Merge branch 'main' into consolidate-content-versioning

.changeset/curvy-houses-grin.md

@@ -0,0 +1,5 @@
+---
+'@directus/app': patch
+---
+
+Fixed the failing auto-creating of default languages for translation fields when using an existing, custom language collection.

.changeset/empty-baboons-wave.md

@@ -0,0 +1,5 @@
+---
+"@directus/sdk": patch
+---
+
+Fixed running SDK in dev mode

.changeset/happy-oranges-play.md

@@ -0,0 +1,9 @@
+---
+"@directus/app": patch
+"@directus/release-notes-generator": patch
+"@directus/storage-driver-gcs": patch
+"@directus/themes": patch
+"@directus/update-check": patch
+---
+
+Updated dependencies

.changeset/new-carrots-do.md

@@ -0,0 +1,5 @@
+---
+'@directus/app': patch
+---
+
+Fixed display template not showing newly added fields under collection field settings

.changeset/twenty-hats-laugh.md

@@ -0,0 +1,5 @@
+---
+'@directus/api': patch
+---
+
+Fixed `_between` and `_nbetween` filters using a function, such as `count()` and `year()`

.changeset/yellow-frogs-warn.md

@@ -0,0 +1,5 @@
+---
+"@directus/app": patch
+---
+
+Fixed missing field selection dropdown for functions in filter interface

.github/workflows/check.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@v42
+        uses: tj-actions/changed-files@v44
 
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -39,7 +39,7 @@ jobs:
     steps:
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@v42
+        uses: tj-actions/changed-files@v44
 
       - name: Checkout repository
         uses: actions/checkout@v4

api/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@directus/api",
-	"version": "19.0.0",
+	"version": "19.1.0",
 	"description": "Directus is a real-time API and App dashboard for managing SQL database content",
 	"keywords": [
 		"directus",
@@ -65,7 +65,7 @@
 	},
 	"dependencies": {
 		"@authenio/samlify-node-xmllint": "2.0.0",
-		"@aws-sdk/client-ses": "3.552.0",
+		"@aws-sdk/client-ses": "3.568.0",
 		"@directus/app": "workspace:*",
 		"@directus/constants": "workspace:*",
 		"@directus/env": "workspace:*",
@@ -112,7 +112,7 @@
 		"destroy": "1.2.0",
 		"directus": "workspace:*",
 		"dotenv": "16.4.5",
-		"encodeurl": "1.0.2",
+		"encodeurl": "2.0.0",
 		"eventemitter2": "6.4.9",
 		"execa": "8.0.1",
 		"exif-reader": "2.0.1",
@@ -122,27 +122,27 @@
 		"glob-to-regexp": "0.4.1",
 		"graphql": "16.8.1",
 		"graphql-compose": "9.0.10",
-		"graphql-ws": "5.15.0",
+		"graphql-ws": "5.16.0",
 		"helmet": "7.1.0",
 		"icc": "3.0.0",
-		"inquirer": "9.2.16",
-		"ioredis": "5.3.2",
+		"inquirer": "9.2.20",
+		"ioredis": "5.4.1",
 		"ip-matching": "2.1.2",
 		"isolated-vm": "4.7.2",
-		"joi": "17.12.2",
+		"joi": "17.13.1",
 		"js-yaml": "4.1.0",
 		"js2xmlparser": "5.0.0",
 		"json2csv": "5.0.7",
 		"jsonwebtoken": "9.0.2",
 		"keyv": "4.5.4",
 		"knex": "3.1.0",
 		"ldapjs": "2.3.3",
-		"liquidjs": "10.10.1",
+		"liquidjs": "10.12.0",
 		"lodash-es": "4.17.21",
-		"marked": "12.0.1",
+		"marked": "12.0.2",
 		"micromustache": "8.0.3",
 		"mime-types": "2.1.35",
-		"minimatch": "9.0.3",
+		"minimatch": "9.0.4",
 		"mnemonist": "0.39.8",
 		"ms": "2.1.3",
 		"nanoid": "5.0.7",
@@ -157,32 +157,32 @@
 		"p-limit": "5.0.0",
 		"p-queue": "8.0.1",
 		"papaparse": "5.4.1",
-		"pino": "8.19.0",
+		"pino": "9.0.0",
 		"pino-http": "9.0.0",
 		"pino-http-print": "3.1.0",
-		"pino-pretty": "10.3.1",
-		"qs": "6.12.0",
-		"rate-limiter-flexible": "5.0.0",
-		"rollup": "4.12.0",
-		"samlify": "2.8.11",
+		"pino-pretty": "11.0.0",
+		"qs": "6.12.1",
+		"rate-limiter-flexible": "5.0.3",
+		"rollup": "4.17.2",
+		"samlify": "2.8.10",
 		"sanitize-html": "2.13.0",
-		"sharp": "0.33.2",
+		"sharp": "0.33.3",
 		"snappy": "7.2.2",
 		"stream-json": "1.8.0",
-		"tar": "6.2.0",
-		"tsx": "4.7.1",
+		"tar": "7.0.1",
+		"tsx": "4.9.3",
 		"wellknown": "0.5.0",
-		"ws": "8.16.0",
-		"zod": "3.22.4",
-		"zod-validation-error": "3.0.3"
+		"ws": "8.17.0",
+		"zod": "3.23.6",
+		"zod-validation-error": "3.2.0"
 	},
 	"devDependencies": {
 		"@directus/random": "workspace:*",
 		"@directus/tsconfig": "workspace:*",
 		"@directus/types": "workspace:*",
 		"@ngneat/falso": "7.2.0",
 		"@types/async": "3.2.24",
-		"@types/busboy": "1.5.3",
+		"@types/busboy": "1.5.4",
 		"@types/bytes": "3.1.4",
 		"@types/content-disposition": "0.5.8",
 		"@types/cookie-parser": "1.4.7",
@@ -191,7 +191,7 @@
 		"@types/destroy": "1.0.3",
 		"@types/encodeurl": "1.0.2",
 		"@types/express": "4.17.21",
-		"@types/express-serve-static-core": "4.17.43",
+		"@types/express-serve-static-core": "4.19.0",
 		"@types/fs-extra": "11.0.4",
 		"@types/glob-to-regexp": "0.4.4",
 		"@types/inquirer": "9.0.7",
@@ -202,33 +202,32 @@
 		"@types/lodash-es": "4.17.12",
 		"@types/mime-types": "2.1.4",
 		"@types/ms": "0.7.34",
-		"@types/node": "18.19.26",
-		"@types/node-schedule": "2.1.6",
-		"@types/nodemailer": "6.4.14",
+		"@types/node": "18.19.31",
+		"@types/node-schedule": "2.1.7",
+		"@types/nodemailer": "6.4.15",
 		"@types/object-hash": "3.0.6",
 		"@types/papaparse": "5.3.14",
-		"@types/qs": "6.9.14",
+		"@types/qs": "6.9.15",
 		"@types/sanitize-html": "2.11.0",
 		"@types/stream-json": "1.7.7",
-		"@types/tar": "6.1.11",
 		"@types/wellknown": "0.5.8",
 		"@types/ws": "8.5.10",
-		"@vitest/coverage-v8": "1.4.0",
+		"@vitest/coverage-v8": "1.5.3",
 		"copyfiles": "2.4.1",
 		"form-data": "4.0.0",
 		"knex-mock-client": "2.0.1",
-		"typescript": "5.3.3",
-		"vitest": "1.3.1"
+		"typescript": "5.4.5",
+		"vitest": "1.5.3"
 	},
 	"optionalDependencies": {
 		"@keyv/redis": "2.8.4",
 		"mysql": "2.18.1",
 		"nodemailer-mailgun-transport": "2.1.5",
 		"nodemailer-sendgrid": "1.0.3",
-		"oracledb": "6.4.0",
-		"pg": "8.11.4",
+		"oracledb": "6.5.0",
+		"pg": "8.11.5",
 		"sqlite3": "5.1.7",
-		"tedious": "17.0.0"
+		"tedious": "18.2.0"
 	},
 	"engines": {
 		"node": ">=18.17.0"

api/src/app.test.ts

@@ -71,7 +71,6 @@ vi.mock('./utils/validate-env.js');
 
 beforeEach(() => {
 	vi.mocked(useEnv).mockReturnValue({
-		KEY: 'xxxxxxx-xxxxxx-xxxxxxxx-xxxxxxxxxx',
 		SECRET: 'abcdef',
 		SERVE_APP: 'true',
 		PUBLIC_URL: 'http://localhost:8055/directus',

api/src/app.ts

@@ -65,7 +65,6 @@ import schema from './middleware/schema.js';
 import { initTelemetry } from './telemetry/index.js';
 import { getConfigFromEnv } from './utils/get-config-from-env.js';
 import { Url } from './utils/url.js';
-import { validateEnv } from './utils/validate-env.js';
 import { validateStorage } from './utils/validate-storage.js';
 
 const require = createRequire(import.meta.url);
@@ -75,16 +74,7 @@ export default async function createApp(): Promise<express.Application> {
 	const logger = useLogger();
 	const helmet = await import('helmet');
 
-	validateEnv(['KEY', 'SECRET']);
-
-	if (!new Url(env['PUBLIC_URL'] as string).isAbsolute()) {
-		logger.warn('PUBLIC_URL should be a full URL');
-	}
-
-	await validateStorage();
-
 	await validateDatabaseConnection();
-	await validateDatabaseExtensions();
 
 	if ((await isInstalled()) === false) {
 		logger.error(`Database doesn't have Directus tables installed.`);
@@ -95,6 +85,19 @@ export default async function createApp(): Promise<express.Application> {
 		logger.warn(`Database migrations have not all been run`);
 	}
 
+	if (!env['SECRET']) {
+		logger.warn(
+			`"SECRET" env variable is missing. Using a random value instead. Tokens will not persist between restarts. This is not appropriate for production usage.`,
+		);
+	}
+
+	if (!new Url(env['PUBLIC_URL'] as string).isAbsolute()) {
+		logger.warn('"PUBLIC_URL" should be a full URL');
+	}
+
+	await validateDatabaseExtensions();
+	await validateStorage();
+
 	await registerAuthProviders();
 
 	const extensionManager = getExtensionManager();

api/src/auth/drivers/oauth2.ts

@@ -31,6 +31,7 @@ import { getIPFromReq } from '../../utils/get-ip-from-req.js';
 import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
 import { Url } from '../../utils/url.js';
 import { LocalAuthDriver } from './local.js';
+import { getSecret } from '../../utils/get-secret.js';
 
 export class OAuth2AuthDriver extends LocalAuthDriver {
 	client: Client;
@@ -306,7 +307,7 @@ export function createOAuth2AuthRouter(providerName: string): Router {
 				throw new InvalidPayloadError({ reason: `URL "${redirect}" can't be used to redirect after login` });
 			}
 
-			const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, env['SECRET'] as string, {
+			const token = jwt.sign({ verifier: codeVerifier, redirect, prompt }, getSecret(), {
 				expiresIn: '5m',
 				issuer: 'directus',
 			});
@@ -338,7 +339,7 @@ export function createOAuth2AuthRouter(providerName: string): Router {
 			let tokenData;
 
 			try {
-				tokenData = jwt.verify(req.cookies[`oauth2.${providerName}`], env['SECRET'] as string, {
+				tokenData = jwt.verify(req.cookies[`oauth2.${providerName}`], getSecret(), {
 					issuer: 'directus',
 				}) as {
 					verifier: string;