Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@wbce-d9/app@11.1.0

Minor Changes

• #432
  d4d8aa9 - The Project Color
  from Settings is now the primary color of the whole admin UI (buttons, links, toggles, focus rings, selections), not
  only of the logo and favicon. --primary and its shades are derived from it with CSS color-mix(), using the same
  mixing rules as the built-in palette, in the light and dark themes. Without a project color, or in browsers without
  color-mix(), the built-in purple palette is used as before.

@wbce-d9/api@12.6.1

Patch Changes

• #427
  7956e59 - security: hash
  fields are now concealed on read, like conceal fields, so their value is no longer stored in clear text
  (GHSA-mvv8-v4jj-g47j, CVE-2026-39943) in revisions when an item is created, and their hash is no longer returned by
  the API (GHSA-mvv8-v4jj-g47j).

• #425
  7e04036 - security: fields
  with the conceal special can no longer be used with value-returning aggregate functions (min,
  (GHSA-38hg-ww64-rrwc, CVE-2026-35442, GHSA-8jpw-gpr4-8cmh, CVE-2025-64748) max, sum, avg, …)
  (GHSA-38hg-ww64-rrwc / CVE-2026-35442) and are excluded from search (GHSA-8jpw-gpr4-8cmh / CVE-2025-64748), to prevent
  extracting their values

• #429
  90fb2e7 - security: deleting a
  field now removes it from the permissions of its collection, so a field later created with the same
  (GHSA-9x5g-62gj-wqf2, CVE-2025-64746) name no longer inherits the deleted field's access (GHSA-9x5g-62gj-wqf2 /
  CVE-2025-64746)

• #426
  3a76a3a - security: the
  OpenAPI specification served by /server/specs/oas now only exposes the exact running version in
  (GHSA-rmjh-cf9q-pv7q) info.version to admins, like /server/info; other users get 0.0.0-hidden
  (GHSA-rmjh-cf9q-pv7q)

• #424
  2c9fefc - security: manual
  Flow triggers now require read access to the Flow and to the target collection / items (GHSA-7cvf-pxgp-42fc,
  CVE-2025-53889) (GHSA-7cvf-pxgp-42fc / CVE-2025-53889)

• Updated dependencies
  [d4d8aa9]:

  • @wbce-d9/app@11.1.0

@wbce-d9/directus9@12.0.21

Patch Changes

• Updated dependencies [7956e59,
  7e04036,
  90fb2e7,
  3a76a3a,
  2c9fefc]:
  • @wbce-d9/api@12.6.1