 by @alvarosabu)
• @directus/api
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
  • Added a batch-import regression test pinning that a negative temporary key maps like any other non-existent auto-increment key in merge mode (#27861 by @bryantgillespie)
  • Updated MCP tool descriptions and safety annotations for connector clients. (#28090 by @bryantgillespie)
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
  • Updated various dependencies to address CVEs (#28110 by @br41nslug)
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed TranslationsService.updateMany incorrectly rejecting single-row updates containing both key and language (#28001 by @suhailopensource)
  • Fixed collection names with surrounding whitespace being accepted on creation (#28038 by @lazerg)
  • Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107 by @AlexGaillard)
• @directus/storage-driver-azure
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/storage-driver-gcs
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076 by @dstockton)
• @directus/release-notes-generator
  • Updated or replaced various dependencies to address GHSA-rgw5-rvv9-x895 (#28050 by @br41nslug)
• @directus/schema
  • Improved MS SQL Server reliability and performance by optimizing schema introspection and only enabling trigger compatibility when required (#27699 by @br41nslug)
• @directus/env
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989 by @dstockton)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111 by @ComfortablyCoding)
• @directus/extensions-registry
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/composables
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/extensions
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/errors
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/stores
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
• @directus/utils
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Updated ESLint dependencies eslint, @eslint/js, eslint-plugin-vue, and typescript-eslint. Replaced eslint-plugin-import with eslint-plugin-import-x (#28047 by @br41nslug)
• @directus/sdk
  • Removed unused dependencies across the monorepo (#28049 by @ComfortablyCoding)
  • Fixed an unhandled rejection in the sdk realtime client when the socket errored or closed during the auth handshake (#28009 by @Deluvio)
• @directus/specs
  • Fixed OpenAPI spec drift, added missing query parameters, and ensured consistent parameter ordering across list endpoints (#27938 by @kheiner)
• @directus/types
  • Fixed extensions that set sandbox without an enabled flag being rejected as invalid (#28087 by @dstockton)
• @directus/extensions-sdk
  • Fixed extension validate crashing on extensions with a disabled sandbox due to an invalid findIndex call (#28087 by @dstockton)

📦 Published Versions

• @directus/app@17.1.0
• @directus/api@39.0.0
• @directus/cli@12.2.0
• @directus/composables@11.6.1
• create-directus-extension@12.1.3
• @directus/env@6.2.1
• @directus/errors@2.5.1
• @directus/extensions@4.0.3
• @directus/extensions-registry@4.0.3
• @directus/extensions-sdk@18.0.3
• @directus/memory@4.0.3
• @directus/pressure@4.0.3
• @directus/release-notes-generator@3.0.1
• @directus/schema@14.0.2
• @directus/schema-builder@1.0.2
• @directus/specs@15.1.1
• @directus/storage-driver-azure@13.0.3
• @directus/storage-driver-cloudinary@14.0.0
• @directus/storage-driver-gcs@13.0.3
• @directus/storage-driver-local@14.0.0
• @directus/storage-driver-s3@14.0.0
• @directus/storage-driver-supabase@5.0.0
• @directus/stores@3.0.1
• @directus/themes@2.0.3
• @directus/types@16.2.0
• @directus/utils@13.5.3
• @directus/validation@3.0.3
• @directus/sdk@25.0.0

⚠️ Potential Breaking Changes

Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996) The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.

Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#27754) The WYSIWYG interface now runs on Tiptap instead of TinyMCE

• tinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.
• TinyMCE is no longer bundled with the app, so anything depending on it (custom plugins, skins, content CSS, the global tinymce object) no longer applies.
• Existing content that contains markup the editor would normalize now locks the field read-only until the warning dialog is confirmed. Editing and autosave are blocked while locked, including raw-value editing.

Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816) The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))

Added support for multi-collection flat data imports (#27984) Import file size is now capped by default A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.

Updated background query flag handling for POST /utils/import/:collection The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).

Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984) The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))

Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995) Image transformation output is now restricted Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.

• @directus/app

  • Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)

    To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.

• @directus/api
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816 by @MahinAnowar)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
• @directus/sdk
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)

✨ New Features & Improvements

• @directus/app
  • Added JSON path filtering to Studio filters. (#27918 by @robluton)
  • Added search to the collection selection in relationship configuration (#27950 by @baguse)
  • Added global setting for default save action (#27993 by @robluton)
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
• @directus/api
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • Fixed incomplete json filter paths errors (#27954 by @robluton)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)
• @directus/composables
  • Added JSON path filtering to Studio filters. (#27918 by @robluton)
• @directus/system-data
  • Added global setting for default save action (#27993 by @robluton)
• @directus/types
  • Added global setting for default save action (#27993 by @robluton)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
• @directus/env
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
• @directus/sdk
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
• @directus/specs
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for partial schema snapshot via new includeCollections/excludeCollections parameters (#27984 by @ComfortablyCoding)
  • Added a mode parameter and partial snapshot support to the schema diff endpoint (#27984 by @ComfortablyCoding)
• @directus/errors
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed the translations split view hiding the second language when resizing the window (#27681 by @valerkahere)
  • Fixed geometry fields losing their subtype on schema changes (#27828 by @rajkumar0932)
  • Fixed stale dynamic permission presets after editing current account (#27899 by @scarab-systems)
  • Fixed a type error in the module bar default configuration (#27944 by @kheiner)
  • Amended app's save-as-copy logic to not create new items when only adjusting order on relationals (#27871 by @AlexGaillard)
  • Fixed the auth module registering a permanent cookie polling interval (#27851 by @dstockton)
  • Fixed presentation fields allowing required and/or readonly to be set (#27688 by @sourav-18)
  • Fixed missing translations for the Datetime display timezone options (#28000 by @lazerg)
  • Fixed dropdown menus shifting position when flipped above their trigger. (#27958 by @Harshith-muddasani)
  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
  • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
  • Fixed live preview requesting a draft version before it exists, which caused a forbidden error (#27848 by @dstockton)
  • Fixed issue causing singleton primary key mismatch (#27919 by @robluton)
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • Fixed many-to-one fields to display the saved key when the referenced item is inaccessible due to permissions (#27899 by @scarab-systems)
  • Fixed a Forbidden error when publishing an itemless content version without delete permission on directus_versions (#27892 by @alex-hsieh)
• @directus/api

  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

  • Added global setting for default save action (#27993 by @robluton)

  • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

  • Restricted license key previews to administrators after initial project setup (#27886 by @ComfortablyCoding)

  • Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#27903 by @dstockton)

  • Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#27990 by @br41nslug)

  • Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#27992 by @br41nslug)

  • Fixed schema apply ignoring configured license (#27869 by @ComfortablyCoding)

  • Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#27864 by @apoorva-01)

  • Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • Fixed requests referencing duplicate primary keys resulting in forbidden error (#27882 by @lazerg)

  • Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)

  • Fixed count, countAll, and PK counts being inflated when filtering across relations (#27926 by @ComfortablyCoding)

  • Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#27793 by @amitmishra11)

  • Fixed WebSocket handlers not validating query parameters (#27845 by @tsushanth)

  • Fixed unnecessary schema cache rebuilds on permission-related changes (#27876 by @dstockton)

• @directus/sdk
  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)
  • Fixed nested filters on relational fields losing type inference, so filtering a related collection's field (e.g. filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#27815 by @MahinAnowar)
  • Removed phantom timestamp from directus_operations (#27942 by @kheiner)
  • Fixed an unhandled rejection in the sdk realtime client when the connection closed during a heartbeat ping (#27846 by @apoorva-01)
• @directus/specs

  • Updated the remaining *.io references to the current *.com domains where possible (#27948 by @kheiner)

  • Fixed OpenAPI spec error schema to match API error format (#27885 by @kheiner)

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • Added missing /users registration and 2FA endpoint openapi specs (#27857 by @kheiner)

  • Removed OpenAPI query parameters that the underlying controllers never honor (#27922 by @kheiner)

  • Added missing id path parameter to the /comments/{id} OpenAPI spec (#27884 by @kheiner)

• @directus/constants
  • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#27934 by @JamesW1)
• @directus/system-data
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
• @directus/env

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

• @directus/utils

  • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#27862 by @dstockton)

    Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

• @directus/schema
  • Fixed MSSQL schema introspection reporting the byte size as max_length for non-character types (#27825 by @BIGSUS24)
• @directus/storage-driver-cloudinary
  • Fixed Cloudinary uploads failing when the configured root contains whitespace (#27841 by @itsabhay1)

📦 Published Versions

• @directus/app@17.0.0
• @directus/api@38.0.0
• @directus/composables@11.6.0
• @directus/constants@14.4.1
• create-directus-extension@12.1.2
• @directus/env@6.2.0
• @directus/errors@2.5.0
• @directus/extensions@4.0.2
• @directus/extensions-registry@4.0.2
• @directus/extensions-sdk@18.0.2
• @directus/memory@4.0.2
• @directus/pressure@4.0.2
• @directus/schema@14.0.1
• @directus/schema-builder@1.0.1
• @directus/specs@15.1.0
• @directus/storage-driver-azure@13.0.2
• @directus/storage-driver-cloudinary@13.0.2
• @directus/storage-driver-gcs@13.0.2
• @directus/storage-driver-s3@13.0.2
• @directus/storage-driver-supabase@4.0.2
• @directus/system-data@4.6.0
• @directus/themes@2.0.2
• @directus/types@16.1.0
• @directus/utils@13.5.2
• @directus/validation@3.0.2
• @directus/sdk@24.0.0

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

🐛 Bug Fixes & Optimizations

• @directus/app
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
• @directus/api
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.2.1
• @directus/api@37.0.1

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

⚠️ Potential Breaking Changes

• @directus/api
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
  • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
  • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
• @directus/specs
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• @directus/sdk
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
• Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)

✨ New Features & Improvements

• @directus/app
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • Replaced tooltip with Reka UI one (#27029 by @HZooly)
  • Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/api
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
• @directus/env
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
  • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
  • Added clearable indicator to input hash field (#27729 by @robluton)
  • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
  • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/api
  • Bumped version of @directus/license package (#27785 by @AlexGaillard)
  • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
  • Fixed Postgres value too long errors being misattributed to an unrelated field (#27768 by @MahinAnowar)
  • Added validation to restrict geometry types to known types (#27809 by @br41nslug)
  • Fixed batch update failures in the MCP files tool (#27121 by @aayushbaluni)
  • Updated dependencies to resolve security advisories and removed obsolete override pins (#27814 by @br41nslug)
  • Fixed accountability overrides in the graphql websocket (#27813 by @br41nslug)
  • Fixed MCP OAuth role resolution to use the users role instead of the root role (#27790 by @ComfortablyCoding)
  • Bumped hono and vite dependencies (#27820 by @br41nslug)
  • Fixed pre-validation side effects in services (#27800 by @br41nslug)
  • Fixed public websocket accountability handling (#27808 by @br41nslug)
• @directus/extensions-sdk
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/system-data
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • Added interface settings for collection status field (#27781 by @robluton)
• @directus/composables
  • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
• @directus/validation
  • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
• @directus/env
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
• @directus/utils
  • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
• License keys correctly validate, even when NODE_ENV=development

📦 Published Versions

• @directus/app@16.2.0
• @directus/api@37.0.0
• @directus/composables@11.5.1
• create-directus-extension@12.1.1
• @directus/env@6.1.0
• @directus/extensions@4.0.1
• @directus/extensions-registry@4.0.1
• @directus/extensions-sdk@18.0.1
• @directus/memory@4.0.1
• @directus/pressure@4.0.1
• @directus/specs@15.0.0
• @directus/storage-driver-azure@13.0.1
• @directus/storage-driver-cloudinary@13.0.1
• @directus/storage-driver-gcs@13.0.1
• @directus/storage-driver-s3@13.0.1
• @directus/storage-driver-supabase@4.0.1
• @directus/system-data@4.5.1
• @directus/themes@2.0.1
• @directus/utils@13.5.1
• @directus/validation@3.0.1
• @directus/sdk@23.0.0

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

✨ New Features & Improvements

• create-directus-extension
  • Added support for non-interactive mode (#27577 by @pklenovic)

🐛 Bug Fixes & Optimizations

• @directus/api
  • Fixed user count for users with conflicting direct policy and role (#27720 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@16.1.1
• @directus/api@36.0.2
• create-directus-extension@12.1.0

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

✨ New Features & Improvements

• @directus/app
  • Added keyboard-editable date entry directly in the datetime field. The field shows its formatted value at rest and swaps to editable date segments on focus, while a calendar button still opens the picker popup. (#27693 by @robluton)
  • Added inline editing support to the JSON repeater interface. (#26863 by @bryantgillespie)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed license badge spacing issue (#27713 by @robluton)
  • Fixed license modals being impossible to dismiss when shown above a route drawer (e.g. field detail pages) by keeping dialog focus traps stacked in visual order, and scoped license dismissal cookies to the whole app so dismissals persist across navigation (#27714 by @dstockton)
• @directus/api
  • Fixed revision snapshots being assigned to the wrong items during batch updates when read order differs (#27407 by @luciemdx)

📦 Published Versions

• @directus/app@16.1.0
• @directus/api@36.0.1

License Enforcement

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

Directus 12 introduces active license enforcement. Self-hosted instances run on the Core tier by default. Higher limits and additional features require a valid license. See Licensing for a complete overview.

This change affects instances previously using features that now require a license, including:

• SSO — SSO login will no longer work. Users who authenticate through SSO will be unable to log in and must be converted to email and password users to regain access.
• Custom permission rules — custom rules on access policies will be ignored.
• Custom or self-hosted LLMs — connections to custom LLMs will no longer work.
• AI Translations — AI-powered translations are not available.

Enforcement is immediate on new instances. Instances upgrading to Directus 12 get a 30-day grace period from the time of upgrade, after which these are enforced unless a license that enables them is configured.

If your instance uses any of these features, add a license that includes them to continue to do so. If your instance uses only Core tier features, no action is required.

Changed license to MSCL-1.0-GPL (#27417)

• Breaking Change: Relicensed from BUSL-1.1 to MSCL-1.0-GPL (Monospace Sustainable Core License, Version 1.0).

Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607)

• The IP_TRUST_PROXY default was changed from true to false. If you run Directus behind a reverse proxy and rely on X-Forwarded-For (or similar) headers for client IP resolution, you must now explicitly set IP_TRUST_PROXY to true or a more specific trust configuration.

Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160)

• Health checks are cached by default and shared across multi-instance deployments
  • /server/health will return 404 for unauthenticated requests, use /server/ping for liveness checks
  • cache, rateLimiter and rateLimiterGlobal health checks have been replaced by a generic redis check using the redis: prefix

Introduced VERSION_KEY_ constants and renamed main to published @alvarosabu (#27397)*

• Backward Compatibility: You can now use ?version=published to resolve versions of the main item(s) via the version query parameter. For backward compatibility, ?version=main will continue to work.

Replaced status field with archived boolean in collection settings @alvarosabu (#27397)

• Backward Compatibility: Existing collections with string-based status fields continue to work unchanged; newly created collections now default to a boolean "Archived" field instead of the string "Status" field

Deprecated the VResizeable component @formfcw (#27437)

• Deprecation for extensions: The globally registered VResizeable component has been deprecated. Extension authors using <v-resizeable> should migrate to @directus/vue-split-panel or their own implementation.

Updated type system, borders, and theme variables @formfcw (#27437)

• Potential breaking change for theme extensions: headerShadow and sidebarShadow removed from LayoutConfig interface
• Potential breaking change for theme extensions: boxShadow removed from header theme rules schema
• Potential breaking change for theme extensions: sidebarShadow no longer exposed in layout wrapper state

Updated module navigation bar spacing and styling @HZooly (#27437)

• Potential breaking change in theme extensions: Removed navigation.project.borderColor / navigation.project.borderWidth / navigation.project.background from theming. No action is required — these props will simply no longer have any effect.

Locked published items in versioned collections from editing and added a header action button to edit in the draft version @alvarosabu (#27397)

• Breaking change — new behavior for versioned collections Published items in versioned collections are now locked. Edits must be made through the draft version.

Removed rounded buttons and adopted shared header action button across all views @formfcw (#27437)

• Potential breaking change for extensions: The rounded prop has been removed from v-button. Extensions using rounded will still render correctly but buttons will appear as rounded rectangles instead of circles. No functional impact.

Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437)

• Potential breaking change for theme extensions: The theme properties navigation.background, navigation.backgroundAccent, navigation.borderWidth, navigation.borderColor, header.background, header.borderWidth, and header.borderColor have been removed and replaced by shell.background, shell.backgroundAccent, shell.borderWidth, and shell.borderColor.
• Potential breaking change for theme extensions: Custom themes overriding any of these removed properties must migrate to the new shell scope. The corresponding CSS variables change from --theme--navigation--background, --theme--navigation--background-accent, --theme--navigation--border-*, --theme--header--background, and --theme--header--border-* to --theme--shell--background, --theme--shell--background-accent, and --theme--shell--border-*.

Removed the extra confirmation step from the publish flow @alvarosabu (#27487)

• Breaking change — new publish flow: Publishing a version no longer shows an additional confirmation dialog after confirming changes in the comparison modal. The item is published directly once the changes are confirmed.

Updated sidebar styles @formfcw (#27437)

• Potential breaking change for theme extensions: Removed section.toggle.borderWidth / section.toggle.borderColor in favor of section-level border tokens. No action is required — these props will simply no longer have any effect.
• Potential breaking change for theme extensions: Removed sidebarShadow and headerShadow from defineLayout(). No action is required — these props will simply no longer have any effect.

Refactored focus ring from border/box-shadow to outline @formfcw (#27437)

• Potential breaking change for theme extensions: borderColorFocus, boxShadowHover, and boxShadowFocus are removed from the theme schema — custom themes referencing these will lose their focus overrides silently
• Potential breaking change for interface extensions that relied on --theme--form--field--input--border-color-focus or --theme--form--field--input--box-shadow-focus CSS variables will need to migrate to --theme--form--field--input--focus-ring-color

Updated header bar elements and deprecated the headline slot @formfcw (#27437)

• Deprecation for extensions: The headline slot on the private view header bar has been deprecated. Existing content keeps rendering, but consumers using <template #headline> will now see a deprecation hint from Volar.

• @directus/app

  • Locked published items in versioned collections from editing and added a header action button to edit in the draft version @alvarosabu (#27397 by @formfcw)
  • Removed rounded buttons and adopted shared header action button across all views @formfcw (#27437 by @formfcw)
  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)
  • Removed the extra confirmation step from the publish flow @alvarosabu (#27487 by @alvarosabu)

• @directus/api

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)

• @directus/themes

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

• @directus/types

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated header and navigation bar base design and merged their theme properties into a new shell scope @formfcw (#27437 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

• @directus/extensions

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/extensions-registry

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/extensions-sdk

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/format-title

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/memory

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/pressure

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/release-notes-generator

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/update-check

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/validation

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/schema

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/schema-builder

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/specs

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-cloudinary

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-supabase

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-azure

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-gcs

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-local

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/storage-driver-s3

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/stores

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• create-directus-extension

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• create-directus-project

  • Changed license to MSCL-1.0-GPL (#27417 by @ComfortablyCoding)

• @directus/env

  • Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607 by @br41nslug)

• @directus/sdk

  • Fixed the outdated updateExtension command and added missing deleteExtension and extension registry commands (#27314 by @kheiner)

    ::notice

    • updateExtension now accepts an id instead of bundle and name :::

  • Refactor sdk error to use class over object (#27417 by @ComfortablyCoding)

    :::warning Requests that fail will now throw a RequestError instead of returning a response with an error property. :::

✨ New Features & Improvements

• @directus/app

  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)

  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)

  • Fixed Image Editor save button to use split button @HZooly (#27437 by @formfcw)

  • Added split-menu slot to v-button and migrate primary header actions @formfcw (#27437 by @formfcw)

  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)

  • Added version support to getItemRoute and update all callers to preserve version context when navigating to items from layouts and interfaces @alvarosabu (#27397 by @formfcw)

  • Added behavior to auto-switch to the draft version on the first edit of published item @alvarosabu (#27507 by @alvarosabu)

  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)

  • Updated Visual Editor header bar buttons @formfcw (#27437 by @formfcw)

  • Updated content route middleware to handle singleton collections and draft flow via route guards @alvarosabu (#27397 by @formfcw)

  • Replaced status field with archived boolean in collection settings @alvarosabu (#27397 by @formfcw)

  • Updated module bar buttons style @HZooly (#27437 by @formfcw)

  • Deprecated the VResizeable component @formfcw (#27437 by @formfcw)

  • Updated VChip component to appear as a pill in form field label, group accordion, group tabs, kanban, deployment status, extension item, marketplace extension list item, marketplace extension banner, and user popover @formfcw (#27462 by @formfcw)

  • Added tresjs shader background for public pages @alvarosabu (#27428 by @alvarosabu)

  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)

  • Rendered non-clickable version menu without directus_versions read access @alvarosabu (#27461 by @alvarosabu)

  • Added item-less draft creation flow for versioned collections @alvarosabu (#27397 by @formfcw)

  • Updated module navigation bar spacing and styling @HZooly (#27437 by @formfcw)

  • Updated Visual Editor popover/modal action buttons @formfcw (#27437 by @formfcw)

  • Updated UI for the Draft & Publish workflow @formfcw (#27437 by @formfcw)

  • Updated mobile appearance of drawer sidebar @formfcw (#27437 by @formfcw)

  • Moved Promote/Publish button to header actions @alvarosabu (#27397 by @formfcw)

  • Updated primary header actions to show label and replace outlined header action buttons @formfcw (#27437 by @formfcw)

  • Updated SearchInput component to match the new design @formfcw (#27437 by @formfcw)

  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)

  • Refactored header bar action slots and reorganized CTAs @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The actions:append slot in the header bar has been deprecated in favor of the new actions:primary slot for primary CTAs. Existing actions:append usage keeps rendering in the secondary-actions zone, but consumers will now see a deprecation hint from Volar.

    :::

  • Added navigation logic on discarding item-less versions @alvarosabu (#27397 by @formfcw)

  • Put the sidebar into the content area @HZooly (#27437 by @formfcw)

  • Updated color system for VChip and VersionMenu components @formfcw (#27437 by @formfcw)

  • Updated content section spacing and drawer content spacing @HZooly (#27437 by @formfcw)

  • Extracted the card subheader into a reusable subheader component @HZooly (#27437 by @formfcw)

  • Added version select to collection page @alvarosabu (#27397 by @formfcw)

  • Updated sidebar styles @formfcw (#27437 by @formfcw)

  • Renamed "Promote" to "Publish" in version menu and disabled create version and published selection for item-less versions @alvarosabu (#27397 by @formfcw)

  • Added version query param guards on content-item route @alvarosabu (#27397 by @formfcw)

  • Improved bookmark flow @formfcw (#27450 by @formfcw)

  • Forwarded theme tokens and i18n strings from Studio to the visual-editing iframe @formfcw (#27469 by @formfcw)

  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)

  • Introduced VersionChip component @formfcw (#27437 by @formfcw)

  • Updated theme preview component to match the new design @formfcw (#27437 by @formfcw)

  • Updated collab avatar indicator design @formfcw (#27437 by @formfcw)

  • Refactored drawer header layout and simplified v-drawer API @formfcw (#27437 by @formfcw)

    :::notice

    • Deprecation for extensions: The globally registered v-breadcrumb component has been deprecated. Extensions using <v-breadcrumb> keep rendering but will see a deprecation hint from Volar.
    • Deprecation for extensions: On v-drawer, the subtitle prop (use the title prop instead), the subtitle slot, the header:append slot, and the actions:append slot have been deprecated. Existing usage keeps rendering — actions:append content lands in the secondary-actions zone, and for primary CTAs in the drawer header use the new actions:primary slot. Consumers will see deprecation hints from Volar.
    • Potential Breaking change for theme extensions: The theme properties header.headline.foreground and header.headline.fontFamily have been removed. Custom themes overriding these properties should remove them. The corresponding CSS variables --theme--header--headline--foreground and --theme--header--headline--font-family no longer exist.

    :::

  • Updated header bar elements and deprecated the headline slot @formfcw (#27437 by @formfcw)

  • Ensured to switch to the draft version when visually editing an item of a versioned collection @formfcw (#27595 by @formfcw)

  • Extracted reusable ModuleBarButton component @formfcw (#27437 by @formfcw)

  • Moved client-validation to promote version workflow instead of save version @alvarosabu (#27397 by @formfcw)

  • Added Create New action to publish split menu with shortcut @alvarosabu (#27425 by @alvarosabu)

• @directus/api
  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
  • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
  • Improved AI assistant prompt caching support across providers. (#27545 by @bryantgillespie)
• @directus/constants
  • Introduced VERSION_KEY_* constants and renamed main to published @alvarosabu (#27397 by @formfcw)
• @directus/env
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
• @directus/system-data
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Replaced status field with archived boolean in collection settings @alvarosabu (#27397 by @formfcw)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Updated directus_oauth_* system collection visibility to match other system collections (#27682 by @hanneskuettner)
• @directus/types
  • Added auto-save for version editing @alvarosabu (#27449 by @alvarosabu)
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
• @directus/errors
  • Added Publish without Review action to the publish split menu with shortcut @alvarosabu (#27501 by @alvarosabu)
• @directus/composables
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Added version select to collection page @alvarosabu (#27397 by @formfcw)
• @directus/themes
  • Updated type system, borders, and theme variables @formfcw (#27437 by @formfcw)
  • Refactored focus ring from border/box-shadow to outline @formfcw (#27437 by @formfcw)
  • Updated header bar elements and deprecated the headline slot @formfcw (#27437 by @formfcw)
• @directus/utils
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
• @directus/sdk
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
  • Added support for item-less versions @Nitwel (#27397 by @formfcw)
• @directus/specs
  • Added support for the version query parameter in collections @Nitwel (#27397 by @formfcw)
• @directus/visual-editing
  • Redesigned the editable-element overlay with theming, RTL support and improved a11y @formfcw (#27469 by @formfcw)
• @directus/memory
  • Added TTL support for local KV and cache stores (#27160 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Added DIRECTUS_DOMAIN constant and replaced hardcoded directus.io to directus.com using the new constant (#27417 by @ComfortablyCoding)
  • Consolidated URLs and emails into shared constants (#27641 by @HZooly)
  • Limited mobile sidebar width so the overlay can be tapped to close it @HZooly (#27437 by @formfcw)
  • Bumped vue-tsc to 3.1.8 (#27437 by @formfcw)
  • Fixed tick rendering when count exceeds display limit in v-slider (#27644 by @HZooly)
  • Fixed icon alignment in v-divider component @HZooly (#27437 by @formfcw)
  • Fixed v-dialog returning focus to opener instead of an autofocused child on close @formfcw (#27464 by @formfcw)
  • Fixed flow handle button alignment in flow editor @HZooly (#27437 by @formfcw)
  • Shown "Import in background" checkbox only when a file is selected @HZooly (#27437 by @formfcw)
  • Fixed sidebar reopening at minimum size after being collapsed via drag handle @HZooly (#27437 by @formfcw)
  • Capped datepicker year to prevent invalid date (#27659 by @HZooly)
  • Bumped Vitest to 3.2.6 (#27686 by @br41nslug)
  • Fixed EXTENSIONS_PATH and EXTENSIONS_LOCATION env vars not being respected by the Vite dev server (#27642 by @HZooly)
  • Added notice on license page with oig link (#27661 by @robluton)
  • Fixed vue console warnings related to the comparison modal (#27538 by @formfcw)
  • Fixed bug on tooltip value when decimals is 0 in pie chart panel (#27356 by @Prateet-Github)
  • Fixed misaligned filter editor in search bar @formfcw (#27454 by @formfcw)
  • Added missing collection note translations for the directus_oauth_* system collections (#27682 by @hanneskuettner)
  • Changed back button behavior, always navigates one level up @HZooly (#27437 by @formfcw)
  • Fixed default favicon path to resolve against the instance root path instead of the site origin. (#27095 by @singhvishalkr)
  • Fixed repeater interface ignoring per-field translations and $t: keys on sub-field labels, and added a "Field Name Translations" section to the sub-field configuration UI (#27374 by @khanahmad4527)
  • Fixed search input not trimming whitespace, causing queries with leading or trailing spaces to return no results (#27359 by @khanahmad4527)
  • Added minor copy change to license onboarding and license key interface (#27651 by @robluton)
  • Fixed calendar layout toolbar responsiveness @HZooly (#27437 by @formfcw)
  • Updated license request links. (#27652 by @HZooly)
  • Fixed the error handling (try-catch) when saving a field in Directus Studio. (#27486 by @baguse)
  • Fixed items not being selectable in the collection drawer when the Kanban layout is used while the parent item is opened in a version context @alvarosabu (#27427 by @alvarosabu)
  • Fixed AI assistant "Clear conversation" not canceling in-flight requests, causing them to continue running in the background (#27646 by @levgiorg)
  • Added support for translatable flow names via the existing $t: prefix and translation strings, matching the field/collection label pattern. The flow name input in the flow editor now exposes the translation picker. (#27472 by @khanahmad4527)
  • Removed unsupported json filter function from the studio (#27669 by @sourav-18)
  • Fixed bookmark icon and color not showing in header @formfcw (#27437 by @formfcw)
  • Fixed UI freeze caused by WYSIWYG interface when its non-editable state toggles @formfcw (#27515 by @formfcw)
  • Fixed project setup silently ignoring invalid license keys (#27671 by @ComfortablyCoding)
• @directus/api
  • Bumped Vitest to 3.2.6 (#27686 by @br41nslug)
  • Fixed project setup silently ignoring invalid license keys (#27671 by @ComfortablyCoding)
  • Fixed nested deep query parameters being dropped when filters use dynamic variables (#27676 by @mazen-salah)
  • Fixed bulk creation of itemless drafts always fails (#27683 by @ComfortablyCoding)
  • Fixed SSO resolver erroring when admin is not defined (#27662 by @ComfortablyCoding)
  • Fixed Postgres numeric overflow errors being misattributed to an unrelated field (#27690 by @MahinAnowar)
  • Fixed registration email verification tokens to use the configured secret fallback when SECRET is missing. (#27406 by @rijkvanzanten)
  • Bumped axios, js-cookie, samlify, systeminformation, simple-git, fast-uri dependencies (#27589 by @br41nslug)
  • Fixed MCP OAuth dynamic client registration defaults and metadata responses. (#27628 by @hanneskuettner)
  • Prevented setting a custom user provider when not entitled to SSO (#27675 by @ComfortablyCoding)
  • Fixed aliased relational fields in GraphQL queries, fragments and REST queries (#27054 by @AlexGaillard)
  • Fixed active seat processing not accounting for user/role changes (#27662 by @ComfortablyCoding)
  • Removed dead isMinimumAppPermission function (#27662 by @ComfortablyCoding)
  • Fixed failed itemless drafts being dropped from version reads when limit=-1 (#27578 by @alvarosabu)
  • Added a namespace to shares cache keys (#27707 by @br41nslug)
  • Updated IP blocking (#27606 by @br41nslug)
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
  • Fixed singletons allowing multiple itemless versions (#27532 by @formfcw)
  • Fixed issue causing duplicate admin roles on first admin creation (#27663 by @robluton)
  • Fixed non custom permissions denied irrespective of if entitled (#27662 by @ComfortablyCoding)
• @directus/constants
  • Added DIRECTUS_DOMAIN constant and replaced hardcoded directus.io to directus.com using the new constant (#27417 by @ComfortablyCoding)
  • Consolidated URLs and emails into shared constants (#27641 by @HZooly)
• @directus/system-data
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
• @directus/types
  • Added AI-powered translations to the translations interface, including glossary, style guide, and configurable default model settings derived from the enabled providers and allowed models. (#26940 by @bryantgillespie)
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
• @directus/utils
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
• @directus/sdk
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
  • Fixed SingletonCollections incorrectly including core schema collections (#27196 by @kheiner)
• @directus/ai
  • Updated the built-in OpenAI and Anthropic AI model lists to use the latest available API models. (#27602 by @hanneskuettner)
• @directus/release-notes-generator
  • Ignored private workspace packages when generating release notes (#27637 by @licitdev)

📦 Published Versions

• @directus/app@16.0.0
• @directus/api@36.0.0
• @directus/ai@1.3.2
• @directus/composables@11.5.0
• @directus/constants@14.4.0
• create-directus-extension@12.0.0
• create-directus-project@13.0.0
• @directus/env@6.0.0
• @directus/errors@2.4.0
• @directus/extensions@4.0.0
• @directus/extensions-registry@4.0.0
• @directus/extensions-sdk@18.0.0
• @directus/format-title@13.0.0
• @directus/memory@4.0.0
• @directus/pressure@4.0.0
• @directus/release-notes-generator@3.0.0
• @directus/schema@14.0.0
• @directus/schema-builder@1.0.0
• @directus/specs@14.0.0
• @directus/storage@13.0.0
• @directus/storage-driver-azure@13.0.0
• @directus/storage-driver-cloudinary@13.0.0
• @directus/storage-driver-gcs@13.0.0
• @directus/storage-driver-local@13.0.0
• @directus/storage-driver-s3@13.0.0
• @directus/storage-driver-supabase@4.0.0
• @directus/stores@3.0.0
• @directus/system-data@4.5.0
• @directus/themes@2.0.0
• @directus/types@16.0.0
• @directus/update-check@14.0.0
• @directus/utils@13.5.0
• @directus/validation@3.0.0
• @directus/visual-editing@2.1.0
• @directus/sdk@22.0.0