v12.0.25

Security

• #483 aacdd03 - security: bump nodemailer to 10.2.1 (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h)
• #479 41ead8b - security: bump sanitize-html to 2.18.1 (GHSA-cv27-6wvh-8x7j / CVE-2026-113661, GHSA-x3q4-9hxx-gx8m / CVE-2026-113654, GHSA-374f-7chj-9948 / CVE-2026-113657)
• #465 ff27c30 - security: the authorization and cookie headers and the access_token query parameter of the request that triggers a (GHSA-f24x-rm6g-3w5v) webhook or manual flow are redacted in the log operation and in the flow logs, so that admins can't hijack the session of the user (GHSA-f24x-rm6g-3w5v)
• #476 86ade75 - security: when the rate limiter is enabled, a GraphQL request consumes one point per root field of the executed (GHSA-ph52-67fq-75wj, CVE-2026-35441) operation instead of one point per request, so repeating expensive reads under aliases with different arguments counts against the client IP's budget (GHSA-ph52-67fq-75wj). Raise RATE_LIMITER_POINTS if your clients send documents with many root fields.
• #468 cfb05b8 - security: a GraphQL query field returning a scalar, repeated under several aliases with the same arguments, is only (GHSA-6q22-g298-grjh) resolved once per request, to prevent amplifying expensive resolvers such as server_health (GHSA-6q22-g298-grjh)
• #475 7914db7 - security: add a metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350, GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3 clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)
• #483 aacdd03 - security: bump undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 / CVE-2026-109841)

@wbce-d9/api 12.7.3

Patch Changes

• #483
  aacdd03 - security: bump
  nodemailer to 10.2.1 (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h)

• #479
  41ead8b - security: bump
  sanitize-html to 2.18.1 (GHSA-cv27-6wvh-8x7j / CVE-2026-113661, GHSA-x3q4-9hxx-gx8m / CVE-2026-113654,
  GHSA-374f-7chj-9948 / CVE-2026-113657)

• #465
  ff27c30 - security: the
  authorization and cookie headers and the access_token query parameter of the request that triggers a
  (GHSA-f24x-rm6g-3w5v) webhook or manual flow are redacted in the log operation and in the flow logs, so that admins
  can't hijack the session of the user (GHSA-f24x-rm6g-3w5v)

• #476
  86ade75 - security: when the
  rate limiter is enabled, a GraphQL request consumes one point per root field of the executed (GHSA-ph52-67fq-75wj,
  CVE-2026-35441) operation instead of one point per request, so repeating expensive reads under aliases with different
  arguments counts against the client IP's budget (GHSA-ph52-67fq-75wj). Raise RATE_LIMITER_POINTS if your clients
  send documents with many root fields.

• #468
  cfb05b8 - security: a GraphQL
  query field returning a scalar, repeated under several aliases with the same arguments, is only (GHSA-6q22-g298-grjh)
  resolved once per request, to prevent amplifying expensive resolvers such as server_health (GHSA-6q22-g298-grjh)

• #475
  7914db7 - security: add a
  metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350,
  GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3
  clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all
  assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)

• Updated dependencies [aacdd03,
  be77810,
  7914db7]:

  • @wbce-d9/storage-driver-cloudinary@10.0.7
  • @wbce-d9/update-check@10.0.5
  • @wbce-d9/app@11.3.1
  • @wbce-d9/storage-driver-s3@10.0.6

@wbce-d9/app 11.3.1

Patch Changes

• #473
  be77810 - Optimize the
  animated crystal background on public pages by caching rendered crystals, capping rendering at 60 FPS, coalescing
  resize updates and pausing the animation while it is not visible.

@wbce-d9/storage-driver-cloudinary 10.0.7

Patch Changes

• #483
  aacdd03 - security: bump
  undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 /
  CVE-2026-109841)

@wbce-d9/storage-driver-s3 10.0.6

Patch Changes

• #475
  7914db7 - security: add a
  metadata-only asset resolution for HEAD requests, only open the storage read stream once an image (CVE-2025-30350,
  GHSA-rv78-qqrq-73m5, CVE-2025-30225, GHSA-j8xj-7jff-46mx) transformation has been validated, and release per-read S3
  clients when their stream closes, preventing repeated requests from exhausting the S3 connections and making all
  assets unavailable (GHSA-rv78-qqrq-73m5, GHSA-j8xj-7jff-46mx)

@wbce-d9/update-check 10.0.5

Patch Changes

• #483
  aacdd03 - security: bump
  undici to 7.30.1 (GHSA-xjj6-f33q-929c / CVE-2026-109869, GHSA-4qv8-2p9j-2685 / CVE-2026-109924, GHSA-f72v-6w45-q472 /
  CVE-2026-109841)

Dependency updates only: @wbce-d9/directus9@12.0.25