Directus v12.1.0 — Release Notes & Engineering Impact

> [!NOTE] > Directus is free for individuals and organizations under $5M annual revenue and 50 employees.\ > Get your free license key at [directus.com/oig](http://directus.com/oig) ### ⚠️ Potential Breaking Changes - **@directus/api** - Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use ([#27801](https://github.com/directus/directus/pull/27801) by @br41nslug) - Removed `/utils/hash/generate` and `/utils/hash/verify` endpoints ([#27774](https://github.com/directus/directus/pull/27774) by @br41nslug) - Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories ([#27803](https://github.com/directus/directus/pull/27803) by @br41nslug) - Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled ([#27801](https://github.com/directus/directus/pull/27801) by @br41nslug) - Added CORS_ORIGIN checks for websocket connections ([#27812](https://github.com/directus/directus/pull/27812) by @br41nslug) - **@directus/specs** - Removed `/utils/hash/generate` and `/utils/hash/verify` endpoints ([#27774](https://github.com/directus/directus/pull/27774) by @br41nslug) - **@directus/sdk** - Removed `/utils/hash/generate` and `/utils/hash/verify` endpoints ([#27774](https://github.com/directus/directus/pull/27774) by @br41nslug) - Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops `npm`/`npx` from the runtime; the new DHI variant is published under a `-dhi` tag suffix ([#27670](https://github.com/directus/directus/pull/27670) by @br41nslug) ### ✨ New Features & Improvements - **@directus/app** - Added `PROJECT_OWNER_ENABLED` env var to allow disabling owner info collection and sync ([#27802](https://github.com/directus/directus/pull/27802) by @ComfortablyCoding) - Replaced tooltip with Reka UI one ([#27029](https://github.com/directus/directus/pull/27029) by @HZooly) - Added `v-kbd` component and support `{ text, kbd }` syntax in tooltip ([#27029](https://github.com/directus/directus/pull/27029) by @HZooly) - Updated bundled `esbuild` to `0.28.1` (resolves GHSA-gv7w-rqvm-qjhr) ([#27738](https://github.com/directus/directus/pull/27738) by @br41nslug) - **@directus/api** - Added `PROJECT_OWNER_ENABLED` env var to allow disabling owner info collection and sync ([#27802](https://github.com/directus/directus/pull/27802) by @ComfortablyCoding) - **@directus/env** - Added `PROJECT_OWNER_ENABLED` env var to allow disabling owner info collection and sync ([#27802](https://github.com/directus/directus/pull/27802) by @ComfortablyCoding) ### 🐛 Bug Fixes & Optimizations - **@directus/app** - Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly ([#27799](https://github.com/directus/directus/pull/27799) by @robluton) - Fixed the public page foreground image rendering side-by-side with the shader background instead of overlaying it ([#27782](https://github.com/directus/directus/pull/27782) by @alvarosabu) - Added clearable indicator to input hash field ([#27729](https://github.com/directus/directus/pull/27729) by @robluton) - Added lazy loading of social icons on v-button ([#27724](https://github.com/directus/directus/pull/27724) by @alvarosabu) - Bumped version of @directus/license package ([#27785](https://github.com/directus/directus/pull/27785) by @AlexGaillard) - Fixed array indexing (e.g. `field[0]` or `field.0`) in display and preview URL templates, so a template like `{{ categories[0].name }}` now resolves to the indexed value instead of rendering empty ([#27773](https://github.com/directus/directus/pull/27773) by @dstockton) - Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML ([#27810](https://github.com/directus/directus/pull/27810) by @br41nslug) - Fixed an internal server error when validating out-of-range integer values ([#27321](https://github.com/directus/directus/pull/27321) by @sourav-18) - Added interface settings for collection status field ([#27781](https://github.com/directus/directus/pull/27781) by @robluton) - **@directus/api** - Bumped version of @directus/license package ([#27785](https://github.com/directus/directus/pull/27785) by @AlexGaillard) - Fixed a Local File Inclusion vulnerability in `MailService.renderTemplate` ([#27811](https://github.com/directus/directus/pull/27811) by @br41nslug) - Fixed Postgres value too long errors being misattributed to an unrelated field ([#27768](https://github.com/directus/directus/pull/27768) by @MahinAnowar) - Added validation to restrict geometry types to known types ([#27809](https://github.com/directus/directus/pull/27809) by @br41nslug) - Fixed batch update failures in the MCP files tool ([#27121](https://github.com/directus/directus/pull/27121) by @aayushbaluni) - Updated dependencies to resolve security advisories and removed obsolete override pins ([#27814](https://github.com/directus/directus/pull/27814) by @br41nslug) - Fixed accountability overrides in the graphql websocket ([#27813](https://github.com/directus/directus/pull/27813) by @br41nslug) - Fixed MCP OAuth role resolution to use the users role instead of the root role ([#27790](https://github.com/directus/directus/pull/27790) by @ComfortablyCoding) - Bumped hono and vite dependencies ([#27820](https://github.com/directus/directus/pull/27820) by @br41nslug) - Fixed pre-validation side effects in services ([#27800](https://github.com/directus/directus/pull/27800) by @br41nslug) - Fixed public websocket accountability handling ([#27808](https://github.com/directus/directus/pull/27808) by @br41nslug) - **@directus/extensions-sdk** - Updated bundled `esbuild` to `0.28.1` (resolves GHSA-gv7w-rqvm-qjhr) ([#27738](https://github.com/directus/directus/pull/27738) by @br41nslug) - **@directus/system-data** - Updated bundled `esbuild` to `0.28.1` (resolves GHSA-gv7w-rqvm-qjhr) ([#27738](https://github.com/directus/directus/pull/27738) by @br41nslug) - Added interface settings for collection status field ([#27781](https://github.com/directus/directus/pull/27781) by @robluton) - **@directus/composables** - Updated bundled `esbuild` to `0.28.1` (resolves GHSA-gv7w-rqvm-qjhr) ([#27738](https://github.com/directus/directus/pull/27738) by @br41nslug) - **@directus/validation** - Fixed an internal server error when validating out-of-range integer values ([#27321](https://github.com/directus/directus/pull/27321) by @sourav-18) - **@directus/env** - Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use ([#27801](https://github.com/directus/directus/pull/27801) by @br41nslug) - **@directus/utils** - Classified the embedded IPv4 of IPv6 transition forms (IPv4-compatible, NAT64, 6to4) in `IpBlocklist.checkAddress` so they cannot bypass an IPv4 deny rule ([#27698](https://github.com/directus/directus/pull/27698) by @joeltco) - License keys correctly validate, even when NODE_ENV=development ### 📦 Published Versions - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]`