LaWebcapsule/d9 v12.0.27

on GitHub

Security

• #501 8a9c8dc - security: bump joi to 18.3.2 (GHSA-4528-x5fx-h6hg / CVE-2026-118772)
• #501 8a9c8dc - security: bump qs to 6.16.1 (GHSA-6pq8-jhm2-2vcw / CVE-2026-110816)
• #504 106f4e4 - security: upgrade vue-i18n from 9 to 11 (GHSA-83rm-6c8r-g728 / CVE-2026-118257, GHSA-8rc2-428q-7ww3 / CVE-2026-118256)
• #502 9ff7fbf - security: upgrade the WYSIWYG editor to TinyMCE 8.10.1 (GHSA-mf2p-h6hf-fcwm / CVE-2026-116675)
• #507 36e451f - security: upgrade zod from 3 to 4 (GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404)
• #505 4147402 - security: replace unmaintained rollup-plugin-styles with rollup-plugin-styler 3.0.1 (drops vulnerable decode-uri-component, GHSA-qr28-fpjm-wq7f / GHSA-vcc3-ghjq-m6fr)

@wbce-d9/api 12.8.0

Minor Changes

• #499
  da52f9f - Added Live Preview,
  ported from Directus 10.2 (GPLv3): set a Preview URL template in a collection's settings to show the item's page of
  your website next to the item form, or in a separate window. The preview reloads on save, and only http(s) URLs are
  previewed. {{$lang}} in the Preview URL inserts the language being edited in the item's translations field.

Patch Changes

• #501
  8a9c8dc - security: bump joi
  to 18.3.2 (GHSA-4528-x5fx-h6hg / CVE-2026-118772)

• #501
  8a9c8dc - security: bump qs to
  6.16.1 (GHSA-6pq8-jhm2-2vcw / CVE-2026-110816)

• #490
  f5d3826 - Register
  directus_sessions.session_id, directus_sessions.fallback_token and directus_activity.session_id as system fields
  so schema snapshots no longer export them and schema apply can no longer drop them, and ignore system fields listed in
  snapshots from older versions so those snapshots still apply (#478)

• Updated dependencies [8a9c8dc,
  da52f9f,
  b25f94e,
  4147402,
  9ff7fbf,
  106f4e4,
  36e451f]:

  • @wbce-d9/utils@10.0.6
  • @wbce-d9/app@11.4.0
  • @wbce-d9/specs@9.27.0
  • @wbce-d9/schema@10.0.1
  • @wbce-d9/extensions-sdk@10.1.1
  • @wbce-d9/constants@10.0.1
  • @wbce-d9/storage-driver-azure@10.0.6
  • @wbce-d9/storage-driver-cloudinary@10.0.8
  • @wbce-d9/storage-driver-gcs@10.0.6
  • @wbce-d9/storage-driver-local@10.0.6
  • @wbce-d9/storage-driver-s3@10.0.7
  • @wbce-d9/exceptions@10.0.1

@wbce-d9/app 11.4.0

Minor Changes

• #499
  da52f9f - Added Live Preview,
  ported from Directus 10.2 (GPLv3): set a Preview URL template in a collection's settings to show the item's page of
  your website next to the item form, or in a separate window. The preview reloads on save, and only http(s) URLs are
  previewed. {{$lang}} in the Preview URL inserts the language being edited in the item's translations field.

• #504
  106f4e4 - security: upgrade
  vue-i18n from 9 to 11 (GHSA-83rm-6c8r-g728 / CVE-2026-118257, GHSA-8rc2-428q-7ww3 / CVE-2026-118256)

  App extensions share the app's vue-i18n: an extension calling tc or $tc, removed in vue-i18n 11, must call t
  with the plural count instead. A translation that can't be compiled, such as one containing an email address, is still
  shown as is.

Patch Changes

• #502
  9ff7fbf - security: upgrade
  the WYSIWYG editor to TinyMCE 8.10.1 (GHSA-mf2p-h6hf-fcwm / CVE-2026-116675)

  TinyMCE 8 sanitizes content more strictly: HTML comments that contain tags and attributes with HTML-like values may be
  removed when content is opened in the editor.

• Updated dependencies []:

  • @wbce-d9/composables@10.0.6

@wbce-d9/constants 10.0.1

Patch Changes

• #507
  36e451f - security: upgrade
  zod from 3 to 4 (GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404)

  The extension schemas exported by this package (ExtensionManifest, ExtensionOptions, …) are now zod 4 schemas.

@wbce-d9/extensions-sdk 10.1.1

Patch Changes

• #505
  4147402 - security: replace
  unmaintained rollup-plugin-styles with rollup-plugin-styler 3.0.1 (drops vulnerable decode-uri-component,
  GHSA-qr28-fpjm-wq7f / GHSA-vcc3-ghjq-m6fr)
• Updated dependencies [8a9c8dc,
  da52f9f,
  b25f94e,
  36e451f]:
  • @wbce-d9/utils@10.0.6
  • @wbce-d9/types@10.2.0
  • @wbce-d9/constants@10.0.1
  • @wbce-d9/composables@10.0.6

@wbce-d9/schema 10.0.1

Patch Changes

• #506
  b25f94e - Built with
  TypeScript 5.9: primary() of the CockroachDB, Oracle and MSSQL schema inspectors is now typed as returning
  string | null, as it returns null when there is no primary key, and optionToObject is typed
  (option: T | string) => T

@wbce-d9/specs 9.27.0

Minor Changes

• #499
  da52f9f - Added Live Preview,
  ported from Directus 10.2 (GPLv3): set a Preview URL template in a collection's settings to show the item's page of
  your website next to the item form, or in a separate window. The preview reloads on save, and only http(s) URLs are
  previewed. {{$lang}} in the Preview URL inserts the language being edited in the item's translations field.

@wbce-d9/types 10.2.0

Minor Changes

• #499
  da52f9f - Added Live Preview,
  ported from Directus 10.2 (GPLv3): set a Preview URL template in a collection's settings to show the item's page of
  your website next to the item form, or in a separate window. The preview reloads on save, and only http(s) URLs are
  previewed. {{$lang}} in the Preview URL inserts the language being edited in the item's translations field.

@wbce-d9/utils 10.0.6

Patch Changes

• #501
  8a9c8dc - security: bump joi
  to 18.3.2 (GHSA-4528-x5fx-h6hg / CVE-2026-118772)

• #506
  b25f94e - Built with
  TypeScript 5.9: primary() of the CockroachDB, Oracle and MSSQL schema inspectors is now typed as returning
  string | null, as it returns null when there is no primary key, and optionToObject is typed
  (option: T | string) => T

• Updated dependencies
  [36e451f]:

  • @wbce-d9/constants@10.0.1

Dependency updates only: @wbce-d9/directus9@12.0.27 @wbce-d9/composables@10.0.6 @wbce-d9/create-directus-extension@9.26.20 @wbce-d9/storage-driver-azure@10.0.6 @wbce-d9/storage-driver-cloudinary@10.0.8 @wbce-d9/storage-driver-gcs@10.0.6 @wbce-d9/storage-driver-local@10.0.6 @wbce-d9/storage-driver-s3@10.0.7