ChristopherJennings · Oct 28, 2026
@@ -15,7 +15,13 @@ This is specifically for contributing to the codebase of Directus. To run Direct
 
 You will need to have the [current LTS version of Node.js](https://nodejs.org/en/download) for the development environment of Directus. Check the `engines.node` field in the [main repository's package.json](https://github.com/directus/directus/blob/main/package.json) for the exact version requirement.
 
-You will also need to have the package manager [pnpm](https://pnpm.io) installed. It's recommended to install [pnpm via Corepack](https://pnpm.io/installation#using-corepack) for automatic use of the correct version.
+You will also need to have the package manager [pnpm](https://pnpm.io) installed, in the version set by the `packageManager` field of the same `package.json`. Install it with npm, replacing `<version>` with that version:
+
+```bash
+npm install --global pnpm@<version>
+```
+
+`pnpm install` refuses to run on an older Node.js or pnpm version than the repository requires.
 
 ##  Install Dependencies and Build
 

@@ -21,7 +21,7 @@ Based on your project's needs, you can extend the `LOGGER_*` environment variabl
 | --------------------- | ---------------------------------------------------------------------------------------------------------------- | ------------- |
 | `RETENTION_ENABLED`   | Whether or not to enable custom data retention settings. `false` will not delete data.                           | `false`       |
 | `RETENTION_SCHEDULE`  | The cron schedule at which to check for removable records, the default is once a day at 00:00.                   | `0 0 * * *`   |
-| `RETENTION_BATCH`     | The maximum number of records to delete in a single query.                                                       | `500`         |
+| `RETENTION_BATCH`     | The maximum number of records to delete in a single query. Must be a positive integer, otherwise retention is disabled and an error is logged. Values above your database's query binding limit are capped, for example to `999` on Oracle and `2097` on MS SQL Server. | `500`         |
 | `ACTIVITY_RETENTION`  | The maximum amount of time to retain `directus_activity` records or `false` to disable. This excludes flow logs. | `90d`         |
 | `REVISIONS_RETENTION` | The maximum amount of time to retain `directus_revisions` records or `false` to disable.                         | `90d`         |
 | `FLOW_LOGS_RETENTION` | The maximum amount of time to retain flow logs or `false` to disable.                                            | `90d`         |

@@ -102,9 +102,16 @@ API keys are encrypted at rest in the database and masked in the UI.
 
 For each provider, you can restrict which models are available to users. Use the **Allowed Models** dropdown next to each API key field to select the models users can choose from.
 
-- If no models are selected, no models from that provider will be available
+Until you change the list, each provider uses a set of recommended models. The dropdown shows them as selected, with a note that they update with new Directus releases. Nothing is saved until you change the selection.
+
+- Changing the list saves your own selection, which stays the same across Directus upgrades
+- Click **Clear Value** to go back to the recommended models
 - You can add custom model IDs by typing them and pressing Enter (useful when new models are released)
 
+::callout{icon="i-lucide-info"}
+A saved selection can include a model that the provider has since retired. Requests to a retired model fail. Remove it from the list, or clear the value to use the recommended models.
+::
+
 This is useful for:
 - Controlling costs by limiting access to expensive models
 - Ensuring compliance by only allowing approved models

@@ -31,6 +31,10 @@ curl -H "Authorization: Bearer your-token" \
      https://your-directus-url.com/items/directus_collections
 ```
 
+### 405 Method Not Allowed
+
+The `/mcp` endpoint only accepts `POST` requests. Authenticated `GET` and `HEAD` requests return `405 Method Not Allowed` with an `Allow: POST` header. Directus does not offer a separate server-sent event stream, so clients that try to open one receive this response. Most MCP clients continue over `POST` automatically. If yours does not, update it to a version that supports the Streamable HTTP transport.
+
 ## Permission Errors
 
 ### Access Denied / Forbidden (403) Errors

@@ -95,7 +95,7 @@ In online mode, your instance periodically revalidates with the Directus licensi
 
 Revalidation runs on a schedule set by the license's settings, at least every 12 hours. If a key is set but no license is in effect, for example because it could not be applied during startup, Directus retries every hour.
 
-If a revalidation request fails, your instance keeps its current license and retries on the next scheduled check. Admins see a warning in **Settings > License** that explains why the license could not be renewed and the date it lapses. If renewal still fails by that date, the instance moves to the core tier. Your license key is kept, so the license is restored automatically if a check succeeds before downgrade.
+If a revalidation request fails, your instance keeps its current license and retries on the next scheduled check. Admins see a warning in the sidebar that shows how many days are left. It links to **Settings > License**, which explains why the license could not be renewed and the date it lapses. If renewal still fails by that date, the instance moves to the core tier. Your license key is kept, so the license is restored automatically if a check succeeds before downgrade.
 
 This is the default mode and is appropriate for any instance with outbound network access.
 

@@ -23,8 +23,19 @@ Each month, some of the Directus team talk through what’s new including core r
 - Creating a collection with neither `schema` nor `meta` now returns a `400` validation error instead of a `403`.
 - Updated several dependencies to address CVEs.
 
-This month we had two releases.
+This month we had three releases.
 - [Directus 12.5.1](https://github.com/directus/directus/releases/tag/v12.5.1) is a patch release with no breaking changes. The Docker images now pin Node.js to `22.23.4`, and `dompurify`, `sanitize-html`, `stream-json`, `follow-redirects`, `ip-address`, and `hono` are updated to newer versions.
+- [Directus 12.6.0](https://github.com/directus/directus/releases/tag/v12.6.0) has several potential breaking changes: Directus now requires Node.js 26, deprecated AI models are removed and unset **Allowed Models** settings use recommended defaults, the OpenAPI `x-metadata` schema is renamed to `Metadata`, telemetry and compliance reports are sent to `telemetry.directus.com`, and `PUBLIC_POLICY_ID` is removed from `@directus/constants`. Review the [full list](/releases/breaking-changes/version-12#version-1260) before upgrading.
+- Added the `richtext` [app extension type](/guides/extensions/app-extensions/richtext), which adds Tiptap nodes, marks, and toolbar buttons to the WYSIWYG interface for the fields you choose.
+- Added a **Default Exports Folder** project setting for [exports saved to the File Library](/guides/content/import-export#exports-saved-to-the-file-library). The export menu now warns that exported files are visible to anyone who can read them, and only shows options the user has permission to use.
+- The AI Assistant model lists include the latest OpenAI, Anthropic, and Google models. [Allowed Models](/guides/ai/assistant/setup#configure-allowed-models) that you have not customized follow recommended defaults that update with Directus releases.
+- License warnings, such as an invalid key or an unreachable licensing service, now also [appear in the sidebar](/licensing/overview#online-mode) for admins.
+- The Public policy warning and save confirmation now apply to [every policy attached to the Public role](/guides/security/best-practices#secure-the-public-role), including policies edited from the Public role page.
+- The `/mcp` endpoint now returns `405 Method Not Allowed` with an `Allow: POST` header for authenticated `GET` and `HEAD` requests, instead of a `500` error.
+- Fixed the retention schedule failing with a foreign key violation when a revision's parent revision was already deleted. [`RETENTION_BATCH`](/configuration/logging#log-retention) is now capped at the database's maximum number of query bindings.
+- Fixed `directus init` exiting with a missing `DB_CLIENT` error before creating the `.env` file.
+- Fixed the SDK's `customEndpoint` sending `FormData` bodies with a JSON content type.
+- Fixed markdown rendering getting slower over time, and fixed Flows saving unchanged fields.
 
 ## September 2026
 

@@ -4,6 +4,52 @@ title: Version 12
 description: Breaking changes may require action on your part before upgrading.
 ---
 
+## Version 12.6.0
+
+### Node.js 26 required
+
+The `directus`, `@directus/api`, and `create-directus-project` packages now require Node.js 26 or newer. Node.js 22 is no longer supported. The official Docker images already run Node.js 26, so this only affects projects that install Directus from npm. Upgrade Node.js before upgrading Directus.
+
+`@directus/sdk` and `@directus/cli` still support Node.js 22.
+
+Extensions are affected as follows:
+
+- App extensions are unaffected.
+- API extensions that are not sandboxed now run on Node.js 26. This brings a newer OpenSSL version, and `require()` of ES modules is enabled by default. Native addons must be built for Node.js 26.
+- Sandboxed API extensions now run on `isolated-vm` 7 instead of 5. Retest them before upgrading.
+
+Node.js 26 no longer bundles Corepack. If a multi-stage Dockerfile runs `corepack enable` in a `node:*-alpine` build stage, replace it with `npm install --global pnpm` and update the base image to `node:26-alpine`. See [Including Extensions](/self-hosting/including-extensions).
+
+### Default AI allowed models
+
+The built-in OpenAI, Anthropic, and Google model lists are updated, and the following deprecated models are removed:
+
+- `gpt-4.1-nano`
+- `gpt-5.1-chat-latest`
+- `gpt-5.2-chat-latest`
+- `gemini-3-pro-preview`
+- `gemini-3.1-flash-lite-preview`
+
+A provider's **Allowed Models** setting that is unset (`null`) now uses recommended defaults, which update with Directus releases. Previously, new projects had no allowed models until an admin selected some.
+
+Saved selections are not changed on upgrade, so they can still include a model the provider has retired. Requests to a retired model fail. After upgrading, review **Allowed Models** in **Settings → AI**, or clear the field to use the recommended defaults. See [Configure Allowed Models](/guides/ai/assistant/setup#configure-allowed-models).
+
+### OpenAPI `x-metadata` schema renamed to `Metadata`
+
+The OpenAPI schema for list response metadata is renamed from `x-metadata` to `Metadata`. List responses now reference `#/components/schemas/Metadata` for `meta`, in both `@directus/specs` and the `/server/specs/oas` endpoint. Update any `$ref` to `x-metadata` and regenerate clients built from the spec.
+
+### Telemetry and compliance URLs moved to `telemetry.directus.com`
+
+The default `TELEMETRY_URL` and `COMPLIANCE_URL` are now `https://telemetry.directus.com` instead of `https://telemetry.directus.io`. If your deployment restricts outbound traffic, allow `telemetry.directus.com` before upgrading. Otherwise reporting fails without logging an error. See [Telemetry](/licensing/telemetry).
+
+### `PUBLIC_POLICY_ID` removed from `@directus/constants`
+
+`@directus/constants` no longer exports `PUBLIC_POLICY_ID`. Projects can attach several policies to the Public role, so a single ID does not identify public access. To find the policies attached to the Public role, read `directus_access` rows where both `role` and `user` are `null`:
+
+```http
+GET /access?filter[role][_null]=true&filter[user][_null]=true
+```
+
 ## Version 12.5.0
 
 ### Stricter IP access validation

@@ -8,6 +8,8 @@ navigation:
 
 We distribute Directus as a Docker image. To self-host Directus, you will need to be in an environment that supports Docker.
 
+If you install Directus from npm instead of using the Docker image, you will need Node.js 26 or newer.
+
 ## Variables
 
 Directus uses environment variables to configure many advanced features. In order to run Directus, your host will need to provide the ability to edit the required variables. You can learn more about the available variables in the [configuration section](/configuration/general).

@@ -29,13 +29,13 @@ build:
 
 ### 2. Create a Dockerfile
 
-At the root of your project, create a file called `Dockerfile`, if one doesn't already exist. The Directus image doesn't include `npm`, `npx`, or Corepack, so install the extension in a separate build stage and copy the result into the final image:
+At the root of your project, create a file called `Dockerfile`, if one doesn't already exist. The Directus image doesn't include `npm` or `npx`, so install the extension in a separate build stage and copy the result into the final image:
 
 ```dockerfile
-# Build stage - a Node.js Alpine image with npm and Corepack
-FROM node:22-alpine AS build
+# Build stage - a Node.js Alpine image with npm
+FROM node:26-alpine AS build
 
-RUN corepack enable
+RUN npm install --global pnpm
 
 WORKDIR /extension-build
 RUN pnpm init

@@ -42,7 +42,7 @@ The following `Dockerfile` installs an extension in a `node:*-alpine` build stag
 # Build stage
 FROM node:{version}-alpine AS build
 
-RUN corepack enable
+RUN npm install --global pnpm
 
 WORKDIR /extension-build
 RUN pnpm init