Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated export logic to have better temp file clean-up. (#5374, #5379)
• Updated in-app export endpoints to have rate limits. (#5379)
• Updated translations with latest Crowdin changes. (#5370)
• Updated PHP dependency package versions.
• Fixed markdown editor focus jumping on image insert. (#5384)

Links

• Release video overview
• Update instructions
• Update details on blog

Full List of Changes

• Added new portable ZIP import/export format. (#5260, #43)
• Added support for concatenating multiple LDAP attributes in displayName. Thanks to @MatthieuLeboeuf. (#5295, #1684)
• Added book and chapter titles to search API results. Thanks to @rashadkhan359. (#5280, #5140)
• Added cover image details to book/shelf API list responses. (#5180)
• Updated dev dockerfile setup to simplify things. Thanks to @johnroyer. (#5293)
• Updated guest account form to hide language preference to prevent confusion. (#5356)
• Updated new WYSIWYG editor codebase to merge nodes & re-organise code. (#5349)
• Updated notification handling to not block user with errors on send failures. (#5315)
• Updated our JavaScript service files to TypeScript. (#5259)
• Updated project NPM package & SASS deprecations/changes. (#5354)
• Updated the new WYSIWYG editor with a range of fixes/updates. (#5365)
• Updated translations with latest Crowdin changes. (#5345)
• Fixed API attachment update issue when name not provided. (#5353)
• Fixed attachment actions showing when lacking permissions. (#5323)
• Fixed missing book description and formatting in markdown exports. Thanks to @czemu. (#5313)
• Fixed page indexing breaking with very large pages. (#5322)

• Milestone

In this release, the coding focus has been on moving to PHP 8.1+ and refactoring the integration of the SimplePie library (which was long due). At the same time, plenty of new features have been added. Enjoy! 🎄

Breaking changes 💥:

• Require PHP 8.1+ (and improved support of PHP 8.4+)
• Require PostgreSQL 10+ or MariaDB 10.0.5+ or MySQL 8+

A few highlights ✨:

• Add support for regex search (regular expressions)
  • ⚠️ Advanced regex syntax for searches depends on the database used (SQLite, PostgreSQL, MariaDB, MySQL),
    but FreshRSS filter actions such as auto-mark-as-read and auto-favourite always use PHP PCRE2 syntax.
• Allow dynamic search operator in user queries, like search:UserQueryA date:P1d
• New feed mode HTML+XPath+JSON dot notation (JSON in HTML)
• Better HTTP compliance with support for HTTP response headers Cache-Control: max-age and Expires
• New unicity policies and heuristic for feeds with bad article IDs (reduce the problem of duplicated articles)
• New option to automatically mark new articles as read if an identical title already exists in the same category
• Add ability to remove content from articles with CSS selectors, also when not using full content
• New condition option to selectively retrieve full content of articles
• New UI feature to download a user’ SQLite database or a database SQLite export (to be produced by CLI)
• Supported by Capy Reader (Android, open source)
• Many bug fixes, UI improvements, and a lot more

This release has been made by @aledeg, @Alkarex, @Art4, @ColonelMoutarde, @Frenzie, @math-GH, @ramazansancar
and newcomers @DevGrohl, @UserRoot-Luca, @aarnej, @andrey-utkin, @bhj, @christophehenry, @davralin, @drego85, @ev-gor, @killerog, @kwarraich, @minna-xD, @mtalexan, @oshaposhnyk, @patHyatt

Full changelog:

• Features
  • Add support for regex search (regular expressions) #6706, #6926
    • ⚠️ Advanced regex syntax for searches depends on the database used (SQLite, PostgreSQL, MariaDB, MySQL),
      but FreshRSS filter actions such as auto-mark-as-read and auto-favourite always use PHP PCRE2 syntax.
  • Allow dynamic search operator in user queries, like search:UserQueryA date:P1d #6851
  • New feed mode HTML+XPath+JSON dot notation (JSON in HTML) #6888
  • Better HTTP compliance with support for HTTP response headers Cache-Control: max-age and Expires #6812, FreshRSS/simplepie#26
  • Support custom HTTP request headers per feed (e.g. for Authorization) #6820
  • New unicity policies and heuristic for feeds with bad article IDs #4487, #6900
  • Fallback to GUID if article link is empty #7051
  • New option to automatically mark new articles as read if an identical title already exists in the same category #6922
  • New reading view option to display unread articles + favourites #7088
    • And corresponding new filter state &state=96 (no UI button yet)
  • Add ability to remove content from articles with CSS selectors, also when not using full content #6786, #6807
  • Update phpgt/cssxpath library with improved CSS selectors #6618
    • Support for :last-child, :first-of-type, :last-of-type, ^=, |=
  • New condition option to selectively retrieve full content of articles
    #33fd07f6f26310d4806077cc87bcdf9b8b940e35, #7082
  • Allow parentheses in quoted search #7055
  • New UI feature to download a user’ SQLite database or a database SQLite export (to be produced by CLI) #6931
  • New button to delete errored feeds from a category #7030
  • Better import of Inoreader user labels #6791
  • Rebuild feed favicon on cache clear #6961
  • New sharing with Bluesky #7116
  • New sharing with Telegram #6838
• Bug fixing
  • Fix searches with a parenthesis before an operator like ("a b") or (!c) #6818
  • Fix auto-read tags #6790
  • Fix CSS selector for removing elements #7037, #7073,
    #7081, #7091, #7083
  • Fix redirection error after creating a new user #6995
  • Fix favicon error in case of wrong URL #6899
  • Use cURL to fetch extensions list (allows e.g. IPv6) #6767
  • Fix XML encoding in cURL options #6821
  • Fix initial UI scroll for some browsers #7059
  • Fix menu for article tags in some cases #6990
  • Fix share menu shortcut #6825
  • Fix HTML regex pattern during install for compatibility with v mode #7009
  • More robust creation of user data folder #7000
• API
  • Fix API for categories and labels containing a + #7033
    • Compatibility with FocusReader
  • Supported by Capy Reader (Android, open source) capyreader#492
  • Improved UI for API #7048
  • Allow adding multiple feeds to a category via API #7017
  • API support edit multiple tags #7060
  • API return all categories also those without any feed #7020
• Compatibility
  • Require PHP 8.1+ (drop PHP 7.4) #6711
  • Improved support of PHP 8.4+ #6618, PhpGt/CssXPath#227,
    #6781, #4374
  • Require PostgreSQL 10+ (drop PostgreSQL 9.5) #6705
  • Require MariaDB 10.0.5+ (drop MariaDB 5.5) #6706
  • Requiring MySQL 8+ (drop MySQL 5.5.3) #6706
• Deployment
  • Docker: dev image freshrss/freshrss:oldest updated to Alpine 3.16 with PHP 8.1.22 and Apache 2.4.59 #6711
  • Docker alternative image updated to Alpine 3.21 with PHP 8.3.14 and Apache 2.4.62 #5383
  • Update Dockerfiles to newer key-value format #6819
  • Docker minor improvement of entrypoint #6827
• SimplePie
  • Refactor our embedding of SimplePie #4374
    • Our fork is maintained in its own repository.
  • Remove HTTP Referer #6822, FreshRSS/simplepie#27
    • If some sites require it, add Referer: https://example.net/ to the custom HTTP headers of the feed #6820
  • Upstream fixes simplepie#878, simplepie#883
  • Sync upstream #6840, #7067
• Security
  • Apache protect more non-public folders and files #6881, #6893, #7008
  • Add privacy settings on extension list retrieval #4603, #7132
  • Fix login in unsafe mode when using a password with special XML characters #6797
  • Fix login in e.g. Brave browser by avoiding synchronous XHR #7023
  • Fix invalid login message #7066
  • Modernise windows.open noopener (to avoid flash of white page in dark mode) #7077, #7089
• UI
  • Searchable My Labels field #6753
  • Add subscription management button to reading view #6946
  • New option for showing label menu in article row #6984
  • Move to next unread label on mark as read #6886
  • Improved article footer for small / mobile screens #7031
  • Improve Web accessibility: fix aria-hidden bug, and use HTML5 hidden #6910
  • Default styles for <pre> and <code> #6770
  • Refactor the sharing menu to use a <template> instead of duplicated HTML code #6751, #7113
  • Refactor the label menu to use a <template> #6864
  • Rework UI for authors #7054
    • Avoid Unicode escape of authors in HTML UI #7056
  • Improved subscription management page #6816
  • Improve user query management page #7062
  • Restore JavaScript form validation compatibility with Web browsers using older engines (SeaMonkey) #6777
  • Reorganise some options #6920
  • New shortcut ? to show shortcut page and help #6981
  • Use of consistent colours in statistics #7090
  • Various UI and style improvements #6959
• Extensions
  • New extension hook simplepie_after_init #7007
• I18n
  • Add Finnish #6954
  • Improve English #7049, #7053
  • Improve German #6847, #7068, #7128
  • Improve Italian #6872, #7069, #7086
  • Improve Spanish #6894, #6908
  • Improve Turkish #6960
• Misc.
  • Better cache name for JSON feeds #6768
  • Fix inversed encoding logic in Minz_Request::paramArray() #6800
  • Pass PHPStan booleansInConditions #6793
  • Rename PHPStan configuration file to phpstan.dist.neon to allow custom configuration in phpstan.neon #6892
  • Code improvements #6800, #6809, #6983
  • Makefile improvements #6913
  • Fix PHPCS ControlSignature #6896
  • Update PHPMailer #6968, #7046
  • Code updates to PHP 8.1 syntax #6748
  • Update dev dependencies #6780, #6964, , #6965,
    #6966, #6967, #6970,
    #7042, #7043, #7044,
    #7045, #7047, #7052

✨ New Features & Improvements

• @directus/app
  • Added support for title and text fields to display related values in the kanban layout (#23538 by @matt-rolley)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Added Marathi (mr-IN) to the list of translations 94% completed (#24244 by @satputekuldip)
• @directus/api
  • Fixed incorrect updating of user's role when OIDC role mapping is not set (#24252 by @licitdev)

📦 Published Versions

• @directus/app@13.4.0
• @directus/api@23.3.2

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed flow return data not being shown in flow logs if value is falsey (#24231 by @hanneskuettner)
  • Fixed field template sanitization (#24238 by @connorwinston)
• @directus/sdk
  • Fixed SDK policy type and updateRole function (#24208 by @br41nslug)

📦 Published Versions

• @directus/app@13.3.8
• @directus/api@23.3.1
• @directus/sdk@18.0.3

✨ New Features & Improvements

• @directus/api
  • Added ability to map oidc groups to oidc roles (#24157 by @Audiotape-2)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Ensure floating view will not scroll top after route change (#23920 by @SP12893678)
  • Improved perf by preventing an unnecessary permissions lookup (#24178 by @paescuj)
  • Fixed permission checks when creating or editing related items (#24177 by @paescuj)
  • Fixed calendar layout locale for "Norwegian" (#24205 by @hanneskuettner)
  • Fixed the alignment of the select-all checkbox in the notifications drawer (#24213 by @Dominic-Marcelino)
  • Enhanced vertical alignment of SSO icons on login page (#24119 by @robsoncombr)
  • Fixed an issue with unintentional sorting after editing items in relational interfaces (#24172 by @osmandvc)
  • A potential licensing issue was reported in our use of TinyMCE (used for the WYSIWYG interface) after they changed licenses in the new major version. We've downgraded to the previous major which is MIT-licensed to resolve that while we look for a long term solution. (#24181 by @paescuj)
  • Fixed the display of relational fields in nested groups (#24183 by @formfcw)
  • Improved the default user created display template by using the avatar field (#24160 by @gavalierm)
  • Fixed thumbnails not appearing in File Library after upload (#24087 by @joselcvarela)
  • Increase raw-editor max-height (#24199 by @gloriarodrife)
• @directus/api
  • Prevented websocket heartbeat handler from erroring on startup (#24211 by @br41nslug)
  • Added assigning admin policy to a new role created via command line when needed (#24022 by @NickSettler)
  • Fixed retention time based query not being database agnostic (#24179 by @ComfortablyCoding)
  • Added idToken to providerPayload in auth.create and auth.update filter hooks (#24154 by @m3Lith)
  • Improved the performance of relational lookups (#23907 by @jclaveau)
  • Reverted query generation for M2M relations that share the same junction table in #23879 (#24149 by @licitdev)
• @directus/sdk
  • Add a discriminated union scenario to m2a query type resolution (#23708 by @datner)

📝 Documentation

• Added tip to enable System Logs (#24218 by @licitdev)
• Added ability to map oidc groups to oidc roles (#24157 by @Audiotape-2)

📦 Published Versions

• @directus/app@13.3.7
• @directus/api@23.3.0
• @directus/sdk@18.0.2

🐛 Bug Fixes & Optimizations

• @directus/app
  • Added select all and delete buttons for notifications drawer (#24028 by @NickSettler)
• @directus/api
  • Fixed an issue that could cause the schema cache to not be invalidated on schema apply (#24128 by @rijkvanzanten)
  • Added user existence check when migrating legacy comments (#24134 by @licitdev)

📦 Published Versions

• @directus/app@13.3.6
• @directus/api@23.2.2

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed WYSIWYG file upload extension to use filename_disk (#24097 by @that1matt)
• @directus/api
  • Fixed an issue that could cause the migrations to fail on certain database versions (#24126 by @ComfortablyCoding)
  • Fix specifications.ts to generate required array in OpenAPI schema (#24123 by @Zyles)

📦 Published Versions

• @directus/app@13.3.5
• @directus/api@23.2.1

🐛 Bug Fixes & Optimizations

• @directus/api
  • Added HTML sanitization in comments

📦 Published Versions

• @directus/api@21.0.2

✨ New Features & Improvements

• @directus/api
  • Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)
• @directus/env
  • Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed a HTML validity issue in the table component (#24093 by @robsoncombr)
  • Prefill sort field on relational interfaces (#20271 by @Nitwel)
  • Fixed an issue that would cause content versions to throw an error when used on singleton collections (#24096 by @rijkvanzanten)
  • Fixed item permissions not respected in drawer-item (#24045 by @ComfortablyCoding)
• @directus/api
  • Fixed unauthenticated data access on a public websocket (#24108 by @br41nslug)
  • Fixed query generation for M2M relations that share the same junction table (#23879 by @hanneskuettner)
  • Removed outdated logic for the versioning service (#24058 by @ComfortablyCoding)
  • Fixed thumbnails not being generated after edits using Cloudinary storage (#24112 by @joselcvarela)
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)
  • Restricted comment create, update and delete to authenticated users (#24058 by @ComfortablyCoding)
  • Fixed applying of snapshot changes to/from alias fields (#24120 by @licitdev)
  • Fixed SSO GitHub sign up for users without public emails (#24105 by @alexey-yarmosh)
  • Allow the login timeout for OpenID SSO login to be adjusted (#24003 by @g-pichler)
• @directus/system-data
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)
• @directus/sdk
  • Removed outdated logic for the comment service (#24058 by @ComfortablyCoding)

📝 Documentation

• Added retention support for directus_activity and directus_revisions (#24058 by @ComfortablyCoding)
• Restricted comment create, update and delete to authenticated users (#24058 by @ComfortablyCoding)
• Allow the login timeout for OpenID SSO login to be adjusted (#24003 by @g-pichler)
• fix typos in relational.md (#24088 by @Leptopoda)

📦 Published Versions

• @directus/app@13.3.4
• @directus/api@23.2.0
• @directus/composables@11.1.5
• create-directus-extension@11.0.7
• @directus/env@4.1.0
• @directus/extensions@2.0.6
• @directus/extensions-registry@2.0.6
• @directus/extensions-sdk@12.1.4
• @directus/memory@2.0.6
• @directus/pressure@2.0.5
• @directus/storage-driver-azure@11.1.2
• @directus/storage-driver-cloudinary@11.1.2
• @directus/storage-driver-gcs@11.1.2
• @directus/storage-driver-s3@11.0.5
• @directus/storage-driver-supabase@2.1.2
• @directus/system-data@2.1.2
• @directus/themes@1.0.5
• @directus/utils@12.0.5
• @directus/validation@1.0.5
• @directus/sdk@18.0.1

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated PHP dependency package versions.
• Updated translations with latest Crowdin changes. (#5331)
• Fixed attachment stream handling for better Chrome video support. (#5342, #5088)
• Fixed page include issue caused by PHP 8.3.14 bug. (#5341)
• Fixed OIDC userinfo handling when response included charset content type. Thanks to @wesbiggs. (#5337)
• Fixed differing code line height between dark/light modes. (#5146)

New

• PHP 8.4 Support
• MariaDB 11.4 Support
• Translations: Hungarian, Slovak, Thai

Bug Fixes

• #471 username error
• #476 Shebang incorrect in /usr/bin/clpctl
• #484 Unexpected brackets at the beginning of files
• #500 Custom cron commands are not working
• #505 Web based File Manager does not upload files
• #511 .well-known directory deleted after certificate renew
• #527 Unable to login with site user via ssh key when ftp user is created (Thanks to ccMatrix)
• #530 File permissions revert to 0770 after file modification
• #535 "Additional Configuration Directives" doesn't allow for spaces in value
• #540 S3 backup - Region - Middle East (UAE) me-central-1 missing
• Translation Fixes

Enhancements

• Added new AWS regions for S3 remote backup

Security

• Privilege Escalation from clpctlWrapper command (Yell Phone Naing) (HIGH)
• Privilege Escalation: Site User Access Allows Linux Password Changes (HIGH) (Yell Phone Naing)
• Server IP disclosure despite using Cloudflare (Yell Phone Naing)

⚠️ Potential Breaking Changes

• @directus/env
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
  • Added "Item Link" option to M2O interface (#23997 by @joselcvarela)
  • Fixed sorting order of collection for grouped collections (#22392 by @hanneskuettner)
  • Fixed broken reactivity in format item count composable (#24039 by @hanneskuettner)
• @directus/api
  • Fixed an issue in the OracleDB query binding preprocessing (#24027 by @hanneskuettner)
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
  • Added content version merging to SEARCH method endpoint (#24040 by @br41nslug)
  • Fixed an issue in the item access validation that caused problems with CockroachDB (#24026 by @hanneskuettner)
• @directus/storage-driver-cloudinary
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-supabase
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/constants
  • Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)
• @directus/storage-driver-s3
  • Made S3 connection settings configurable (#24036 by @joselcvarela)

📝 Documentation

• Fixed enforcing chunkSize when TUS is not enabled and updated the default TUS_CHUNK_SIZE to 8mb (#24002 by @ComfortablyCoding)

📦 Published Versions

• @directus/app@13.3.3
• @directus/api@23.1.3
• @directus/composables@11.1.4
• @directus/constants@12.0.1
• create-directus-extension@11.0.6
• @directus/env@4.0.0
• @directus/extensions@2.0.5
• @directus/extensions-registry@2.0.5
• @directus/extensions-sdk@12.1.3
• @directus/memory@2.0.5
• @directus/pressure@2.0.4
• @directus/storage-driver-azure@11.1.1
• @directus/storage-driver-cloudinary@11.1.1
• @directus/storage-driver-gcs@11.1.1
• @directus/storage-driver-s3@11.0.4
• @directus/storage-driver-supabase@2.1.1
• @directus/themes@1.0.4
• @directus/types@12.2.2
• @directus/utils@12.0.4
• @directus/validation@1.0.4

Security Release

• Update Instructions
• Update details on blog

BookStack v24.10.2 has been released.

This is a security release to address a vulnerability in our dependencies where specifically formatted requests could be used to manipulate application configuration in environments where a certain PHP option (register_argc_argv) is enabled. This is not an option that's typically enabled in production web-serving environments, but it's advised to update where uncertain.

Full List of Changes

• Updated application PHP dependencies.
• Updated translations with latest Crowdin changes. (#5317)

Links

• Update instructions

Full List of Changes

This release contains the following fixes and changes:

• Updated System CLI with fixes and updated dependencies. (#5312)
• Fixed update-url command not updating revisions & drafts. (#5292)
• Fixed the namespaces of some tests. Thanks to @LordSimal. (#5291, #5071)
• Fixed misaligned user input validation. (#5263)
• Updated setting categories to validate by for existing views, allowing custom categories to be used via the theme system. Thanks to @LachTrip. (#5255, #5251)
• Updated translations with latest Crowdin changes. (#5250)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed /permissions/me request if primary key contains a / (#23990 by @hanneskuettner)
• @directus/api
  • Skipped collection exists check when creating collections and folders (#23991 by @licitdev)

📦 Published Versions

• @directus/app@13.3.2
• @directus/api@23.1.2

✨ New Features & Improvements

• @directus/storage-driver-supabase
  • Added TUS support to the Supabase storage driver (#23958 by @ComfortablyCoding)
• @directus/storage-driver-azure
  • Added TUS support to the Azure storage driver (#23904 by @ComfortablyCoding)
• @directus/storage-driver-cloudinary
  • Added TUS support to the Cloudinary storage driver (#23943 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Added TUS support to the GCS storage driver (#23897 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed disabled state of the "Add File" empty state button for users without permissions (#23947 by @osmandvc)
  • Improved the loading and unloading speed of the data model pages (#23976 by @hanneskuettner)
  • Fix permission generation for Shares (#23716 by @Nitwel)
  • Fixed regression to item count displaying after vue-i18n upgrade (#23973 by @hanneskuettner)
• @directus/api
  • Fix permission generation for Shares (#23716 by @Nitwel)
  • Fixed Cloudinary image preview in the File Library (#23956 by @joselcvarela)
  • Fixed SQL generation for relational sort fields with permissions (#23871 by @hanneskuettner)
  • Fixed invalid legacy permission fetching for comment mentions (#23972 by @licitdev)
• @directus/system-data
  • Fix permission generation for Shares (#23716 by @Nitwel)
• @directus/types
  • Fix permission generation for Shares (#23716 by @Nitwel)

📦 Published Versions

• @directus/app@13.3.1
• @directus/api@23.1.1
• @directus/composables@11.1.3
• create-directus-extension@11.0.5
• @directus/env@3.1.3
• @directus/extensions@2.0.4
• @directus/extensions-registry@2.0.4
• @directus/extensions-sdk@12.1.2
• @directus/memory@2.0.4
• @directus/pressure@2.0.3
• @directus/storage-driver-azure@11.1.0
• @directus/storage-driver-cloudinary@11.1.0
• @directus/storage-driver-gcs@11.1.0
• @directus/storage-driver-s3@11.0.3
• @directus/storage-driver-supabase@2.1.0
• @directus/system-data@2.1.1
• @directus/themes@1.0.3
• @directus/types@12.2.1
• @directus/utils@12.0.3
• @directus/validation@1.0.3

⚠️ Potential Breaking Changes

• @directus/sdk
  • Extracted comments to a separate table (#23612 by @licitdev)

✨ New Features & Improvements

• @directus/app
  • Extracted comments to a separate table (#23612 by @licitdev)
  • Added support for batch editing in M2M and O2M table interfaces (#21241 by @u12206050)
• @directus/api
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/system-data
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/specs
  • Extracted comments to a separate table (#23612 by @licitdev)
• @directus/types
  • Extracted comments to a separate table (#23612 by @licitdev)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed display error when selecting kanban layout for the first time (#23927 by @SP12893678)
  • Ensured elements on login page are correctly truncated when not enough space is available (#23746 by @Julias0)
  • Added condition to only show the "Create Dashboard" if the user has the correct permissions (#23828 by @SP12893678)
  • Added save options to role and policies item pages (#23820 by @ubercj)
  • Hide alias fields in the export sidebar (#23866 by @licitdev)
  • Fixed tags interface to correctly handle reset whitespace option (#23829 by @SP12893678)
  • Ensured new operation can reuse same key as previously deleted one in current flow editing session (#23874 by @SP12893678)
  • Fixed an issue where the WYSIWYG interface would reload with every keystroke if custom formats are given (#23881 by @SP12893678)
  • Updated dependencies (#23819 by @renovate)
  • Fixed pasting of multiple, comma separated numbers into the filter input (#23911 by @hanneskuettner)
• @directus/api
  • Updated dependencies (#23819 by @renovate)
  • Fixed an issue which prevented the deletion of some nested collections when applying a snapshot (#23851 by @DanielBiegler)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
  • Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
  • Fixed an issue where the mail sender is not displayed correctly for instances that use special characters in project name (#23889 by @shaietz)
  • Fixed query time logging leaking memory for failed queries (#23926 by @SP12893678)
  • Added is_indexed to schema snapshot (#23861 by @ComfortablyCoding)
• create-directus-project
  • Updated dependencies (#23819 by @renovate)
• create-directus-extension
  • Updated dependencies (#23819 by @renovate)
• @directus/extensions-sdk
  • Updated dependencies (#23819 by @renovate)
• @directus/memory
  • Updated dependencies (#23819 by @renovate)
• @directus/storage-driver-azure
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-cloudinary
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
  • Fixed the cloudinary storage driver to work again with the server health check (#23821 by @ComfortablyCoding)
• @directus/storage-driver-gcs
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-s3
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage-driver-supabase
  • Updated dependencies (#23819 by @renovate)
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/themes
  • Updated dependencies (#23819 by @renovate)
• @directus/update-check
  • Updated dependencies (#23819 by @renovate)
  • Added missing clear cache method (#23913 by @paescuj)
• @directus/storage-driver-local
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/storage
  • Allow for cachebusting when reading images from cloudinary to use the latest image for preview generation. (#23639 by @Nitwel)
• @directus/sdk
  • Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
  • Improved SDK relation function type (#23877 by @br41nslug)
  • Ensured failing GraphQL requests are properly handled by throwing an error and exposing errors and data information (#22666 by @GuyShane)
• @directus/specs
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/system-data
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/types
  • Consolidated Content Versions with a new delta field under directus_versions (#23612 by @licitdev)
• @directus/extensions
  • Fixed extension-sdk defineHook and defineEndpoint types (#23836 by @br41nslug)

📝 Documentation

• Added missing fields for directus_fields to GraphQL schema, SDK and docs (#23905 by @br41nslug)

📦 Published Versions

• @directus/app@13.3.0
• @directus/api@23.1.0
• @directus/composables@11.1.2
• create-directus-extension@11.0.4
• create-directus-project@11.0.2
• @directus/env@3.1.2
• @directus/errors@1.0.1
• @directus/extensions@2.0.3
• @directus/extensions-registry@2.0.3
• @directus/extensions-sdk@12.1.1
• @directus/memory@2.0.3
• @directus/pressure@2.0.2
• @directus/specs@11.1.0
• @directus/storage@11.0.1
• @directus/storage-driver-azure@11.0.2
• @directus/storage-driver-cloudinary@11.0.3
• @directus/storage-driver-gcs@11.0.2
• @directus/storage-driver-local@11.0.1
• @directus/storage-driver-s3@11.0.2
• @directus/storage-driver-supabase@2.0.2
• @directus/system-data@2.1.0
• @directus/themes@1.0.2
• @directus/types@12.2.0
• @directus/update-check@12.0.2
• @directus/utils@12.0.2
• @directus/validation@1.0.2
• @directus/sdk@18.0.0

New

• Debian 12 and Ubuntu 24.04 with HTTP/3 Support
• Node.js 22 LTS Support
• Translations: Serbian, Georgian

Bug Fixes

• #427 Cannot rename files in file manager
• #430 Comma in cron jobs minute
• #434 I think this should be a bug
• Translation Fixes

New

• Translations: Bosnian

Enhancements

• The issuance of Let's Encrypt certificates is being tested against the staging environment first to avoid rate limit errors
• The performance of creating sites, especially Node.js sites, has been enhanced

Bug Fixes

• #382 phpMyAdmin sorting not working
• #383 Instance Reboot at Admin/Instance/Setting doesn't reboot and block auto login from login pages
• #406 CloudPanel Dashboard doesn't when using the AWS EC2 installer.
• Translation Fixes

Security

• Vulnerability that allows a user with the lowest privilege to conduct a session hijacking, subsequently gaining unauthorized access to the admin and other user accounts. (Muhammad Aizat, datack.my)

New

• PHP 8.3 Support
• Node.js 20 LTS Support
• Translations: Danish, Czech

Enhancements

• The databases are backed up prior to executing remote backup
• The site settings and vhost are being included in the remote backup file
• Updated phpMyAdmin to 5.2.1

Bug Fixes

• #329 duplicate settings key in file-manager.conf
• #338 The original certificate is not removed when you delete a web application
• #355 Login Page Autocomplete/Password Manager Issue
• #359 When you delete a website the nodejs app started with PM2 is not deleted
• #367 phpMyAdmin basic auth doesn't work when CloudPanel basic auth is enableds

Security

• File Manager: New file chown issue (CVE-2023-43880)
• File Manager: Zip symlink (BSDTAR) (CVE-2023-43881)
• Command Injection (Yell Phone Naing)

New

• Translation: Koran, Persian

Enhancements

• Vietnamese, Chinese Translation
• RTL stylesheet improvements

Security

• [#298 MySQL Root Password Leak from site user (Thanks to Yell Phone Naing)](#298)
• Critical: Privilege Escalation to root from user (Thanks to Yell Phone Naing)

Bug Fixes

• #287 Colon in remote cloud backup breaks most filesystems
• #290 File Manager Extract not working since v2.3.0
• #293 Strange \n\n inside the certificate file used for custom domain.
• Translation Fixes

Security

• Critical (CVE-2023-35885): Insecure file manager cookie authentication (Muhammad Aizat, datack.my)
• Insecure File Upload leads to Privilege Escalation and Authentication Bypass (Muhammad Zulfiqar)

New

• Translations: Bulgarian
• New CloudPanel CLI Root Commands:
  • User:
    • user:add
    • user:delete
    • user:list
  • Site:
  • site:install:certificate

Enhancements

• The site user name and password can be entered manually for new WordPress sites.

Bug Fixes

• #278 CLI need normalize domain name field
• #284 CLPCTL - Problem with special characters in password result false error
• Translation Fixes

Security

• Critical (CVE-2023-33747): Privilege Escalation to root from user, big thanks to Muhammad (datack.my, host.sabily.info) for reporting and testing
• OS Command Injection, big thanks to Laurence from crowdsec.net for reporting and testing

New

• MariaDB 10.11 LTS Support
• Hebrew
• Japanese

Bug Fixes

• #245 Dark mode: Separating table borders missing
• #254 Site path / copy and paste issues
• Translation Fixes

New

• Reverse Proxy
• Chinese (Simplified)
• Chinese (Taiwan)

Bug Fixes

• #210 Dark mode: Separating table borders missing
• #220 Hetzner Snapshot cleanup throws an exception when delete protection is enabled on a snapshot
• Translation Fixes

New

• Add PHP 8.2 Support
• Dark Mode
• Node.js 18 LTS Support

Improvements

• File Manager order Directories before Files

Bug Fixes

• #208 Unable to create a WordPress site with a database server that doesn't use the default port 3306
• Translation Fixes

New

• Varnish Cache Support

Improvements

• Generate Password Link for Site User Password Update

Bug Fixes

• #138 WordPress Admin login doesn't work with passwords which contains special characters like
• #150 Cron Job PHP version issue
• #153 Backup Custom Rclone Config Time
• Translation Fixes

⚠️ Potential Breaking Changes

• @directus/api
  • Dropped support for the SendGrid email transport option (#23392 by @McSundae)

✨ New Features & Improvements

• @directus/types
  • Add Prettify type helper (#23714 by @hanneskuettner)
• @directus/extensions-sdk
  • Added support for disabling terminal screen clearing on rebuild in watch mode (#23556 by @GuyShane)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Fixed empty preview in Markdown interface (#23599 by @joselcvarela)
  • Fixed spacing of expand/collapse button in the data model view (#23581 by @formfcw)
  • Fixed dialog/drawer order when creating a bookmark in the collection view (#23505 by @hanneskuettner)
  • Fixed SVG truncation issue in image interface preview (#23389 by @SP12893678)
  • Fixed an issue that would cause custom role names to not be translated in the role navigation sidebar (#23651 by @SP12893678)
  • Fixed WYSIWYG interface to be updated when interface options are changed via conditions (#23773 by @SP12893678)
  • Improved behavior of the translations interface when setting 'use users language' option (#23597 by @SP12893678)
  • Fixed an issue blocking collection view after switching between Kanban bookmarks (#23774 by @hanneskuettner)
  • Improved calendar layout styling to be more consistent (#23550 by @formfcw)
  • Updated dependencies (#23796 by @renovate)
  • Ensured data in sidebar is re-fetched when switching pages while a sidebar pane is already opened (#23553 by @SP12893678)
  • Ensured errors occured within the cards layout are always shown (#23802 by @SP12893678)
  • Fixed format warnings in api/src/request/is-denied-ip.ts and app/src/interfaces/input-rich-text-html/input-rich-text-html.vue (#23584 by @ComfortablyCoding)
  • Fixed an issue that would cause log streaming to fail on Directus installations that use a subpath in the URL (#23569 by @JoshTheDerf)
  • Fixed an issue that could cause the color picker interface to crash when a invalid color was used and improved the UX of interacting with the text input of the color picker interface. (#23654 by @connorwinston)
  • Ensured users are redirected to the intended page after login via LDAP (#23788 by @mmsardar)
  • Fixed failing validation of $CURRENT_POLICIES and $CURRENT_ROLES in the filter interface (#23730 by @hanneskuettner)
  • Fixed the truncation of long collection names in the permission configuration interface (#23700 by @hanneskuettner)
• @directus/api
  • Updated dependencies (#23796 by @renovate)
  • Fixed format warnings in api/src/request/is-denied-ip.ts and app/src/interfaces/input-rich-text-html/input-rich-text-html.vue (#23584 by @ComfortablyCoding)
  • Fixed unit tests for get-address util (#23583 by @ComfortablyCoding)
  • Fixed injection of the $CURRENT_POLICIES into permissions (#23728 by @hanneskuettner)
  • Added option to sync SSO user information on login for LDAP, OpenID and OAuth2 (#23595 by @br41nslug)
  • Fixed an issue enforcing database specific Primary Key constraints on field updates for all vendors (#23706 by @ComfortablyCoding)
  • Added optional ignoreRules option to Schema Apply CLI (#23465 by @keesvanbemmel)
  • Fixed authentication handling between logs streaming and regular websocket connections (#23691 by @br41nslug)
• create-directus-project
  • Updated dependencies (#23796 by @renovate)
• @directus/components
  • Updated dependencies (#23796 by @renovate)
• @directus/extensions-registry
  • Updated dependencies (#23796 by @renovate)
• @directus/release-notes-generator
  • Updated dependencies (#23796 by @renovate)
• @directus/stores
  • Updated dependencies (#23796 by @renovate)
• @directus/storage-driver-s3
  • Updated dependencies (#23796 by @renovate)
• @directus/themes
  • Updated dependencies (#23796 by @renovate)
• @directus/update-check
  • Updated dependencies (#23796 by @renovate)
• @directus/utils
  • Updated dependencies (#23796 by @renovate)
• @directus/env
  • Added option to sync SSO user information on login for LDAP, OpenID and OAuth2 (#23595 by @br41nslug)
• @directus/sdk
  • Fixed the precedence of withToken if a token is already saved in the SDK instance (#23739 by @hanneskuettner)
  • Made the output types of SDK requests better readable in IDEs (#23494 by @fapspirit)
• @directus/schema
  • Fixed an issue that would cause a server crash on unexpected PostgreSQL database schema contents (#23664 by @rijkvanzanten)
• @directus/extensions-sdk
  • Prevented nesting bundle extensions via the extensions-sdk add command (#23663 by @ComfortablyCoding)
• @directus/extensions
  • Improve defineX typings to properly type the known config options (#23714 by @hanneskuettner)

📝 Documentation

• Fixed a typo in the docs (#23585 by @rijkvanzanten)

📦 Published Versions

• @directus/app@13.2.1
• @directus/api@23.0.0
• @directus/components@1.0.1
• @directus/composables@11.1.1
• create-directus-extension@11.0.3
• create-directus-project@11.0.1
• @directus/env@3.1.1
• @directus/extensions@2.0.2
• @directus/extensions-registry@2.0.2
• @directus/extensions-sdk@12.1.0
• @directus/memory@2.0.2
• @directus/pressure@2.0.1
• @directus/release-notes-generator@1.0.1
• @directus/schema@12.1.1
• @directus/storage-driver-azure@11.0.1
• @directus/storage-driver-cloudinary@11.0.2
• @directus/storage-driver-gcs@11.0.1
• @directus/storage-driver-s3@11.0.1
• @directus/storage-driver-supabase@2.0.1
• @directus/stores@1.0.1
• @directus/themes@1.0.1
• @directus/types@12.1.0
• @directus/update-check@12.0.1
• @directus/utils@12.0.1
• @directus/validation@1.0.1
• @directus/sdk@17.0.2

✨ New Features & Improvements

• @directus/app
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
  • Ensured the opened detail in the sidebar is persisted across site navigation and reloads (per browser tab) (#23383 by @Dominic-Marcelino)
  • Added a system interface for showing a password field with visibility toggle (#23387 by @AlexGaillard)
  • Added item count to the notification drawer (#23414 by @Dominic-Marcelino)
  • Implemented selection mode for kanban layouts (#23489 by @hanneskuettner)
  • Added default view option to the markdown interface to select which view should be shown by default (#23353 by @hanneskuettner)
• @directus/api
  • Implemented logs websocket (#23016 by @licitdev)
  • Introduced the USER_INVITE_TOKEN_TTL option, allowing to configure the expiration of user invitations (#22986 by @matt-rolley)
  • Fixed OracleDB error when updating nullable option with the same value as before (#23436 by @jaads)
  • Enabled gen_random_uuid() to be used as default value for a field (#23359 by @jaads)
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
• @directus/env
  • Implemented logs websocket (#23016 by @licitdev)
• @directus/schema
  • Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)

🐛 Bug Fixes & Optimizations

• @directus/app
  • Ensured notifications are reloaded after manually running a Flow to provide users with the latest notifications generated by the Flow (#23381 by @Dominic-Marcelino)
  • Ensured warning about unsaved changes is displayed for Flows with custom confirmation config too (#23408 by @Dominic-Marcelino)
  • Improved selection label of the "New Tab" checkbox in the html rich text editor (#23502 by @simboonlong)
  • Added notice in notifications drawer when no items are found due to applied search/filter (#23428 by @paescuj)
  • Fixed styling issues with the related-values display (#21854 by @formfcw)
  • Added system logs to the app (#23066 by @licitdev)
  • Fixed the "Archive All" notifications functionality (#23411 by @Dominic-Marcelino)
  • Fixed a syntax error that did not correctly apply the border for the v-chip component (#23540 by @formfcw)
  • Prevented a crash in the Data Studio when switching to the "Date" type while configuring Datetime interface (#23384 by @SP12893678)
  • Dropped unused translations (#23503 by @hanneskuettner)
  • Fixed the image tune menu toggle state indication in the block editor interface (#23510 by @HeikoMueller)
  • Ensured the notifications unread count is updated when un-/archiving notifications (#23407 by @paescuj)
  • Improved the grid layout for radio and checkboxes interface (#23358 by @SP12893678)
• @directus/api
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
  • Fixed server address undefined for graphql and websocket logs (#23488 by @ComfortablyCoding)
  • Fixed the length of icon fields in system collections, allowing to use icons with longer names (#23391 by @SP12893678)
  • Fixed SQL query generation for MSSQL queries that use field level permissions and sort (#23518 by @hanneskuettner)
  • Fixed the preprocessing of SQL bindings that is necessary to deduplicate identical value bindings for some SQL dialects (#23453 by @joselcvarela)
  • Fixed an issue that could cause the response cache to misbehave (769fa22 by @rijkvanzanten)
  • Fixed an issue that would cause local extensions built via workspaces to not be watched when extensions reload is active (#23100 by @bernatvadell)
  • Fixed the email.send filter to be usable in Flows in conjunction with the "Run Script" operation (#23446 by @joselcvarela)
  • Fixed the generated OpenAPI specs to include POST, PATCH and DELETE paths again (#23460 by @u12206050)
  • Fixed an issue where creating notifications could hang on SQLite (#23405 by @paescuj)
• @directus/memory
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
• @directus/env
  • Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
  • Fixed server address undefined for graphql and websocket logs (#23488 by @ComfortablyCoding)
  • Expanded 0.0.0.0 matching of loopback ranges (8cbf943 by @br41nslug)
  • Introduced the USER_INVITE_TOKEN_TTL option, allowing to configure the expiration of user invitations (#22986 by @matt-rolley)
• @directus/sdk
  • Fixed an outdated property name in the permissions typing (#23380 by @EdouardDem)
  • Fix DirectusPolicy typescript declaration (#23442 by @Lfillon)
  • Reset attempts after reconnection failure (#23016 by @licitdev)
• @directus/specs
  • Fixed a duplicate operationId (d90d1bd by @rijkvanzanten)
• @directus/storage-driver-cloudinary
  • Fixed an issue that could cause cloudinary to throw an inconsistent chunk size (#23554 by @AndriyStankevych)

📝 Documentation

• Implemented logs websocket (#23016 by @licitdev)
• Fixed an issue that would prevent extensions from loading (#23492 by @rijkvanzanten)
• Added support for creating database indexes on fields (#23149 by @ComfortablyCoding)
• Fixed missing import in auth example (#23490 by @rijkvanzanten)

📦 Published Versions

• @directus/app@13.2.0
• @directus/api@22.2.0
• create-directus-extension@11.0.2
• @directus/env@3.1.0
• @directus/extensions@2.0.1
• @directus/extensions-registry@2.0.1
• @directus/extensions-sdk@12.0.2
• @directus/memory@2.0.1
• @directus/schema@12.1.0
• @directus/specs@11.0.1
• @directus/storage-driver-cloudinary@11.0.1
• @directus/types@12.0.1
• @directus/sdk@17.0.1