Document Directus 12.2.0 - #792
Merged
Merged
Conversation
Verified against the v12.2.0 tag rather than the release notes, which contradict themselves on the IMPORT_MAX_FILE_SIZE default. The breaking changes page listed only the WYSIWYG migration. Added the remaining six: - App Access policies now read a limited set of directus_settings fields. Existing policies are untouched, so pre-12.2.0 policies still expose the AI provider keys - Imports capped at 50mb (IMPORT_MAX_FILE_SIZE), which also caps schema snapshot uploads to /schema/diff and /schema/apply - Image transformation output capped at 3000px - Valueless boolean query flags now count as true, affecting ?background on import and ?force on /schema/apply. /schema/diff changed the opposite way: it tested key presence, so ?force=false previously still forced - SDK schemaDiff now takes an options object rather than a positional force argument - DeploymentProjectsService.readByExternalId now takes a deployment ID Also: - Documented the new Default Save Action project setting, along with the save action menu, which was previously undocumented apart from Save as Copy - Corrected the IMPORT_MAX_FILE_SIZE default from "no limit" to 50mb - Noted read exposure of the AI provider keys in the security best practices, which previously covered only write access - Dropped the pre-publication TODOs now that v12.2.0 has shipped The schema migration tutorial updates for the new snapshot and diff parameters are on chrisjennings/fix-schema-migration-tutorial. POST /utils/import is intentionally not documented. It is API-only with no Studio UI, so it belongs in the generated API reference rather than the content module guide. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The Imports table documented a variable that does not exist, two wrong defaults, and omitted one variable entirely. Verified against packages/env/src/constants/defaults.ts at v12.2.0. Corrections. These were also wrong in v12.1.1, so they are not regressions from a recent release: - IMPORT_CONCURRENT_MAX does not exist. The code reads IMPORT_MAX_CONCURRENCY (api/src/services/import/import.ts), and its default is 20 rather than 10. A documented name the code never reads silently does nothing when set - IMPORT_TIMEOUT defaults to 1h, not 1m. Also noted that the budget is shared across receiving and parsing an upload, so the effective wall clock is not twice the value - IMPORT_EXPORT_NAMESPACE defaults to directus:import-export, not import-export - Fixed the "simultainous" typo Addition: - IMPORT_MAX_FILE_SIZE, new in v12.2.0, was missing from this table. Added as a pointer row so the Imports section covers every import variable. Its full description, including the 413 response and the fact that it also caps schema snapshot uploads, lives in Security & Limits alongside MAX_IMPORT_ERRORS. content/releases/3.breaking-changes/2.version-11.md already documented IMPORT_TIMEOUT as 1 hour and IMPORT_MAX_CONCURRENCY as 20 under the correct name, so that page has been contradicting this table. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…ennings/update-for-v12-2-0
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Member
Yes, although not their values as those are still masked. The reduction was for other fields that were exposed and "may" expose sensitive info, somewhat already covered by the be careful what read permissions one gives to core tables
This should be fine as this notice pertains to v12.2.0 if changed in the future that adjustment will be mentioned there. Any live link will have the potential to break if the file moved.
Not a bad idea, possibly some drift over time as observed here. Out of scope for this PR though. |
Co-authored-by: judda <44623501+ComfortablyCoding@users.noreply.github.com>
Co-authored-by: judda <44623501+ComfortablyCoding@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents v12.2.0 and fixes env var docs that no longer match source. Verified against the
v12.2.0tag rather than the release notes.The breaking changes page had only the WYSIWYG entry. Added the other six: App Access settings fields, the 50mb import cap, the 3000px transform cap, valueless query flags, the SDK
schemaDiffsignature, andreadByExternalId.Also new: a Saving Items section covering the save menu and the new Default Save Action setting (settings.yaml).
The Imports env table now matches defaults.ts:
IMPORT_CONCURRENT_MAXdoesn't exist (it'sIMPORT_MAX_CONCURRENCY, default 20), andIMPORT_TIMEOUTis1hnot1m. Both were wrong in v12.1.1 too, andcontent/releases/3.breaking-changes/2.version-11.md:11already documented them correctly.Questions
1. Do pre-12.2.0 App Access policies still expose the AI provider keys? #27996 added a field allowlist and the changeset says existing policies are untouched. If so, every older policy still grants read on
ai_openai_api_keyand friends until an admin scopes it, and upgrading doesn't fix it. It's written as an audit instruction on that basis. If that's right, does it also belong in the upgrading guide, or a security advisory?2. The 21 allowlisted field names are listed verbatim. Better to link the YAML? Verbatim helps someone auditing a policy but will drift.
3. Want a full env var audit? I only checked the import family. That one table had three wrong values in three rows.
Notes
Merge
chrisjennings/update-schema-migration-tutorialfirst or together — the changelog links to it.