🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed flow return data not being shown in flow logs if value is falsey (#24231 by @hanneskuettner)
  • Fixed field template sanitization (#24238 by @connorwinston)
• @directus/sdk
  • Fixed SDK policy type and updateRole function (#24208 by @br41nslug)

📦 Published Versions

• @directus/app@13.3.8
• @directus/api@23.3.1
• @directus/sdk@18.0.3

✨ New Features & Improvements

• @directus/api
  • Added ability to map oidc groups to oidc roles (#24157 by @Audiotape-2)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Ensure floating view will not scroll top after route change (#23920 by @SP12893678)
  • Improved perf by preventing an unnecessary permissions lookup (#24178 by @paescuj)
  • Fixed permission checks when creating or editing related items (#24177 by @paescuj)
  • Fixed calendar layout locale for "Norwegian" (#24205 by @hanneskuettner)
  • Fixed the alignment of the select-all checkbox in the notifications drawer (#24213 by @Dominic-Marcelino)
  • Enhanced vertical alignment of SSO icons on login page (#24119 by @robsoncombr)
  • Fixed an issue with unintentional sorting after editing items in relational interfaces (#24172 by @osmandvc)
  • A potential licensing issue was reported in our use of TinyMCE (used for the WYSIWYG interface) after they changed licenses in the new major version. We've downgraded to the previous major which is MIT-licensed to resolve that while we look for a long term solution. (#24181 by @paescuj)
  • Fixed the display of relational fields in nested groups (#24183 by @formfcw)
  • Improved the default user created display template by using the avatar field (#24160 by @gavalierm)
  • Fixed thumbnails not appearing in File Library after upload (#24087 by @joselcvarela)
  • Increase raw-editor max-height (#24199 by @gloriarodrife)
• @directus/api
  • Prevented websocket heartbeat handler from erroring on startup (#24211 by @br41nslug)
  • Added assigning admin policy to a new role created via command line when needed (#24022 by @NickSettler)
  • Fixed retention time based query not being database agnostic (#24179 by @ComfortablyCoding)
  • Added idToken to providerPayload in auth.create and auth.update filter hooks (#24154 by @m3Lith)
  • Improved the performance of relational lookups (#23907 by @jclaveau)
  • Reverted query generation for M2M relations that share the same junction table in #23879 (#24149 by @licitdev)
• @directus/sdk
  • Add a discriminated union scenario to m2a query type resolution (#23708 by @datner)

📝 Documentation

• Added tip to enable System Logs (#24218 by @licitdev)
• Added ability to map oidc groups to oidc roles (#24157 by @Audiotape-2)

📦 Published Versions

• @directus/app@13.3.7
• @directus/api@23.3.0
• @directus/sdk@18.0.2

🐛 Bug Fixes & Optimizations

• @directus/app
  • Added select all and delete buttons for notifications drawer (#24028 by @NickSettler)
• @directus/api
  • Fixed an issue that could cause the schema cache to not be invalidated on schema apply (#24128 by @rijkvanzanten)
  • Added user existence check when migrating legacy comments (#24134 by @licitdev)

📦 Published Versions

• @directus/app@13.3.6
• @directus/api@23.2.2

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed WYSIWYG file upload extension to use filename_disk (#24097 by @that1matt)
• @directus/api
  • Fixed an issue that could cause the migrations to fail on certain database versions (#24126 by @ComfortablyCoding)
  • Fix specifications.ts to generate required array in OpenAPI schema (#24123 by @Zyles)

📦 Published Versions

• @directus/app@13.3.5
• @directus/api@23.2.1

🐛 Bug Fixes & Optimizations

• @directus/api
  • Added HTML sanitization in comments

📦 Published Versions

• @directus/api@21.0.2

✨ New Features & Improvements

• @directus/api
  • Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)
• @directus/env
  • Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed a HTML validity issue in the table component (#24093 by @robsoncombr)
  • Prefill sort field on relational interfaces (#20271 by @Nitwel)
  • Fixed an issue that would cause content versions to throw an error when used on singleton collections (#24096 by @rijkvanzanten)
  • Fixed item permissions not respected in drawer-item (#24045 by @ComfortablyCoding)
• @directus/api
  • Fixed unauthenticated data access on a public websocket (#24108 by @br41nslug)
  • Fixed query generation for M2M relations that share the same junction table (#23879 by @hanneskuettner)
  • Removed outdated logic for the versioning service (#24058 by @ComfortablyCoding)
  • Fixed thumbnails not being generated after edits using Cloudinary storage (#24112 by @joselcvarela)
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)
  • Restricted comment create, update and delete to authenticated users (#24058 by @ComfortablyCoding)
  • Fixed applying of snapshot changes to/from alias fields (#24120 by @licitdev)
  • Fixed SSO GitHub sign up for users without public emails (#24105 by @alexey-yarmosh)
  • Allow the login timeout for OpenID SSO login to be adjusted (#24003 by @g-pichler)
• @directus/system-data
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)
• @directus/sdk
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)

📝 Documentation

• Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)
• Restricted comment create, update and delete to authenticated users (#24058 by @ComfortablyCoding)
• Allow the login timeout for OpenID SSO login to be adjusted (#24003 by @g-pichler)
• fix typos in relational.md (#24088 by @Leptopoda)

📦 Published Versions

• @directus/app@13.3.4
• @directus/api@23.2.0
• @directus/composables@11.1.5
• create-directus-extension@11.0.7
• @directus/env@4.1.0
• @directus/extensions@2.0.6
• @directus/extensions-registry@2.0.6
• @directus/extensions-sdk@12.1.4
• @directus/memory@2.0.6
• @directus/pressure@2.0.5
• @directus/storage-driver-azure@11.1.2
• @directus/storage-driver-cloudinary@11.1.2
• @directus/storage-driver-gcs@11.1.2
• @directus/storage-driver-s3@11.0.5
• @directus/storage-driver-supabase@2.1.2
• @directus/system-data@2.1.2
• @directus/themes@1.0.5
• @directus/utils@12.0.5
• @directus/validation@1.0.5
• @directus/sdk@18.0.1

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated PHP dependency package versions.
• Updated translations with latest Crowdin changes. (#5331)
• Fixed attachment stream handling for better Chrome video support. (#5342, #5088)
• Fixed page include issue caused by PHP 8.3.14 bug. (#5341)
• Fixed OIDC userinfo handling when response included charset content type. Thanks to @wesbiggs. (#5337)
• Fixed differing code line height between dark/light modes. (#5146)

New

• PHP 8.4 Support
• MariaDB 11.4 Support
• Translations: Hungarian, Slovak, Thai

Bug Fixes

• #471 username error
• #476 Shebang incorrect in /usr/bin/clpctl
• #484 Unexpected brackets at the beginning of files
• #500 Custom cron commands are not working
• #505 Web based File Manager does not upload files
• #511 .well-known directory deleted after certificate renew
• #527 Unable to login with site user via ssh key when ftp user is created (Thanks to ccMatrix)
• #530 File permissions revert to 0770 after file modification
• #535 "Additional Configuration Directives" doesn't allow for spaces in value
• #540 S3 backup - Region - Middle East (UAE) me-central-1 missing
• Translation Fixes

Enhancements

• Added new AWS regions for S3 remote backup

Security

• Privilege Escalation from clpctlWrapper command (Yell Phone Naing) (HIGH)
• Privilege Escalation: Site User Access Allows Linux Password Changes (HIGH) (Yell Phone Naing)
• Server IP disclosure despite using Cloudflare (Yell Phone Naing)

⚠️ Potential Breaking Changes

• @directus/env
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
  • Added "Item Link" option to M2O interface (#23997 by @joselcvarela)
  • Fixed sorting order of collection for grouped collections (#22392 by @hanneskuettner)
  • Fixed broken reactivity in format item count composable (#24039 by @hanneskuettner)
• @directus/api
  • Fixed an issue in the OracleDB query binding preprocessing (#24027 by @hanneskuettner)
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
  • Added content version merging to SEARCH method endpoint (#24040 by @br41nslug)
  • Fixed an issue in the item access validation that caused problems with CockroachDB (#24026 by @hanneskuettner)
• @directus/storage-driver-cloudinary
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-supabase
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/constants
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-s3
  • Made S3 connection settings configurable (#24036 by @joselcvarela)

📝 Documentation

• Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@13.3.3
• @directus/api@23.1.3
• @directus/composables@11.1.4
• @directus/constants@12.0.1
• create-directus-extension@11.0.6
• @directus/env@4.0.0
• @directus/extensions@2.0.5
• @directus/extensions-registry@2.0.5
• @directus/extensions-sdk@12.1.3
• @directus/memory@2.0.5
• @directus/pressure@2.0.4
• @directus/storage-driver-azure@11.1.1
• @directus/storage-driver-cloudinary@11.1.1
• @directus/storage-driver-gcs@11.1.1
• @directus/storage-driver-s3@11.0.4
• @directus/storage-driver-supabase@2.1.1
• @directus/themes@1.0.4
• @directus/types@12.2.2
• @directus/utils@12.0.4
• @directus/validation@1.0.4

Security Release

• Update Instructions
• Update details on blog

BookStack v24.10.2 has been released.

This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that's typically enabled in production web-serving environments, but it's advised to update where uncertain.

Full List of Changes

• Updated application PHP dependencies.
• Updated translations with latest Crowdin changes. (#5317)

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated System CLI with fixes and updated dependencies. (#5312)
• Fixed update-url command not updating revisions & drafts. (#5292)
• Fixed the namespaces of some tests. Thanks to @LordSimal. (#5291, #5071)
• Fixed misaligned user input validation. (#5263)
• Updated setting categories to validate by for existing views, allowing custom categories to be used via the theme system. Thanks to @LachTrip. (#5255, #5251)
• Updated translations with latest Crowdin changes. (#5250)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed /permissions/me request if primary key contains a / (#23990 by @hanneskuettner)
• @directus/api
  • Skipped collection exists check when creating collections and folders (#23991 by @licitdev)

📦 Published Versions

• @directus/app@13.3.2
• @directus/api@23.1.2

✨ New Features & Improvements

• @directus/storage-driver-supabase
  • Added TUS support to the Supabase storage driver (#23958 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Added TUS support to the Azure storage driver (#23904 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Added TUS support to the Cloudinary storage driver (#23943 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Added TUS support to the GCS storage driver (#23897 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed disabled state of the "Add File" empty state button for users without permissions (#23947 by @osmandvc)
  • Improved the loading and unloading speed of the data model pages (#23976 by @hanneskuettner)
  • Fix permission generation for Shares (#23716 by @Nitwel)
  • Fixed regression to item count displaying after vue-i18n upgrade (#23973 by @hanneskuettner)
• @directus/api
  • Fix permission generation for Shares (#23716 by @Nitwel)
  • Fixed Cloudinary image preview in the File Library (#23956 by @joselcvarela)
  • Fixed SQL generation for relational sort fields with permissions (#23871 by @hanneskuettner)
  • Fixed invalid legacy permission fetching for comment mentions (#23972 by @licitdev)
• @directus/system-data
  • Fix permission generation for Shares (#23716 by @Nitwel)
• @directus/types
  • Fix permission generation for Shares (#23716 by @Nitwel)

📦 Published Versions

• @directus/app@13.3.1
• @directus/api@23.1.1
• @directus/composables@11.1.3
• create-directus-extension@11.0.5
• @directus/env@3.1.3
• @directus/extensions@2.0.4
• @directus/extensions-registry@2.0.4
• @directus/extensions-sdk@12.1.2
• @directus/memory@2.0.4
• @directus/pressure@2.0.3
• @directus/storage-driver-azure@11.1.0
• @directus/storage-driver-cloudinary@11.1.0
• @directus/storage-driver-gcs@11.1.0
• @directus/storage-driver-s3@11.0.3
• @directus/storage-driver-supabase@2.1.0
• @directus/system-data@2.1.1
• @directus/themes@1.0.3
• @directus/types@12.2.1
• @directus/utils@12.0.3
• @directus/validation@1.0.3

⚠️ Potential Breaking Changes

• @directus/sdk
  • Extracted comments to a separate table (#23612 by @licitdev)

✨ New Features & Improvements

• @directus/app
  • Extracted comments to a separate table (#23612 by @licitdev)
  • Added support for batch editing in M2M and O2M table interfaces (#21241 by @u12206050)
• @directus/api
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/system-data
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/specs
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/types
  • Extracted comments to a separate table (#23612 by @licitdev)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed display error when selecting kanban layout for the first time (#23927 by @SP12893678)
  • Ensured elements on login page are correctly truncated when not enough space is available (#23746 by @Julias0)
  • Added condition to only show the "Create Dashboard" if the user has the correct permissions (#23828 by @SP12893678)
  • Added save options to role and policies item pages (#23820 by @ubercj)
  • Hide alias fields in the export sidebar (#23866 by @licitdev)
  • Fixed tags interface to correctly handle reset whitespace option (#23829 by @SP12893678)
  • Ensured new operation can reuse same key as previously deleted one in current flow editing session (#23874 by @SP12893678)
  • Fixed an issue where the WYSIWYG interface would reload with every keystroke if custom formats are given (#23881 by @SP12893678)
  • Updated dependencies (#23819 by @renovate)
  • Fixed pasting of multiple, comma separated numbers into the filter input (#23911 by @hanneskuettner)
• @directus/api
  • Updated dependencies (#23819 by @renovate)
  • Fixed an issue which prevented the deletion of some nested collections when applying a snapshot (#23851 by @DanielBiegler)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
  • Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
  • Fixed an issue where the mail sender is not displayed correctly for instances that use special characters in project name (#23889 by @shaietz)
  • Fixed query time logging leaking memory for failed queries (#23926 by @SP12893678)
  • Added is_indexed to schema snapshot (#23861 by @ComfortablyCoding)
• create-directus-project
  • Updated dependencies (#23819 by @renovate)
• create-directus-extension
  • Updated dependencies (#23819 by @renovate)
• @directus/extensions-sdk
  • Updated dependencies (#23819 by @renovate)
• @directus/memory
  • Updated dependencies (#23819 by @renovate)
• @directus/storage-driver-azure
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-cloudinary
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
  • Fixed the cloudinary storage driver to work again with the server health check (#23821 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-s3
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-supabase
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/themes
  • Updated dependencies (#23819 by @renovate)
• @directus/update-check
  • Updated dependencies (#23819 by @renovate)
  • Added missing clear cache method (#23913 by @paescuj)
• @directus/storage-driver-local
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/sdk
  • Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
  • Improved SDK relation function type (#23877 by @br41nslug)
  • Ensured failing GraphQL requests are properly handled by throwing an error and exposing errors and data information (#22666 by @GuyShane)
• @directus/specs
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/system-data
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/types
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/extensions
  • Fixed extension-sdk defineHook and defineEndpoint types (#23836 by @br41nslug)

📝 Documentation

• Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)

📦 Published Versions

• @directus/app@13.3.0
• @directus/api@23.1.0
• @directus/composables@11.1.2
• create-directus-extension@11.0.4
• create-directus-project@11.0.2
• @directus/env@3.1.2
• @directus/errors@1.0.1
• @directus/extensions@2.0.3
• @directus/extensions-registry@2.0.3
• @directus/extensions-sdk@12.1.1
• @directus/memory@2.0.3
• @directus/pressure@2.0.2
• @directus/specs@11.1.0
• @directus/storage@11.0.1
• @directus/storage-driver-azure@11.0.2
• @directus/storage-driver-cloudinary@11.0.3
• @directus/storage-driver-gcs@11.0.2
• @directus/storage-driver-local@11.0.1
• @directus/storage-driver-s3@11.0.2
• @directus/storage-driver-supabase@2.0.2
• @directus/system-data@2.1.0
• @directus/themes@1.0.2
• @directus/types@12.2.0
• @directus/update-check@12.0.2
• @directus/utils@12.0.2
• @directus/validation@1.0.2
• @directus/sdk@18.0.0

New

• Debian 12 and Ubuntu 24.04 with HTTP/3 Support
• Node.js 22 LTS Support
• Translations: Serbian, Georgian

Bug Fixes

• #427 Cannot rename files in file manager
• #430 Comma in cron jobs minute
• #434 I think this should be a bug
• Translation Fixes

New

• Translations: Bosnian

Enhancements

• The issuance of Let's Encrypt certificates is being tested against the staging environment first to avoid rate limit errors
• The performance of creating sites, especially Node.js sites, has been enhanced

Bug Fixes

• #382 phpMyAdmin sorting not working
• #383 Instance Reboot at Admin/Instance/Setting doesn't reboot and block auto login from login pages
• #406 CloudPanel Dashboard doesn't when using the AWS EC2 installer.
• Translation Fixes

Security

• Vulnerability that allows a user with the lowest privilege to conduct a session hijacking, subsequently gaining unauthorized access to the admin and other user accounts. (Muhammad Aizat, datack.my)

New

• PHP 8.3 Support
• Node.js 20 LTS Support
• Translations: Danish, Czech

Enhancements

• The databases are backed up prior to executing remote backup
• The site settings and vhost are being included in the remote backup file
• Updated phpMyAdmin to 5.2.1

Bug Fixes

• #329 duplicate settings key in file-manager.conf
• #338 The original certificate is not removed when you delete a web application
• #355 Login Page Autocomplete/Password Manager Issue
• #359 When you delete a website the nodejs app started with PM2 is not deleted
• #367 phpMyAdmin basic auth doesn't work when CloudPanel basic auth is enableds

Security

• File Manager: New file chown issue (CVE-2023-43880)
• File Manager: Zip symlink (BSDTAR) (CVE-2023-43881)
• Command Injection (Yell Phone Naing)

New

• Translation: Koran, Persian

Enhancements

• Vietnamese, Chinese Translation
• RTL stylesheet improvements

Security

• [#298 MySQL Root Password Leak from site user (Thanks to Yell Phone Naing)](#298)
• Critical: Privilege Escalation to root from user (Thanks to Yell Phone Naing)

Bug Fixes

• #287 Colon in remote cloud backup breaks most filesystems
• #290 File Manager Extract not working since v2.3.0
• #293 Strange \n\n inside the certificate file used for custom domain.
• Translation Fixes

Security

• Critical (CVE-2023-35885): Insecure file manager cookie authentication (Muhammad Aizat, datack.my)
• Insecure File Upload leads to Privilege Escalation and Authentication Bypass (Muhammad Zulfiqar)

New

• Translations: Bulgarian
• New CloudPanel CLI Root Commands:
  • User:
    • user:add
    • user:delete
    • user:list
  • Site:
  • site:install:certificate

Enhancements

• The site user name and password can be entered manually for new WordPress sites.

Bug Fixes

• #278 CLI need normalize domain name field
• #284 CLPCTL - Problem with special characters in password result false error
• Translation Fixes

Security

• Critical (CVE-2023-33747): Privilege Escalation to root from user, big thanks to Muhammad (datack.my, host.sabily.info) for reporting and testing
• OS Command Injection, big thanks to Laurence from crowdsec.net for reporting and testing

New

• MariaDB 10.11 LTS Support
• Hebrew
• Japanese

Bug Fixes

• #245 Dark mode: Separating table borders missing
• #254 Site path / copy and paste issues
• Translation Fixes

New

• Reverse Proxy
• Chinese (Simplified)
• Chinese (Taiwan)

Bug Fixes

• #210 Dark mode: Separating table borders missing
• #220 Hetzner Snapshot cleanup throws an exception when delete protection is enabled on a snapshot
• Translation Fixes

New

• Add PHP 8.2 Support
• Dark Mode
• Node.js 18 LTS Support

Improvements

• File Manager order Directories before Files

Bug Fixes

• #208 Unable to create a WordPress site with a database server that doesn't use the default port 3306
• Translation Fixes

New

• Varnish Cache Support

Improvements

• Generate Password Link for Site User Password Update

Bug Fixes

• #138 WordPress Admin login doesn't work with passwords which contains special characters like
• #150 Cron Job PHP version issue
• #153 Backup Custom Rclone Config Time
• Translation Fixes

⚠️ Potential Breaking Changes

• @directus/api
  • Dropped support for the SendGrid email transport option (#23392 by @McSundae)

✨ New Features & Improvements

• @directus/types
  • Add Prettify type helper (#23714 by @hanneskuettner)
• @directus/extensions-sdk
  • Added support for disabling terminal screen clearing on rebuild in watch mode (#23556 by @GuyShane)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed empty preview in Markdown interface (#23599 by @joselcvarela)
  • Fixed spacing of expand/collapse button in the data model view (#23581 by @formfcw)
  • Fixed dialog/drawer order when creating a bookmark in the collection view (#23505 by @hanneskuettner)
  • Fixed SVG truncation issue in image interface preview (#23389 by @SP12893678)
  • Fixed an issue that would cause custom role names to not be translated in the role navigation sidebar (#23651 by @SP12893678)
  • Fixed WYSIWYG interface to be updated when interface options are changed via conditions (#23773 by @SP12893678)
  • Improved behavior of the translations interface when setting 'use users language' option (#23597 by @SP12893678)
  • Fixed an issue blocking collection view after switching between Kanban bookmarks (#23774 by @hanneskuettner)
  • Improved calendar layout styling to be more consistent (#23550 by @formfcw)
  • Updated dependencies (#23796 by @renovate)
  • Ensured data in sidebar is re-fetched when switching pages while a sidebar pane is already opened (#23553 by @SP12893678)
  • Ensured errors occured within the cards layout are always shown (#23802 by @SP12893678)
  • Fixed format warnings in api/src/request/is-denied-ip.ts and app/src/interfaces/input-rich-text-html/input-rich-text-html.vue (#23584 by @ComfortablyCoding)
  • Fixed an issue that would cause log streaming to fail on Directus installations that use a subpath in the URL (#23569 by @JoshTheDerf)
  • Fixed an issue that could cause the color picker interface to crash when a invalid color was used and improved the UX of interacting with the text input of the color picker interface. (#23654 by @connorwinston)
  • Ensured users are redirected to the intended page after login via LDAP (#23788 by @mmsardar)
  • Fixed failing validation of $CURRENT_POLICIES and $CURRENT_ROLES in the filter interface (#23730 by @hanneskuettner)
  • Fixed the truncation of long collection names in the permission configuration interface (#23700 by @hanneskuettner)
• @directus/api
  • Updated dependencies (#23796 by @renovate)
  • Fixed format warnings in api/src/request/is-denied-ip.ts and app/src/interfaces/input-rich-text-html/input-rich-text-html.vue (#23584 by @ComfortablyCoding)
  • Fixed unit tests for get-address util (#23583 by @ComfortablyCoding)
  • Fixed injection of the $CURRENT_POLICIES into permissions (#23728 by @hanneskuettner)
  • Added option to sync SSO user information on login for LDAP, OpenID and OAuth2 (#23595 by @br41nslug)
  • Fixed an issue enforcing database specific Primary Key constraints on field updates for all vendors (#23706 by @ComfortablyCoding)
  • Added optional ignoreRules option to Schema Apply CLI (#23465 by @keesvanbemmel)
  • Fixed authentication handling between logs streaming and regular websocket connections (#23691 by @br41nslug)
• create-directus-project
  • Updated dependencies (#23796 by @renovate)
• @directus/components
  • Updated dependencies (#23796 by @renovate)
• @directus/extensions-registry
  • Updated dependencies (#23796 by @renovate)
• @directus/release-notes-generator
  • Updated dependencies (#23796 by @renovate)
• @directus/stores
  • Updated dependencies (#23796 by @renovate)
• @directus/storage-driver-s3
  • Updated dependencies (#23796 by @renovate)
• @directus/themes
  • Updated dependencies (#23796 by @renovate)
• @directus/update-check
  • Updated dependencies (#23796 by @renovate)
• @directus/utils
  • Updated dependencies (#23796 by @renovate)
• @directus/env
  • Added option to sync SSO user information on login for LDAP, OpenID and OAuth2 (#23595 by @br41nslug)
• @directus/sdk
  • Fixed the precedence of withToken if a token is already saved in the SDK instance (#23739 by @hanneskuettner)
  • Made the output types of SDK requests better readable in IDEs (#23494 by @fapspirit)
• @directus/schema
  • Fixed an issue that would cause a server crash on unexpected PostgreSQL database schema contents (#23664 by @rijkvanzanten)
• @directus/extensions-sdk
  • Prevented nesting bundle extensions via the extensions-sdk add command (#23663 by @ComfortablyCoding)
• @directus/extensions
  • Improve defineX typings to properly type the known config options (#23714 by @hanneskuettner)

📝 Documentation

• Fixed a typo in the docs (#23585 by @rijkvanzanten)

📦 Published Versions

• @directus/app@13.2.1
• @directus/api@23.0.0
• @directus/components@1.0.1
• @directus/composables@11.1.1
• create-directus-extension@11.0.3
• create-directus-project@11.0.1
• @directus/env@3.1.1
• @directus/extensions@2.0.2
• @directus/extensions-registry@2.0.2
• @directus/extensions-sdk@12.1.0
• @directus/memory@2.0.2
• @directus/pressure@2.0.1
• @directus/release-notes-generator@1.0.1
• @directus/schema@12.1.1
• @directus/storage-driver-azure@11.0.1
• @directus/storage-driver-cloudinary@11.0.2
• @directus/storage-driver-gcs@11.0.1
• @directus/storage-driver-s3@11.0.1
• @directus/storage-driver-supabase@2.0.1
• @directus/stores@1.0.1
• @directus/themes@1.0.1
• @directus/types@12.1.0
• @directus/update-check@12.0.1
• @directus/utils@12.0.1
• @directus/validation@1.0.1
• @directus/sdk@17.0.2

✨ New Features & Improvements

• @directus/app
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
  • Ensured the opened detail in the sidebar is persisted across site navigation and reloads (per browser tab) (#23383 by @Dominic-Marcelino)
  • Added a system interface for showing a password field with visibility toggle (#23387 by @AlexGaillard)
  • Added item count to the notification drawer (#23414 by @Dominic-Marcelino)
  • Implemented selection mode for kanban layouts (#23489 by @hanneskuettner)
  • Added default view option to the markdown interface to select which view should be shown by default (#23353 by @hanneskuettner)
• @directus/api
  • Implemented logs websocket (#23016 by @licitdev)
  • Introduced the USER_INVITE_TOKEN_TTL option, allowing to configure the expiration of user invitations (#22986 by @matt-rolley)
  • Fixed OracleDB error when updating nullable option with the same value as before (#23436 by @jaads)
  • Enabled gen_random_uuid() to be used as default value for a field (#23359 by @jaads)
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
• @directus/env
  • Implemented logs websocket (#23016 by @licitdev)
• @directus/schema
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Ensured notifications are reloaded after manually running a Flow to provide users with the latest notifications generated by the Flow (#23381 by @Dominic-Marcelino)
  • Ensured warning about unsaved changes is displayed for Flows with custom confirmation config too (#23408 by @Dominic-Marcelino)
  • Improved selection label of the "New Tab" checkbox in the html rich text editor (#23502 by @simboonlong)
  • Added notice in notifications drawer when no items are found due to applied search/filter (#23428 by @paescuj)
  • Fixed styling issues with the related-values display (#21854 by @formfcw)
  • Added system logs to the app (#23066 by @licitdev)
  • Fixed the "Archive All" notifications functionality (#23411 by @Dominic-Marcelino)
  • Fixed a syntax error that did not correctly apply the border for the v-chip component (#23540 by @formfcw)
  • Prevented a crash in the Data Studio when switching to the "Date" type while configuring Datetime interface (#23384 by @SP12893678)
  • Dropped unused translations (#23503 by @hanneskuettner)
  • Fixed the image tune menu toggle state indication in the block editor interface (#23510 by @HeikoMueller)
  • Ensured the notifications unread count is updated when un-/archiving notifications (#23407 by @paescuj)
  • Improved the grid layout for radio and checkboxes interface (#23358 by @SP12893678)
• @directus/api
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
  • Fixed server address undefined for graphql and websocket logs (#23488 by @ComfortablyCoding)
  • Fixed the length of icon fields in system collections, allowing to use icons with longer names (#23391 by @SP12893678)
  • Fixed SQL query generation for MSSQL queries that use field level permissions and sort (#23518 by @hanneskuettner)
  • Fixed the preprocessing of SQL bindings that is necessary to deduplicate identical value bindings for some SQL dialects (#23453 by @joselcvarela)
  • Fixed an issue that could cause the response cache to misbehave (769fa22 by @rijkvanzanten)
  • Fixed an issue that would cause local extensions built via workspaces to not be watched when extensions reload is active (#23100 by @bernatvadell)
  • Fixed the email.send filter to be usable in Flows in conjunction with the "Run Script" operation (#23446 by @joselcvarela)
  • Fixed the generated OpenAPI specs to include POST, PATCH and DELETE paths again (#23460 by @u12206050)
  • Fixed an issue where creating notifications could hang on SQLite (#23405 by @paescuj)
• @directus/memory
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
• @directus/env
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
  • Fixed server address undefined for graphql and websocket logs (#23488 by @ComfortablyCoding)
  • Expanded 0.0.0.0 matching of loopback ranges (8cbf943 by @br41nslug)
  • Introduced the USER_INVITE_TOKEN_TTL option, allowing to configure the expiration of user invitations (#22986 by @matt-rolley)
• @directus/sdk
  • Fixed an outdated property name in the permissions typing (#23380 by @EdouardDem)
  • Fix DirectusPolicy typescript declaration (#23442 by @Lfillon)
  • Reset attempts after reconnection failure (#23016 by @licitdev)
• @directus/specs
  • Fixed a duplicate operationId (d90d1bd by @rijkvanzanten)
• @directus/storage-driver-cloudinary
  • Fixed an issue that could cause cloudinary to throw an inconsistent chunk size (#23554 by @AndriyStankevych)

📝 Documentation

• Implemented logs websocket (#23016 by @licitdev)
• Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
• Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
• Fixed missing import in auth example (#23490 by @rijkvanzanten)

📦 Published Versions

• @directus/app@13.2.0
• @directus/api@22.2.0
• create-directus-extension@11.0.2
• @directus/env@3.1.0
• @directus/extensions@2.0.1
• @directus/extensions-registry@2.0.1
• @directus/extensions-sdk@12.0.2
• @directus/memory@2.0.1
• @directus/schema@12.1.0
• @directus/specs@11.0.1
• @directus/storage-driver-cloudinary@11.0.1
• @directus/types@12.0.1
• @directus/sdk@17.0.1

🐛 Bug Fixes & Optimizations

• @directus/api
  • Fixed an issue that would prevent extensions from loading (#23328 by @joselcvarela)
  • Fixed an issue that could cause the response cache to misbehave (4aace0b by @rijkvanzanten)
• @directus/memory
  • Fixed an issue that would prevent extensions from loading (#23328 by @joselcvarela)
• @directus/env
  • Fixed an issue that would prevent extensions from loading (#23328 by @joselcvarela)
  • Expanded 0.0.0.0 matching of loopback ranges (c1f3ccc by @rijkvanzanten)

📝 Documentation

• Fixed an issue that would prevent extensions from loading (#23328 by @joselcvarela)

📦 Published Versions

• @directus/app@12.2.3
• @directus/api@21.0.1
• @directus/env@1.3.2
• @directus/memory@1.0.12

✨ New Features & Improvements

• @directus/app
  • Added the option to select a default sort field in the O2M interface (#23019 by @alexvdvalk)
• @directus/composables
  • Enhanced & aligned item counts in collections, providing more detailed information (#22519 by @paescuj)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed bookmark duplication when rapidly switching between bookmarks (#23324 by @SP12893678)
  • Fixed translations interface that attempted to query the language direction field, even if unconfigured and unavailable (#23300 by @hanneskuettner)
  • Fixed readonly mutation to fields in the store via item drawer (#23277 by @azrikahar)
  • Fixed the sorting behavior when adding new items to a O2M relation that uses a string sort field (e.g. through manual (#23348 by @hanneskuettner)
    sorting in the table interface)
  • Enhanced & aligned item counts in collections, providing more detailed information (#22519 by @paescuj)
  • Improved WYSIWYG editor to hide the toolbar if no toolbar items are selected (#23310 by @Dominic-Marcelino)
  • Fixed the WYSIWYG interface to correctly apply the font configured in the interface settings (#23343 by @formfcw)
• @directus/api
  • Persist default value and nullable during field schema update (#23151 by @echocrow)
  • Fixed caching behavior of permissions that contain dynamic variables (#23321 by @hanneskuettner)
  • Fixed the permission application for relational _some and _none filters (#23272 by @hanneskuettner)
  • Fixed an issue where the first column would be missing when importing UTF-8 BOM CSV files (#23332 by @azrikahar)
  • Fixed sort field default for related o2m items in case of missing permissions (#23267 by @hanneskuettner)
  • Fixed typo for invalid aggregate query parameter log (#23334 by @azrikahar)
  • Fixed item permission checking for collections that have permissions with no field access (#23357 by @hanneskuettner)
  • Fixed deep groupBy queries for O2M relations, where results were not correctly grouped under their respective parent (#23279 by @hanneskuettner)
    items
  • Fixed the notification for finished file exports to be sent out to users without requiring any permissions on directus_notifications (#23336 by @azrikahar)
  • Fixed the retrieval of updatable singleton field permissions in the /permissions/me/<collection> endpoint (#23269 by @hanneskuettner)
  • Fixed permissions migration to work with more MySQL flavors (#23327 by @hanneskuettner)
  • Fixed "DB_CLIENT" Environment Variable is missing. appearing during directus init (#23256 by @ComfortablyCoding)
  • Fixed M2A querying when the user does not have access to all related collections (#23340 by @hanneskuettner)
  • Ensured payload validation accounts for preset data (#23346 by @hanneskuettner)

📦 Published Versions

• @directus/app@13.1.0
• @directus/api@22.1.1
• @directus/composables@11.1.0
• create-directus-extension@11.0.1
• @directus/extensions-sdk@12.0.1

There were a handful reports about the migrations from v10-v11 failing, so we pushed a couple patches to make it more reliable 🙂

✨ New Features & Improvements

• @directus/api
  • Added transaction retry mechanism for SQLite if a SQLITE_BUSY errors occurs (#23243 by @joggienl)
  • Added support for listening on unix sockets via a new UNIX_SOCKET_PATH variable (#23150 by @McSundae)
• @directus/env
  • Added support to provide a cast prefix to config variables which are read from a file using the _FILE suffix (#22164 by @joselcvarela)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Removed update delay in the block editor interface (#23115 by @SP12893678)
  • Fixed list structure in draggable lists (#23116 by @SP12893678)
  • Fixed an issue that would cause the translations display not to use the correct language if the user relied on "system (#23240 by @danilobuerger)
    language"
• @directus/api
  • Improved policies migration to handle a missing foreign key on directus_permissions.role more gracefully (#23251 by @hanneskuettner)
  • Ensured the migrations are properly executed when bootstrapping MySQL (#23233 by @paescuj)
  • Fixed drop foreign key if has different constraint name on permissions policies migrations (#23253 by @joselcvarela)
  • Fixed the init CLI command for MySQL to use the new mysql2 package (#23231 by @paescuj)

📝 Documentation

• Added support for listening on unix sockets via a new UNIX_SOCKET_PATH variable (#23150 by @McSundae)
• Added support to provide a cast prefix to config variables which are read from a file using the _FILE suffix (#22164 by @joselcvarela)

📦 Published Versions

• @directus/app@13.0.1
• @directus/api@22.1.0
• @directus/env@3.0.0

Policies

Directus v11 contains a brand new permissions system that's based on policies. We've provided a migration, so the upgrade path is the same as with other releases. This is a big release, which changes the paradigm on how permissions are attached and executed. Please make a database backup before upgrading your version of Directus.

⚠️ Potential Breaking Changes

• @directus/app
  • Added a new policy based permissions system (#22773 by @rijkvanzanten)
• @directus/api
  • Replaced the database client library mysql with mysql2, used for MySQL/MariaDB (#22534 by @paescuj)
  • Added a new policy based permissions system (#22773 by @rijkvanzanten)
• @directus/extensions
  • Changed module preRegisterCheck signature to align with the changes made for Policies (#22773 by @rijkvanzanten)
• @directus/system-data
  • Added new collections and fields and updated existing fields and permissions needed for Policies (#22773 by @rijkvanzanten)
• @directus/types
  • Added new types and modified existing types required for Policies (#22773 by @rijkvanzanten)
• @directus/utils
  • Added new dynamic variables to parseFilter and added the processChunk helper (#22773 by @rijkvanzanten)

✨ New Features & Improvements

• @directus/api
  • Updated WebSocket subscriptions to include the new policies collection (#22773 by @rijkvanzanten)
  • Used explicit headings for CSV export (#23140 by @jaads)
  • Implemented new GraphQL queries for policies (#22773 by @rijkvanzanten)
• @directus/constants
  • Added permission actions constant (#22773 by @rijkvanzanten)
• @directus/sdk
  • Implemented new SDK functions for policies (#22773 by @rijkvanzanten)
• @directus/memory
  • Added new clear method to cache implementations (#22773 by @rijkvanzanten)
• @directus/errors
  • Added error extension to the ForbiddenError (#22773 by @rijkvanzanten)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Ensured collections in system permissions interface are scrolled into view when added but out of view (#23036 by @paescuj)
  • Ensured the permissions table under policies is displayed correctly on mobile devices (#22985 by @paescuj)
  • Fixed table layout default query, to not include presetational fields (#22840 by @hanneskuettner)
  • Fixed missing policies in public role policy selection (#23192 by @hanneskuettner)
• @directus/api
  • Fixed groupBy behavior that resulted in an internal server error when used with relational item permissions (#23185 by @hanneskuettner)
  • Fixed an issue that would cause the API to return an error when a root field in a m2a builder was queried (#23181 by @rijkvanzanten)
  • Fixed reduceSchema to strip out collection the user does not have access to (#22916 by @hanneskuettner)
  • Fixed user counting where users were double counted and inactive users with policies were counted as well (#23184 by @rijkvanzanten)
  • Fixed filter creation in fetchPolicies for users without roles (#22936 by @hanneskuettner)
  • Fixed aggregation field existence and permission checks (#23022 by @hanneskuettner)
  • Fixed down migration erroring on post migration permissions (#23097 by @ComfortablyCoding)
  • Fixed permission checking for o2m related fields (#23199 by @hanneskuettner)
  • Ensured that policies attached to a user, role and parent roles are correctly prioritized (#22967 by @paescuj)
  • Ensured the default DB_FILENAME option from the Docker Image is not applied when using MySQL/MariaDB, fixing a corresponding warning (#22970 by @cliqer)
  • Fixed the policies migration for the case where permissions had been configured for the public role (#22811 by @paescuj)
  • Fix query error on some DB vendors when using multi relation sort (#22872 by @hanneskuettner)
  • Migrated NotificationsService to new policies system (#22914 by @hanneskuettner)
  • Fixed broken permissions for sorting of aggregate query when using the aggregate result as sort field (#23193 by @hanneskuettner)
  • Fixed an issue where keys in filter operand objects where incorrectly checked for field permissions (#22915 by @hanneskuettner)

📦 Published Versions

• @directus/app@13.0.0
• @directus/api@22.0.0
• @directus/components@1.0.0
• @directus/composables@11.0.0
• @directus/constants@12.0.0
• create-directus-extension@11.0.0
• create-directus-project@11.0.0
• @directus/env@2.0.0
• @directus/errors@1.0.0
• @directus/extensions@2.0.0
• @directus/extensions-registry@2.0.0
• @directus/extensions-sdk@12.0.0
• @directus/format-title@11.0.0
• @directus/memory@2.0.0
• @directus/pressure@2.0.0
• @directus/random@1.0.0
• @directus/release-notes-generator@1.0.0
• @directus/schema@12.0.0
• @directus/specs@11.0.0
• @directus/storage@11.0.0
• @directus/storage-driver-azure@11.0.0
• @directus/storage-driver-cloudinary@11.0.0
• @directus/storage-driver-gcs@11.0.0
• @directus/storage-driver-local@11.0.0
• @directus/storage-driver-s3@11.0.0
• @directus/storage-driver-supabase@2.0.0
• @directus/stores@1.0.0
• @directus/system-data@2.0.0
• @directus/themes@1.0.0
• @directus/tsconfig@2.0.0
• @directus/types@12.0.0
• @directus/update-check@12.0.0
• @directus/utils@12.0.0
• @directus/validation@1.0.0
• @directus/sdk@17.0.0