⭐ Known Gaps

The honest list — tracked here and in todo.md's "Still to do" table, not buried in chat history.

• packages/release-notes-generator's pnpm-internals rewrite still owed. Its package.json no longer lists @pnpm/workspace.find-packages/@pnpm/workspace.pkgs-graph/@pnpm/logger, but the actual source file that imports them (src/utils/process-packages.ts) hasn't been copied/rewritten yet. Planned replacement: read each workspace's package.json directly and build the internal dependency graph from workspace:* references — no package-manager-specific API needed at all.
• blackbox.yml/e2e.yml steps gated if: false — tests/blackbox/tests/e2e are manifest-only, nothing real to run yet. Re-enable condition is written directly in each workflow's comment, and tracked as its own card so it doesn't get forgotten once the source lands: Issue #30 — see CI and Docker.
• CI secrets not yet configured — Check now installs cleanly (see Yarn Migration for the isolated-vm fix), but workflows depending on unconfigured secrets (Docker Hub, release PAT, etc.) will keep failing until those are set — see CI and Docker.
• Neither Dockerfile has been build-tested end-to-end — blocked on the real source trees and a real run of scripts/deploy-production.mjs.
• 35 of 40 workspace packages have no real source yet — see Architecture Overview. This is the main body of remaining work, not a footnote. Even the 5 that have started aren't fully resolved: packages/types is complete but doesn't fully type-check (1 cross-package dependency, @directus/ai, remains manifest-only — packages/schema and packages/constants both completed and closed their own halves of that gap), and packages/ai itself is only 2 of 4 files in.

Real bugs found and fixed

• 🏁 isolated-vm@5.0.3 incompatible with Node 26. Failed to compile identically on Windows and the GitHub Actions Ubuntu runner — real compiler output (gh run view --log-failed) showed the native addon calling V8 APIs Node 26's bundled V8 has since removed or changed (Template::SetAccessor, Object::GetIsolate/GetPrototype, internal-field accessor signatures, a Maybe<T>/cppgc header restructuring). Not a missing-toolchain problem — every other native module in the dependency graph built cleanly. Fixed by bumping to 7.0.1 (latest, engines.node: ">=24.0.0"), verified with a real yarn install. Issue #26.
• 🏁 CodeQL Default-setup vs. advanced-workflow conflict. Three consecutive scheduled CodeQL Analysis runs failed with a red X, but the scan itself succeeded every time — only the final upload-acceptance step failed, with Code Scanning could not process the submitted SARIF file: CodeQL analyses from advanced configurations cannot be processed when the default setup is enabled. Real cause: GitHub's own "Default" CodeQL setup was enabled alongside this repo's own migrated codeql-analysis.yml workflow — GitHub refuses results from an advanced workflow while Default is also active, a real product constraint, not a bug in this repo's YAML. Fixed by disabling Default setup via the Code Scanning API, confirmed by 3 consecutive green scheduled runs afterward. Issue #35.
• 🏁 All 41 open Dependabot alerts fixed. Across 18 unique packages, 21 PRs (including 3 unplanned follow-ups where one fix's own dependency bump reintroduced or reopened a different alert — a pm2 bump pulling in a vulnerable ws, then a vulnerable js-yaml; uuid's first fix covered too narrow a version range). Every fix verified with a real yarn install and a yarn why check against the specific advisory's actual vulnerable_version_range — not bumped and assumed clean. Zero open alerts remain as of 2026-08-24.
• 🏁 CLA check gated — inapplicable to a single-maintainer repo. directus/cla-bot checks PR authors against upstream Directus's own CLA-signer records, which fails on every PR here regardless of author — not a required status check (no branch protection on main), but a permanent red X for a check that structurally can't pass. Gated if: false the same way as blackbox.yml/e2e.yml's test steps, re-enable condition tied to this project ever accepting external contributions.
• 🏁 SQL injection in packages/schema's SQLite dialect. sqlite.ts's hasColumn() built its query via direct string interpolation of table/column names, unlike every other method in the file and package, which correctly use knex's ?/?? parameter binding — a real, exploitable vector in upstream's own source, found while porting the file one-at-a-time like every other file in this migration. Fixed by switching to parameter binding; verified against a real in-memory SQLite database (node:sqlite) that a real injection payload is safely neutralized where the original would have executed it. Issue #59.