<![CDATA[Directus - Package Updates]]>This topic is to track Directus package updates.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/3249/directus-package-updatesRSS for NodeTue, 06 Oct 2026 10:02:02 GMTTue, 29 Sep 2020 00:20:04 GMT60<![CDATA[Reply to Directus - Package Updates on Thu, 24 Sep 2026 09:36:57 GMT]]>[3.4.0]

  • Update directus to 12.4.1
  • Full Changelog
  • Fixed reading from folders endpoint as non admin (#28286 by @Nitwel)
  • Updated MapLibre GL JS from 1.15.3 to 6.9.0 (#28216 by @br41nslug)
  • Updated Unhead from 1.11.20 to 3.4.1 (#28248 by @br41nslug)
  • Fixed read permissions not enforced when resolving item keys for updateByQuery and deleteByQuery (#28143 by @br41nslug)
  • Added native mailtrap email transport support via EMAIL_TRANSPORT=mailtrap (#27873 by @tsokolovs)
  • Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable (#27792 by @br41nslug)
  • Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication (#28206 by @robluton)
  • Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field (#28206 by @robluton)
  • Added support for setting the From Name in the Send Email operation (#28206 by @robluton)
  • Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs (#28242 by @br41nslug)
]]>https://forum.cloudron.io/post/129950https://forum.cloudron.io/post/129950Thu, 24 Sep 2026 09:36:57 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 26 Aug 2026 07:05:34 GMT]]>[3.3.2]

  • Update directus to 12.3.1
  • Full Changelog
  • Added countFilterListeners, countActionListeners, and countInitListeners methods to the emitter, exposing the number of registered handlers for each event (#28117 by @ComfortablyCoding)
  • Fixed MCP OAuth clients settings pages concatenating breadcrumbs into the page title (#28115 by @MHJahanbakhsh)
  • Fixed the WebSocket heartbeat leaking a websocket.message listener on each ping when a client failed to respond in time (#28117 by @ComfortablyCoding)
  • Fixed GraphQL query fragments returning null fields (#28128 by @ComfortablyCoding)
  • Fixed public registration verification using the provided email instead of the stored one (#28144 by @br41nslug)
  • Removed user_created and date_created for update from recommended permissions for directus_shares (#28145 by @br41nslug)
  • Updated storage driver dependencies (#28119 by @ComfortablyCoding)
  • Stripped project_id when pulling settings, so a sync no longer copies one instance's identity onto another (#28132 by @lazerg)
  • Fixed unsubscribe() not removing subscriptions, causing them to persist across reconnects and accumulate for the lifetime of the client (#28117 by @ComfortablyCoding)
]]>https://forum.cloudron.io/post/128560https://forum.cloudron.io/post/128560Wed, 26 Aug 2026 07:05:34 GMT<![CDATA[Reply to Directus - Package Updates on Fri, 21 Aug 2026 08:14:22 GMT]]>[3.3.1]

]]>https://forum.cloudron.io/post/128371https://forum.cloudron.io/post/128371Fri, 21 Aug 2026 08:14:22 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 20 Aug 2026 10:00:51 GMT]]>[3.3.0]

  • Update directus to 12.3.0
  • Full Changelog
  • Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#27759)
  • Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#28076)
  • Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#28111)
  • Added search-first AI tool discovery for chat and MCP tools, with schema pinned as a root chat tool. (#27797)
  • Added a caption field to the WYSIWYG image drawer, which wraps the image in a figure with a figcaption (#28026)
  • Added the collection name appended to display template in item and drawer headers (#28078)
  • Introduced @directus/cli (d6s / directus-cli) a client-side CLI that syncs schema and configuration between Directus instances through committed JSON files, with sync pull, sync diff, sync push, and an interactive wizard (#27861)
  • Fixed SSO login redirecting to the last visited page instead of the originally requested page (#28080)
  • Fixed slow extension sync from remote storage during startup. Added EXTENSIONS_STORAGE_MAX_CONCURRENCY to configure the maximum number of concurrent requests to the extensions storage location (#27989)
  • Fixed WebSocket rate limiting breaking on shared Redis setups where keys must start with a per-project prefix. The WebSocket limiter now accepts RATE_LIMITER_WEBSOCKETS_* values as overrides, including RATE_LIMITER_WEBSOCKETS_KEY_PREFIX to override the Redis key prefix. (#28107)
]]>https://forum.cloudron.io/post/128348https://forum.cloudron.io/post/128348Thu, 20 Aug 2026 10:00:51 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 30 Jul 2026 08:37:48 GMT]]>[3.2.0]

  • Update directus to 12.2.0
  • Full Changelog
  • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#27996 by @br41nslug)
  • Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#27754 by @alvarosabu)
  • Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#27816 by @MahinAnowar)
  • Added support for multi-collection flat data imports (#27984 by @ComfortablyCoding)
  • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#27995 by @br41nslug)
  • Added JSON path filtering to Studio filters. (#27918 by @robluton)
  • Added global setting for default save action (#27993 by @robluton)
  • Added LICENSE_KEY_MANAGEMENT_ENABLED to control license key management (#27779 by @AlexGaillard)
  • Fixed manual flows triggerable by non authenticated users (#27997 by @br41nslug)
  • Fixed IP denylist not enforced for AI chat file downloads (#27994 by @br41nslug)
]]>https://forum.cloudron.io/post/127458https://forum.cloudron.io/post/127458Thu, 30 Jul 2026 08:37:48 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 02 Jul 2026 06:51:58 GMT]]>[3.1.0]

  • Update directus to 12.1.1
  • Full Changelog
  • Updated vite dependency to 8.1.2 (#27826 by @ComfortablyCoding)
  • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#27801 by @br41nslug)
  • Removed /utils/hash/generate and /utils/hash/verify endpoints (#27774 by @br41nslug)
  • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#27803 by @br41nslug)
  • Added CORS_ORIGIN checks for websocket connections (#27812 by @br41nslug)
  • Added PROJECT_OWNER_ENABLED env var to allow disabling owner info collection and sync (#27802 by @ComfortablyCoding)
  • Restored pre-v12 back button behavior: returns to the previously visited item/page when navigating via a relation, and to the collection listing when landing on an item directly (#27799 by @robluton)
  • Fixed a stored XSS vulnerability where the project color could break out of the generated favicon's SVG markup and inject arbitrary HTML (#27810 by @br41nslug)
  • Fixed a Local File Inclusion vulnerability in MailService.renderTemplate (#27811 by @br41nslug)
  • Fixed array indexing (e.g. field[0] or field.0) in display and preview URL templates, so a template like {{ categories[0].name }} now resolves to the indexed value instead of rendering empty (#27773 by @dstockton)
]]>https://forum.cloudron.io/post/126326https://forum.cloudron.io/post/126326Thu, 02 Jul 2026 06:51:58 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 18 Jun 2026 11:24:08 GMT]]>[3.0.0]

  • ⚠️ WARNING ⚠️ | [GUIDE] Directus v12 migration | Directus 12 requires a license
  • Update directus to 12.0.2
  • Full Changelog
  • Added support for non-interactive mode (#27577 by @pklenovic)
  • Fixed user count for users with conflicting direct policy and role (#27720 by @ComfortablyCoding)
  • Added keyboard-editable date entry directly in the datetime field. The field shows its formatted value at rest and swaps to editable date segments on focus, while a calendar button still opens the picker popup. (#27693 by @robluton)
  • Added inline editing support to the JSON repeater interface. (#26863 by @bryantgillespie)
  • Fixed revision snapshots being assigned to the wrong items during batch updates when read order differs (#27407 by @luciemdx)
  • Changed license to MSCL-1.0-GPL (#27417)
  • Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607)
  • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160)
  • Added MCP OAuth 2.1 authorization server. MCP clients (like Claude, Codex) can now authenticate via standard OAuth flow with PKCE instead of requiring a manually provisioned static token. Enable with MCP_OAUTH_ENABLED=true. Dynamic and client ID metadata registration were kept separately opt-in with MCP_OAUTH_DCR_ENABLED=true and MCP_OAUTH_CIMD_ENABLED=true. (#27069 by @hanneskuettner)
  • Added JSON filtering, alias and sorting support (#26981 by @br41nslug)
]]>https://forum.cloudron.io/post/125882https://forum.cloudron.io/post/125882Thu, 18 Jun 2026 11:24:08 GMT<![CDATA[Reply to Directus - Package Updates on Tue, 05 May 2026 15:04:53 GMT]]>[2.17.4]

  • Update directus to 11.17.4
  • Full Changelog
  • Updated the token field on the user detail page to require confirmation before regenerating or removing a token, and saved those changes immediately without requiring a page-level save. (#27108 by @LZylstra)
  • Added opt-in must-revalidate and ETag headers for assets via ASSETS_CACHE_REVALIDATE env var (#27027 by @gaetansenn)
  • Added a force option to schema apply to bypass hash check (#27136 by @Nitwel)
  • Fixed UI freeze when navigating items with WYSIWYG translations for non-admin users (#27154 by @gaetansenn)
  • Fixed selection not being cleared after running a manual flow from the collection list view sidebar (#27330 by @kropsi)
  • Fixed "Save as copy" in the file library throwing a 403 Forbidden error (#27181 by @sanskar-soni-9)
  • Fixed user token not being displayed after generation when collaboration is enabled (#27319 by @LZylstra)
  • Fixed flows not awaiting reload (#27137 by @Nitwel)
  • Fixed VERSION_SAVE activity/revisions not respecting collection tracking settings (#27096 by @yogeshwaran-c)
  • Denied creating collections with / in name (#27114 by @costajohnt)
]]>https://forum.cloudron.io/post/124411https://forum.cloudron.io/post/124411Tue, 05 May 2026 15:04:53 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 16 Apr 2026 09:50:15 GMT]]>[2.17.3]

  • Update directus to 11.17.3
  • Full Changelog
  • Replaced "All Users" tab with Active, Suspended, and Invited status tabs (#27036 by @robluton)
  • Added Save as New File option to image editor (#27084 by @JamesW1)
  • Added a new /ai/object endpoint to generate structured objects for autocomplete and other inline experiences (#26862 by @bryantgillespie)
  • Eliminated redundant count requests in the useItems composable (#26906 by @okxint)
  • Fixed export failing on collections with virtual fields like $thumbnail by excluding them from export defaults and the field picker (#27073 by @om-singh-D)
  • Added customizing of cache keys for flow endpoints. (#26935 by @costajohnt)
  • Fixed VBadge intercepting pointer events on slotted elements (#27087 by @HZooly)
  • Fixed schema introspection for MSSQL text fields with max length of -1 to be normalized to null (#26934 by @begsaquib)
  • Trimmed leading and trailing spaces from search queries (#27089 by @robluton)
  • Replaced INTERNAL_SERVER_ERROR with SERVICE_UNAVAILABLE for marketplace registry errors and improved error messages. (#26937 by @eric-pennecot)
]]>https://forum.cloudron.io/post/123512https://forum.cloudron.io/post/123512Thu, 16 Apr 2026 09:50:15 GMT<![CDATA[Reply to Directus - Package Updates on Tue, 07 Apr 2026 06:58:48 GMT]]>[2.17.2]

]]>https://forum.cloudron.io/post/122986https://forum.cloudron.io/post/122986Tue, 07 Apr 2026 06:58:48 GMT<![CDATA[Reply to Directus - Package Updates on Tue, 31 Mar 2026 09:39:27 GMT]]>[2.17.1]

]]>https://forum.cloudron.io/post/122734https://forum.cloudron.io/post/122734Tue, 31 Mar 2026 09:39:27 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 25 Mar 2026 08:10:16 GMT]]>[2.17.0]

  • Update directus to 11.17.0
  • Full Changelog
  • Added support for importing data in the background (#​26914)
  • Imports now automatically time out after 1 hour, with a maximum of 20 running concurrently. These limits can be configured via IMPORT_TIMEOUT and IMPORT_MAX_CONCURRENCY, respectively.
  • Improved build times using tsdowns oxc-transform (#​26604)
  • Exports previously available from @directus/types/collab are now exported directly from @directus/types
  • Shrunk app UI to 90% and converted all px to rem (16px browser default) (#​26826)
  • Potential breaking change: The app UI has been shrunk to 90% of its previous size. Extensions that rely on hardcoded px values or the old 14px root font-size may render incorrectly all app sizing now uses rem based on the 16px browser default.
]]>https://forum.cloudron.io/post/122473https://forum.cloudron.io/post/122473Wed, 25 Mar 2026 08:10:16 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 11 Mar 2026 07:09:10 GMT]]>[2.16.1]

]]>https://forum.cloudron.io/post/121624https://forum.cloudron.io/post/121624Wed, 11 Mar 2026 07:09:10 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 05 Mar 2026 06:33:54 GMT]]>[2.16.0]

]]>https://forum.cloudron.io/post/121268https://forum.cloudron.io/post/121268Thu, 05 Mar 2026 06:33:54 GMT<![CDATA[Reply to Directus - Package Updates on Mon, 16 Feb 2026 20:36:18 GMT]]>[2.15.3]

]]>https://forum.cloudron.io/post/120327https://forum.cloudron.io/post/120327Mon, 16 Feb 2026 20:36:18 GMT<![CDATA[Reply to Directus - Package Updates on Fri, 13 Feb 2026 17:41:32 GMT]]>[2.15.2]

]]>https://forum.cloudron.io/post/120158https://forum.cloudron.io/post/120158Fri, 13 Feb 2026 17:41:32 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 14 Jan 2026 20:29:27 GMT]]>[2.14.1]

  • Update directus to 11.14.1
  • Full Changelog
  • Added multi-domain support for OAuth/OpenID (#26312)
  • Removed the deprecated /webhooks functionality across the stack. This includes the API route and its related tests, (#26311 by @mobml)
  • Removed the "Comment" tab from the activities page (#26440 by @Abdallah-Awwad)
  • Fixed getAsset returning all file fields instead of only those allowed by the users permissions (#25905 by @gaetansenn)
  • Added a new AI_ENABLED environment variable to allow opting out of our AI chat feature (#26458 by @bryantgillespie)
  • Added concurrency control for file uploads via a new FILES_MAX_UPLOAD_CONCURRENCY env variable (#26424 by @thomas-svrts)
  • Added nested validation rules to validation error notice (#26389 by @robluton)
  • Added Comparison modal wysiwyg diff highlighting (#26301 by @robluton)
  • Fixed an issue that would cause some drawer header icons from being displayed too large (#26442 by @kekekuli)
  • Added support for specifying a KMS Key ID in S3 storage when using aws:kms Server Side Encryption (#26377 by @Joey92)
]]>https://forum.cloudron.io/post/118522https://forum.cloudron.io/post/118522Wed, 14 Jan 2026 20:29:27 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 10 Dec 2025 07:43:21 GMT]]>[2.14.0]

]]>https://forum.cloudron.io/post/116760https://forum.cloudron.io/post/116760Wed, 10 Dec 2025 07:43:21 GMT<![CDATA[Reply to Directus - Package Updates on Sat, 22 Nov 2025 07:01:05 GMT]]>[2.13.4]

]]>https://forum.cloudron.io/post/115771https://forum.cloudron.io/post/115771Sat, 22 Nov 2025 07:01:05 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 19 Nov 2025 23:10:54 GMT]]>[2.13.3]

]]>https://forum.cloudron.io/post/115667https://forum.cloudron.io/post/115667Wed, 19 Nov 2025 23:10:54 GMT<![CDATA[Reply to Directus - Package Updates on Tue, 11 Nov 2025 07:44:37 GMT]]>[2.13.2]

]]>https://forum.cloudron.io/post/115186https://forum.cloudron.io/post/115186Tue, 11 Nov 2025 07:44:37 GMT<![CDATA[Reply to Directus - Package Updates on Mon, 10 Nov 2025 10:24:29 GMT]]>[2.13.1]

]]>https://forum.cloudron.io/post/115134https://forum.cloudron.io/post/115134Mon, 10 Nov 2025 10:24:29 GMT<![CDATA[Reply to Directus - Package Updates on Thu, 06 Nov 2025 17:45:58 GMT]]>[2.13.0]

  • Update directus to 11.13.0
  • Full Changelog
  • Removed non-relational types from RELATIONAL_TYPES constant (#25964)
  • Fixed <scope>.delete filter hook running after permission check. Fixed keys returned by the hook not being used in place of the original keys. (#26034)
  • Restricted system collection fields to only allow indexing (#24820)
  • Use node exportConditions when building api extensions. See #25591 (#25591)
  • Introduced the Content Comparison Modal for side-by-side review of version and revision changes. (#25782)
  • Added interface config option to control indicator appearance (#26086)
  • Added schema snapshot download button to the admin view of the studio (#25903)
  • Added setup flow and license agreement banner (#25983)
  • Added comparison indicators for group interfaces (#26086)
  • Improved error reporting for data imports (#25862)
]]>https://forum.cloudron.io/post/114975https://forum.cloudron.io/post/114975Thu, 06 Nov 2025 17:45:58 GMT<![CDATA[Reply to Directus - Package Updates on Wed, 17 Sep 2025 08:18:36 GMT]]>[2.12.0]

  • Update directus to 11.12.0
  • Full Changelog
  • Fixed USER_CREATED, USER_UPDATED, DATE_CREATED, and DATE_UPDATED values in content versioning. These fields now correctly reflect the actual user and timestamp of creation or last update, rather than the user and date of promotion. (#25744)
  • Requesting a non-existent version will now return a Forbidden error.
  • The USER_CREATED, USER_UPDATED, DATE_CREATED, and DATE_UPDATED fields will now represent the last actual changes, not the promotion metadata.
  • Add MCP support (#25578 by @ComfortablyCoding)
  • Fixed OAuth flow to allow for 2FA setup (#25695 by @robluton)
  • Added description and primary key copy option to the policy page sidebar (#25755 by @khanahmad4527)
  • Ensured that custom validation messages are displayed in the drawer (#25786 by @formfcw)
  • Added cache-busting to image asset URLs in the studio to ensure updated images are always loaded (#25833 by @formfcw)
  • Fixed issue causing incorrect relationships to be used in custom interfaces (#25638 by @robluton)
  • Ensured that M2M fields in the directus_files collection use the correct interface (#25602 by @robluton)
]]>https://forum.cloudron.io/post/112762https://forum.cloudron.io/post/112762Wed, 17 Sep 2025 08:18:36 GMT