Directus v12.1.0

v12.1.0
Added 5
  • Publish a distroless Docker Hardened Image (DHI) variant under a -dhi tag suffix
  • Add PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync
  • Add v-kbd component and support { text, kbd } syntax in tooltip
  • Replace tooltip with Reka UI one
  • Add validation to restrict geometry types to known types
Changed 4
  • Limit sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use
  • Update GraphQL WebSocket restrictions to match the HTTP endpoint and hide validation hints when introspection is disabled
  • Harden the published Docker image and drop npm/npx from the runtime
  • Update bundled esbuild to 0.28.1
Fixed 6
  • Restore pre-v12 back button behavior to return to previously visited item/page when navigating via a relation
  • Fix public page foreground image rendering to overlay shader background instead of rendering side-by-side
  • Fix array indexing in display and preview URL templates so templates like {{ categories[0].name }} resolve to the indexed value
  • Fix internal server error when validating out-of-range integer values
  • Fix Postgres value too long errors being misattributed to an unrelated field
  • Fix accountability overrides in the graphql websocket
Removed 1
  • Remove /utils/hash/generate and /utils/hash/verify endpoints
Security 4
  • Harden upload path validation to prevent writes to extension and temporary storage directories
  • Add CORS_ORIGIN checks for websocket connections
  • Fix stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup
  • Fix Local File Inclusion vulnerability in MailService.renderTemplate

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

⚠️ Potential Breaking Changes
  • @directus/api
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
    • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
    • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#27801 by @br41nslug)
    • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
  • @directus/specs
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • @directus/sdk
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#27670 by @br41nslug)
✨ New Features & Improvements
  • @directus/app
    • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
    • Replaced tooltip with Reka UI one (#27029 by @HZooly)
    • Added v-kbd component and support { text, kbd } syntax in tooltip (#27029 by @HZooly)
    • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • @directus/api
    • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • @directus/env
    • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
🐛 Bug Fixes & Optimizations
  • @directus/app
    • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
    • Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it (#27782 by @alvarosabu)
    • Added clearable indicator to input hash field (#27729 by @robluton)
    • Added lazy loading of social icons on v-button (#27724 by @alvarosabu)
    • Bumped version of @directus/license package (#27785 by @AlexGaillard)
    • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
    • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
    • Added interface settings for collection status field (#27781 by @robluton)
  • @directus/api
    • Bumped version of @directus/license package (#27785 by @AlexGaillard)
    • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
    • Fixed Postgres value too long errors being misattributed to an unrelated field (#27768 by @MahinAnowar)
    • Added validation to restrict geometry types to known types (#27809 by @br41nslug)
    • Fixed batch update failures in the MCP files tool (#27121 by @aayushbaluni)
    • Updated dependencies to resolve security advisories and removed obsolete override pins (#27814 by @br41nslug)
    • Fixed accountability overrides in the graphql websocket (#27813 by @br41nslug)
    • Fixed MCP OAuth role resolution to use the users role instead of the root role (#27790 by @ComfortablyCoding)
    • Bumped hono and vite dependencies (#27820 by @br41nslug)
    • Fixed pre-validation side effects in services (#27800 by @br41nslug)
    • Fixed public websocket accountability handling (#27808 by @br41nslug)
  • @directus/extensions-sdk
    • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • @directus/system-data
    • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
    • Added interface settings for collection status field (#27781 by @robluton)
  • @directus/composables
    • Updated bundled esbuild to 0.28.1 (resolves GHSA-gv7w-rqvm-qjhr) (#27738 by @br41nslug)
  • @directus/validation
    • Fixed an internal server error when validating out-of-range integer values (#27321 by @sourav-18)
  • @directus/env
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • @directus/utils
    • Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in IpBlocklist.checkAddress so they cannot bypass an IPv4 deny rule (#27698 by @joeltco)
  • License keys correctly validate, even when NODE_ENV=development
📦 Published Versions
  • @directus/app@16.2.0
  • @directus/api@37.0.0
  • @directus/composables@11.5.1
  • create-directus-extension@12.1.1
  • @directus/env@6.1.0
  • @directus/extensions@4.0.1
  • @directus/extensions-registry@4.0.1
  • @directus/extensions-sdk@18.0.1
  • @directus/memory@4.0.1
  • @directus/pressure@4.0.1
  • @directus/specs@15.0.0
  • @directus/storage-driver-azure@13.0.1
  • @directus/storage-driver-cloudinary@13.0.1
  • @directus/storage-driver-gcs@13.0.1
  • @directus/storage-driver-s3@13.0.1
  • @directus/storage-driver-supabase@4.0.1
  • @directus/system-data@4.5.1
  • @directus/themes@2.0.1
  • @directus/utils@13.5.1
  • @directus/validation@3.0.1
  • @directus/sdk@23.0.0
View original

Upgraded? How did it go?

Discussion