Directus v12.5.0 — Release Notes & Engineering Impact

### ⚠️ Potential Breaking Changes **Fixed TFA enforcement to use effective permissions ([#28176](https://github.com/directus/directus/pull/28176))** Policies with an IP allow list are now accounted for when enforcing TFA within the allowed range. **Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses ([#28331](https://github.com/directus/directus/pull/28331))** The `/server/license` response no longer includes `downgrade_reason`. Read `invalid_reason` instead, which also reports why a license that is still in effect could not be renewed. `@directus/errors` no longer exports `LicenseManagedByEnvError`, `LicenseOfflineUnsupportedError`, `LicenseResolveIncompleteError` or `LicenseServiceUnavailableError`, or their error codes. License request failures now surface as `LICENSE_INVALID` with a `failure` extension, or as the standard `FORBIDDEN`, `INVALID_PAYLOAD`, `REQUESTS_EXCEEDED` and `SERVICE_UNAVAILABLE` errors. **Removed the ip-matching dependency ([#28243](https://github.com/directus/directus/pull/28243))** Policy `ip_access` and `IMPORT_IP_DENY_LIST` values are now more strictly validated. Subnets with a malformed prefix such as `10.0.0.0/ 24` or `10.0.0.0/+24`, are no longer accepted. Existing policies that already store such a value will fail every request for users with that policy. **Fixed requests failing after a process was stopped during schema building ([#28316](https://github.com/directus/directus/pull/28316))** `CACHE_SCHEMA_MAX_ITERATIONS` has been removed. `CACHE_SCHEMA_SYNC_TIMEOUT` now also limits the schema build itself and defaults to `60000` ms. If you have configured a lower value, make sure it is long enough for your schema to finish building. **Updated outdated type definitions for `directus_notifications`, `directus_permissions`, `directus_extensions`, `directus_fields`, `directus_activity`, `directus_collections`, and `directus_revisions` ([#28072](https://github.com/directus/directus/pull/28072))** Breaking changes in `@directus/sdk`: - `DirectusNotification.id` is now correctly typed as `number`. - `DirectusField.schema` is now nullable. - `FieldMetaConditionOptionType` has been removed; condition `options` is now `Record<string, any>`. - `FieldMetaConditionType.hidden`, `readonly`, `required`, and `options` are now optional, and `rule` is typed as a filter. - All `ExtensionSchema` properties are now optional, and `DirectusExtension.schema` can also be an `ExtensionSchemaEntry`. Breaking changes in `@directus/types`: - `Notification.id` is now correctly typed as `number`. - `Notification.status` and `timestamp` are now nullable. - **@directus/api** - Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - Removed the ip-matching dependency ([#28243](https://github.com/directus/directus/pull/28243) by @Nitwel) - Fixed requests failing after a process was stopped during schema building ([#28316](https://github.com/directus/directus/pull/28316) by @Nitwel) - **@directus/errors** - Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - **@directus/utils** - Removed the ip-matching dependency ([#28243](https://github.com/directus/directus/pull/28243) by @Nitwel) - **@directus/types** - Updated outdated type definitions for `directus_notifications`, `directus_permissions`, `directus_extensions`, `directus_fields`, `directus_activity`, `directus_collections`, and `directus_revisions` ([#28072](https://github.com/directus/directus/pull/28072) by @kheiner) - **@directus/sdk** - Updated outdated type definitions for `directus_notifications`, `directus_permissions`, `directus_extensions`, `directus_fields`, `directus_activity`, `directus_collections`, and `directus_revisions` ([#28072](https://github.com/directus/directus/pull/28072) by @kheiner) ### ✨ New Features & Improvements - **@directus/app** - Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL ([#28227](https://github.com/directus/directus/pull/28227) by @robluton) - Added header bar buttons to set multiple selected Flows to active or inactive ([#28321](https://github.com/directus/directus/pull/28321) by @robluton) - Added a confirmation dialog when saving Public policy permission changes on system collections ([#28311](https://github.com/directus/directus/pull/28311) by @robluton) - Added a persistent warning notice when editing the Public policy ([#28310](https://github.com/directus/directus/pull/28310) by @robluton) - Added support for linking images in the WYSIWYG editor: select an image and use the link toolbar button (or Mod+K) to wrap it in an anchor; stored `<a href><img></a>` markup now survives loading without triggering the normalization warning ([#28289](https://github.com/directus/directus/pull/28289) by @alvarosabu) - **@directus/api** - Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL ([#28227](https://github.com/directus/directus/pull/28227) by @robluton) - **@directus/memory** - Added opt-in `hash` option to redis memory, improving cache clear performance ([#28214](https://github.com/directus/directus/pull/28214) by @Nitwel) - Added optional lock settings to `usingLock` to override the lock's duration and retry count. A signal is now passed to the callback that aborts if the lock is lost before it finishes ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - **@directus/system-data** - Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL ([#28227](https://github.com/directus/directus/pull/28227) by @robluton) - **@directus/types** - Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL ([#28227](https://github.com/directus/directus/pull/28227) by @robluton) - **@directus/sdk** - Added a Preview Base URL project setting, selectable as a variable in a collection's Preview URL ([#28227](https://github.com/directus/directus/pull/28227) by @robluton) - **@directus/constants** - Added a persistent warning notice when editing the Public policy ([#28310](https://github.com/directus/directus/pull/28310) by @robluton) - **@directus/env** - Exported the default environment values as `DEFAULTS` ([#28077](https://github.com/directus/directus/pull/28077) by @br41nslug) ### 🐛 Bug Fixes & Optimizations - **@directus/app** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - Update license validation to only accept Directus keys and tokens ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - Improved license handling so a failed license request keeps the current license in effect and is retried by a scheduled license check, with a warning in the app showing why the license could not be renewed and when it lapses ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - Fixed tooltips not appearing on keyboard focus ([#28263](https://github.com/directus/directus/pull/28263) by @robluton) - Fixed Norwegian time format patterns that displayed raw timestamps instead of times in datetime fields ([#28332](https://github.com/directus/directus/pull/28332) by @u12206050) - Fixed the module navigation scrolling back to the top when navigating to another page ([#28269](https://github.com/directus/directus/pull/28269) by @khanahmad4527) - Fixed AI translations creating duplicate target language rows when streaming multiple fields. ([#28074](https://github.com/directus/directus/pull/28074) by @xmflsct) - Updated outdated type definitions for `directus_notifications`, `directus_permissions`, `directus_extensions`, `directus_fields`, `directus_activity`, `directus_collections`, and `directus_revisions` ([#28072](https://github.com/directus/directus/pull/28072) by @kheiner) - Cleaned unsupported markup from pasted content in the WYSIWYG editor and flagged it inline, with a view of what was removed and the choice to undo the paste or redo it raw in the raw HTML editor ([#28238](https://github.com/directus/directus/pull/28238) by @alvarosabu) - **@directus/api** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - Update license validation to only accept Directus keys and tokens ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - Fixed OpenAPI spec `version` to only change when the generated spec does ([#28109](https://github.com/directus/directus/pull/28109) by @kheiner) - Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error ([#28258](https://github.com/directus/directus/pull/28258) by @kheiner) - Fixed filtering and GraphQL typing of geometry subtype fields (e.g. `geometry.Point`) ([#28308](https://github.com/directus/directus/pull/28308) by @PINYOPATTANAWASANPORN) - Fixed license boot holding a lock for the entirety of startup ([#28331](https://github.com/directus/directus/pull/28331) by @ComfortablyCoding) - Fixed GraphQL marking not-null fields with a default value as nullable in queries and fields with falsey default values as required in create mutations ([#28280](https://github.com/directus/directus/pull/28280) by @Dextheking1) - Added opt-in `hash` option to redis memory, improving cache clear performance ([#28214](https://github.com/directus/directus/pull/28214) by @Nitwel) - Fixed TFA enforcement to use effective permissions ([#28176](https://github.com/directus/directus/pull/28176) by @psang39) - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - Fixed GraphQL fragments on the union type of one M2A field returning no data when spread into another M2A field ([#28305](https://github.com/directus/directus/pull/28305) by @Nitwel) - Unified related collection lookups to use `getRelationInfo` ([#28246](https://github.com/directus/directus/pull/28246) by @Nitwel) - Fixed a GraphQL query with a `__proto__` field alias being able to write a property onto Object.prototype. ([#28211](https://github.com/directus/directus/pull/28211) by @datrixlab) - Improved validation of storage locations and paths for files ([#28077](https://github.com/directus/directus/pull/28077) by @br41nslug) - **@directus/extensions-sdk** - Fixed `directus-extension validate` passing or crashing on missing extension paths ([#28320](https://github.com/directus/directus/pull/28320) by @PINYOPATTANAWASANPORN) - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - **@directus/composables** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/extensions** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - **@directus/stores** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - **@directus/themes** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - **@directus/types** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/utils** - Updated proxy-addr, braintrust, MCP SDK, sharp, vue, dompurify, source-map-js and serialize-javascript to address CVEs ([#28334](https://github.com/directus/directus/pull/28334) by @br41nslug) - Fixed filtering and GraphQL typing of geometry subtype fields (e.g. `geometry.Point`) ([#28308](https://github.com/directus/directus/pull/28308) by @PINYOPATTANAWASANPORN) - Unified related collection lookups to use `getRelationInfo` ([#28246](https://github.com/directus/directus/pull/28246) by @Nitwel) - **@directus/specs** - Fixed creating a collection with neither schema nor meta returning a misleading 403 instead of a 400 validation error ([#28258](https://github.com/directus/directus/pull/28258) by @kheiner) - **@directus/cli** - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/storage-driver-cloudinary** - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/storage-driver-supabase** - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/update-check** - Updated `undici`, `axios`, `nodemailer`, `basic-ftp`, `ip-address`, and `fast-uri` to address CVEs ([#28330](https://github.com/directus/directus/pull/28330) by @br41nslug) - **@directus/env** - Fixed requests failing after a process was stopped during schema building ([#28316](https://github.com/directus/directus/pull/28316) by @Nitwel) - **@directus/sdk** - Fixed `readActivity`, `deletePermission`, `readPermission`, `updatePermission`, `readItemPermissions`, `readNotification`, and `readRevision` not rejecting a `null` or `undefined` key or collection ([#28072](https://github.com/directus/directus/pull/28072) by @kheiner) ### 📦 Published Versions - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]` - `@directus/[email protected]`