LaWebcapsule/d9 v12.0.21

on GitHub

Security

• #427 7956e59 - security: hash fields are now concealed on read, like conceal fields, so their value is no longer stored in clear text (GHSA-mvv8-v4jj-g47j, CVE-2026-39943) in revisions when an item is created, and their hash is no longer returned by the API (GHSA-mvv8-v4jj-g47j).
• #425 7e04036 - security: fields with the conceal special can no longer be used with value-returning aggregate functions (min, (GHSA-38hg-ww64-rrwc, CVE-2026-35442, GHSA-8jpw-gpr4-8cmh, CVE-2025-64748) max, sum, avg, …) (GHSA-38hg-ww64-rrwc / CVE-2026-35442) and are excluded from search (GHSA-8jpw-gpr4-8cmh / CVE-2025-64748), to prevent extracting their values
• #429 90fb2e7 - security: deleting a field now removes it from the permissions of its collection, so a field later created with the same (GHSA-9x5g-62gj-wqf2, CVE-2025-64746) name no longer inherits the deleted field's access (GHSA-9x5g-62gj-wqf2 / CVE-2025-64746)
• #426 3a76a3a - security: the OpenAPI specification served by /server/specs/oas now only exposes the exact running version in (GHSA-rmjh-cf9q-pv7q) info.version to admins, like /server/info; other users get 0.0.0-hidden (GHSA-rmjh-cf9q-pv7q)
• #424 2c9fefc - security: manual Flow triggers now require read access to the Flow and to the target collection / items (GHSA-7cvf-pxgp-42fc, CVE-2025-53889) (GHSA-7cvf-pxgp-42fc / CVE-2025-53889)

@wbce-d9/api 12.6.1

Patch Changes

• #427
  7956e59 - security: hash
  fields are now concealed on read, like conceal fields, so their value is no longer stored in clear text
  (GHSA-mvv8-v4jj-g47j, CVE-2026-39943) in revisions when an item is created, and their hash is no longer returned by
  the API (GHSA-mvv8-v4jj-g47j).

• #425
  7e04036 - security: fields
  with the conceal special can no longer be used with value-returning aggregate functions (min,
  (GHSA-38hg-ww64-rrwc, CVE-2026-35442, GHSA-8jpw-gpr4-8cmh, CVE-2025-64748) max, sum, avg, …)
  (GHSA-38hg-ww64-rrwc / CVE-2026-35442) and are excluded from search (GHSA-8jpw-gpr4-8cmh / CVE-2025-64748), to prevent
  extracting their values

• #429
  90fb2e7 - security: deleting a
  field now removes it from the permissions of its collection, so a field later created with the same
  (GHSA-9x5g-62gj-wqf2, CVE-2025-64746) name no longer inherits the deleted field's access (GHSA-9x5g-62gj-wqf2 /
  CVE-2025-64746)

• #426
  3a76a3a - security: the
  OpenAPI specification served by /server/specs/oas now only exposes the exact running version in
  (GHSA-rmjh-cf9q-pv7q) info.version to admins, like /server/info; other users get 0.0.0-hidden
  (GHSA-rmjh-cf9q-pv7q)

• #424
  2c9fefc - security: manual
  Flow triggers now require read access to the Flow and to the target collection / items (GHSA-7cvf-pxgp-42fc,
  CVE-2025-53889) (GHSA-7cvf-pxgp-42fc / CVE-2025-53889)

• Updated dependencies
  [d4d8aa9]:

  • @wbce-d9/app@11.1.0

@wbce-d9/app 11.1.0

Minor Changes

• #432
  d4d8aa9 - The Project Color
  from Settings is now the primary color of the whole admin UI (buttons, links, toggles, focus rings, selections), not
  only of the logo and favicon. --primary and its shades are derived from it with CSS color-mix(), using the same
  mixing rules as the built-in palette, in the light and dark themes. Without a project color, or in browsers without
  color-mix(), the built-in purple palette is used as before.

Dependency updates only: @wbce-d9/directus9@12.0.21