What directus/directus shipped

Directus 12.6.1 is out. The WYSIWYG editor keeps custom link protocols and preserves div and source markup, sandboxed request scopes are enforced on redirects, and login redirects reject protocol-relative paths. Run Script and many-to-many list search got fixes too.

Directus 12.6.1 is out. The WYSIWYG editor now has an Allowed Link Protocols option so links with custom schemes are kept, keeps div attributes when converting to a paragraph, and can keep bold and italic source markup. Sandboxed extensions have their request URL scopes enforced on redirects, and login redirect validation now rejects protocol-relative paths. Run Script no longer fails when flow data contains errors, Environment Sync covers global and role presets, and many-to-many list search matches the related fields shown in the table.

V12.6.0 is out with updated default AI model lists and deprecated models removed. This week also adds a richtext extension type for WYSIWYG fields, fixes directus init and mssql bootstrap, stops a DOMPurify hook leak, and shows license warnings in the sidebar.

V12.6.0 shipped this week with updated default allowed AI models and removed deprecated LLM models, so check your AI assistant settings. A new richtext extension type lets extensions add Tiptap nodes, marks and toolbar buttons to WYSIWYG fields. Setup and operations fixes include directus init no longer failing before.env is written and mssql bootstrapping working. License warnings now show in the sidebar. Smaller changes reduce re-renders in table selection and skip the public page shader on narrow screens.

V12.5.1 is out with dependency bumps. Flows now send only changed fields on save and stay in sync between editor and drawer. SDK form-data requests keep their multipart content type. A Default Exports Folder setting is added. GET and HEAD requests now return 405.

Directus v12.5.1 is out with dependency updates for the app and api. Flow saves now send only changed fields, so editing an existing flow no longer fails with a limit exceeded error, and flow status stays in sync between the editor and the settings drawer. Other fixes: SDK custom endpoint requests with FormData bodies no longer default to JSON, duplicate scrollbars are gone from the rich-text formats dropdown, and authenticated GET and HEAD requests now return 405 instead of 500. New this week: a Default Exports Folder project setting, and telemetry URL defaults moving to telemetry.directus.com.

V12.5.0 is out, with TFA enforcement using effective permissions and IP allow list policies. This week also fixed schema building after a stopped process, a retention schedule foreign key violation, and setDeep walking into an inherited proto.

V12.5.0 is out. TFA enforcement now uses effective permissions and accounts for policies with an IP allow list, and a failed license request now keeps the current license in effect and is retried. License states are also exposed to the app, keys are no longer discarded on auto failure states, and downgrades only happen when explicitly requested. This week fixed requests failing after a process was stopped during schema building, a foreign key violation in the retention schedule when a revision's parent was already deleted, and setDeep walking into an inherited proto. The module navigation also keeps its scroll position across route changes now, and Norwegian date-fns time formats were corrected.

This week: public policy warnings, bulk flow toggling, TFA effective permissions, safer richtext extensions, GraphQL type fixes, and cache performance gains.

Notable fixes in this week's Directus update: confirmation dialogs and warnings when editing public policies for better security awareness, bulk actions for flows, proper TFA enforcement with inherited permissions, isolated richtext extensions to prevent editor breakage, GraphQL type corrections for NOT NULL fields with defaults and geometry subtypes, improved cache performance with Redis hash support, and keyboard focus accessibility for tooltips.

Directus 12.4.0 is out. Flows get their own module, images in WYSIWYG can now link, preview URLs are configurable, and startup is faster. MapLibre GL JS upgraded to v6.9.0 (WebGL2 required).

Directus 12.4.0 is available. This release reorganizes Flows into a dedicated top-level module with folder support, adds configurable preview base URLs, enables linking in WYSIWYG image blocks, and improves startup performance by eliminating lock contention during boot. We also upgraded MapLibre GL JS to v6.9.0, which requires WebGL2 support. Oracle users benefit from fixes to year() and JSON comparison functions.

This week: Flows gets its own module, blackbox tests migrate to E2E, disabled collections handled properly, relational export ordering fixed, and maplibre-gl updated to v6.

This week's updates bring significant improvements to Directus. Flows is now a dedicated module with full folder support. The test infrastructure fully migrated to E2E, providing better coverage. Critical fixes ensure relational fields export in correct order, block editors render smoothly, and concurrent KV operations work reliably. Infrastructure updates replace MinIO with RustFS and modernize maplibre-gl to v6.