[pull] main from tinacms:main - #305
Merged
Merged
Conversation
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.12.2 to 11.16.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/mermaid-js/mermaid/releases">mermaid's releases</a>.</em></p> <blockquote> <h2>mermaid@11.16.1</h2> <h3>Patch Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"><code>12d472c</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix: handle CSS sibling combinators in compileCSS</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"><code>2cd6dcf</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix: increase protections against prototype pollution</p> <p>User-controlled input already has protections against prototype pollution.</p> <p>Fixes: GHSA-c4c3-pg64-4m4v</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf"><code>99af3fc</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix(architecture): use <code>Map</code>s and <code>Set</code>s to store groups/services</p> <p>Services are now rendered in the order they are defined and more service IDs are now supported.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"><code>2cd6dcf</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - deprecate: Deprecate the <code>mermaidAPI.setConfig()</code> function</p> <p>Calling this function has no observable effect, as the next time a <code>render()</code> or <code>parse()</code> is called, the <code>currentConfig</code> is cleared.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"><code>630aa7e</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix(xychart): support zero-width x-axis ranges</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/8022">#8022</a> <a href="https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e"><code>59b22fa</code></a> Thanks <a href="https://github.com/aloisklink"><code>@aloisklink</code></a>! - fix(radar): limit number of ticks to 32</p> <p>Setting a ticks value higher than this would only show 32 ticks.</p> </li> </ul> <h2>mermaid@11.16.0</h2> <h3>Minor Changes</h3> <ul> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7535">#7535</a> <a href="https://github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13"><code>ea1c48f</code></a> Thanks <a href="https://github.com/ragelink"><code>@ragelink</code></a>! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as <code>cynefin-beta</code>). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7721">#7721</a> <a href="https://github.com/mermaid-js/mermaid/commit/f45cc2cc5683b90990e374a463b7bcad0fd68a38"><code>f45cc2c</code></a> Thanks <a href="https://github.com/notionparallax"><code>@notionparallax</code></a>! - feat(treeView): add box-drawing character input support for treeView diagrams</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7550">#7550</a> <a href="https://github.com/mermaid-js/mermaid/commit/f1f4d45ee0513b64a2bd280087d31656f9d2c786"><code>f1f4d45</code></a> Thanks <a href="https://github.com/DominicBurkart"><code>@DominicBurkart</code></a>! - feat(xychart): add per-point text labels for xychart line plots</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7527">#7527</a> <a href="https://github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55"><code>b4d0442</code></a> Thanks <a href="https://github.com/notionparallax"><code>@notionparallax</code></a>! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7793">#7793</a> <a href="https://github.com/mermaid-js/mermaid/commit/a6f097d580d459dfc3ade3e21030037341f79940"><code>a6f097d</code></a> Thanks <a href="https://github.com/SSDWGG"><code>@SSDWGG</code></a>! - feat(er): support optional ER attribute types with a <code>?</code> suffix</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7772">#7772</a> <a href="https://github.com/mermaid-js/mermaid/commit/37f2e36fa017698b66093ac5518396523a7a3241"><code>37f2e36</code></a> Thanks <a href="https://github.com/devareddy05"><code>@devareddy05</code></a>! - feat(gantt): support multiple <code>excludes</code> / <code>includes</code> lines so long exclusion lists can be split into commented groups (<a href="https://redirect.github.com/mermaid-js/mermaid/issues/6270">#6270</a>)</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7708">#7708</a> <a href="https://github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563"><code>4e63e9d</code></a> Thanks <a href="https://github.com/txmxthy"><code>@txmxthy</code></a>! - feat(architecture): add <code>align row|column {ids…}</code> directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7760">#7760</a> <a href="https://github.com/mermaid-js/mermaid/commit/05223bee47a424be3ba7805e753b96861d342765"><code>05223be</code></a> Thanks <a href="https://github.com/ngdaniels"><code>@ngdaniels</code></a>! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7251">#7251</a> <a href="https://github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31"><code>216e4e9</code></a> Thanks <a href="https://github.com/ydah"><code>@ydah</code></a>! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).</p> </li> <li> <p><a href="https://redirect.github.com/mermaid-js/mermaid/pull/7774">#7774</a> <a href="https://github.com/mermaid-js/mermaid/commit/e5c75e6b797f84f8f652d8771eb1ce6161dd8f89"><code>e5c75e6</code></a> Thanks <a href="https://github.com/ngdaniels"><code>@ngdaniels</code></a>! - feat(xychart): enable rotate label on X-axis</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mermaid-js/mermaid/commit/7ecca0cd7f1658ef74f4e7e91f925724ef403bbf"><code>7ecca0c</code></a> Version Packages (<a href="https://redirect.github.com/mermaid-js/mermaid/issues/8023">#8023</a>)</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/95b1b9cdba40e7954aee7d8a265577fd3839710c"><code>95b1b9c</code></a> docs: change <code>mermaidAPI.setConfig()</code> changeset (<a href="https://redirect.github.com/mermaid-js/mermaid/issues/8024">#8024</a>)</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/acc69f172b5ad5405ca8de8f4f79a80505092b3f"><code>acc69f1</code></a> Merge pull request <a href="https://redirect.github.com/mermaid-js/mermaid/issues/8022">#8022</a> from mermaid-js/release/11.16.1</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/eba72879e94755433403e571d724ca7a448800af"><code>eba7287</code></a> docs: point changesets to correct commit hashes</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed"><code>12d472c</code></a> Merge commit from fork</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43"><code>2cd6dcf</code></a> Merge commit from fork</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289"><code>630aa7e</code></a> Merge commit from fork</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e"><code>59b22fa</code></a> Merge commit from fork</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf"><code>99af3fc</code></a> Merge commit from fork</li> <li><a href="https://github.com/mermaid-js/mermaid/commit/2337f7ecd629c8e777684a2edff341976230ad67"><code>2337f7e</code></a> Merge branch 'test/improve-example.html' into release/11.16.1</li> <li>Additional commits viewable in <a href="https://github.com/mermaid-js/mermaid/compare/mermaid@11.12.2...mermaid@11.16.1">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eli Kent [SSW] <69125238+kulesy@users.noreply.github.com> Co-authored-by: kulesy <kulewidak@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @tinacms/cli@2.6.0 ### Minor Changes - [#7391](#7391) [`ece366b`](ece366b) Thanks [@Aibono1225](https://github.com/Aibono1225)! - Add a Rename action to the Media Manager, backed by the local dev server. Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path. Renaming does **not** update content that already references the old path — the modal says so explicitly. The action only appears when the media store implements `rename`. `TinaMediaStore` implements it for local development via a new `POST /media/rename` route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing `MediaStore.rename`. `MediaManager.rename()` dispatches `media:rename:start`, `media:rename:success` and `media:rename:failure`. - [#7323](#7323) [`4a19d66`](4a19d66) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Add media-manager search and a folder/file filter, and refresh the grid. Search filters the library by file path (debounced, recursive across folders); the `All | Folders | Files` toggle narrows the view. Folders and files render in labelled sections, files show a type badge (JPEG/PNG/MP4…), and videos show a play overlay. Search works against both TinaCloud media and local dev media. The local dev-server media endpoint (`@tinacms/cli`) now honours a `search` query param, matching paths recursively within the requested folder (case-insensitive) and staying within the media root. Matching is on the folder-relative path, so a folder name matches the files beneath it, and matching folders surface as their own folder results (local dev media; TinaCloud parity to follow). Results are paginated with the same `limit`/`cursor` contract as an unfiltered listing. The search box is opt-in per media store via a new `searchable` flag on the `MediaStore` interface. The default (TinaCloud/local) store sets it; a custom or self-hosted store shows the box only once it sets `searchable` and reads `options.search` in its `list()`, so stores that don't support search don't get a box that returns unfiltered results. Also fixes the breadcrumb rendering a duplicate root crumb — and Back not returning to the root — for folder names that carry a trailing slash. - [#7392](#7392) [`4b7d9b9`](4b7d9b9) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add tina-markdown web component feat: add visual-editing library for web components - [#7283](#7283) [`1c89c44`](1c89c44) Thanks [@kulesy](https://github.com/kulesy)! - `tinacms dev` and `tinacms build` now warn at startup when the `tinacms`, `@tinacms/graphql`, or `@tinacms/schema-tools` versions resolved from the project don't satisfy the ranges the CLI was published with, or when two different copies of `tinacms` are installed. A held-back package (stale lockfile entry, partial upgrade, pnpm `minimumReleaseAge`) previously failed silently: the admin built fine but served an older `tinacms` where newer documented features were missing. ### Patch Changes - [#7297](#7297) [`f74e2d9`](f74e2d9) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Bump `vite` off the EOL 4.x line (`^4.5.9`, resolving to the last-ever `4.5.14`) to `^6.4.3`, and `@vitejs/plugin-react` 3 → 4, closing several path-traversal / file-disclosure advisories that were never backported to vite 4.x. **Dev server:** Vite 6 serves its dev endpoints (`@vite/client`, `@react-refresh`, and the SPA entry) under the configured `base` — Vite 4 served them at the server root. The injected dev HTML now prefixes those URLs with the admin base path, so `tinacms dev` loads the editor again instead of failing with "Failed loading TinaCMS assets". **esbuild:** the `esbuild` catalog pin moves `^0.24.2` → `^0.25.0` to match the version vite 6 bundles, so `@tinacms/cli` installs a single esbuild native binary instead of two. **Other fallout from the majors:** `@vitejs/plugin-react` 4 removed the `fastRefresh` option, so Fast Refresh is now always on in `tinacms dev` (it had been explicitly disabled) — if editor HMR misbehaves, that's the knob that changed. `splitVendorChunkPlugin` (deprecated since Vite 5.2.7, still exported in 6.4.3) is deliberately dropped from the build config as a simplification — the admin build now emits a single bundle with no separate vendor chunk, unless a `manualChunks` split is reinstated. The `process.env` define switches from a `new Object(...)` wrapper to a plain JSON literal, since esbuild ≥0.25 (bundled by vite 6) rejects the old form. The Node.js floor for the `tinacms` binary rises from 14.18 to 18, matching vite 6's engine requirement. - [#7285](#7285) [`c87b028`](c87b028) Thanks [@kulesy](https://github.com/kulesy)! - Capture CLI telemetry as anonymous events so builds no longer create a single-use person profile per run - [#7228](#7228) [`74ea991`](74ea991) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Move graphql-codegen to its current majors (~33 MB). `@graphql-codegen/plugin-helpers@7` drops lodash entirely. Before this, the CLI declared `plugin-helpers` directly at `^7.0.1` while the five codegen plugins it uses all wanted `^5` — so our pin took the hoisted slot and each plugin nested its own copy, each dragging a `lodash` pinned to `~4.17.0` that couldn't use the hoisted `4.18.1` either. Six copies of `plugin-helpers` and six of `lodash`, all but one identical. **Now one of each.** Three things v7 needs, all handled here: - **jest couldn't load it.** codegen v6's CJS build `require()`s `auto-bind@5`, which is ESM-only. Node 22 can do that; jest's module registry can't, and jest doesn't transform `node_modules`. Babel now down-levels that one package. - **`@graphql-inspector/core` v6** makes `ChangeType` a const rather than an enum; the type is `TypeOfChangeType`. - **codegen v5+ stops exporting `Exact`** from the generated `types.ts`, and defaults unmapped scalars to `unknown` instead of `any` — which would break every `<TinaMarkdown content={data.post._body} />`, since rich-text bodies ride on the `JSON` scalar. Both are pinned back. No behaviour change: the generated `types.ts`, `frags.gql` and `queries.gql` are unchanged, and the kitchen-sink typechecks with zero new errors. - [#7076](#7076) [`976a93c`](976a93c) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `esbuild` to 0.28.1, picking up upstream security fixes (GHSA-g7r4-m6w7-qqqr, GHSA-gv7w-rqvm-qjhr) - Updated dependencies [[`7df6e04`](7df6e04), [`4499dcb`](4499dcb), [`d7a1641`](d7a1641), [`f014558`](f014558), [`17931b7`](17931b7), [`cf75e5b`](cf75e5b), [`5050709`](5050709), [`cf75e5b`](cf75e5b), [`bd4df92`](bd4df92), [`566f977`](566f977), [`5f14d96`](5f14d96), [`b6199da`](b6199da), [`ece366b`](ece366b), [`4a19d66`](4a19d66), [`4b7d9b9`](4b7d9b9), [`5112e60`](5112e60), [`8c8e297`](8c8e297)]: - @tinacms/app@2.5.11 - tinacms@3.12.0 - @tinacms/schema-tools@2.9.0 - @tinacms/graphql@2.4.9 - @tinacms/metrics@2.1.1 - @tinacms/search@1.2.23 ## @tinacms/mdx@2.2.0 ### Minor Changes - [#7233](#7233) [`5f14d96`](5f14d96) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Add a dedicated `@tinacms/mdx/sanitize-url` subpath export containing just the URL-scheme sanitizer, and point `tinacms`'s rich-text renderer (`TinaMarkdown` / `StaticTinaMarkdown`) at it instead of the root `@tinacms/mdx` entry. Previously, importing `sanitizeUrl` pulled in `@tinacms/mdx`'s full remark/mdast/micromark markdown-parsing bundle (~2MB) into every site's client bundle, even though rich-text rendering only needs the ~15-line sanitizer. The root `@tinacms/mdx` export of `sanitizeUrl` is unchanged and still works. ### Patch Changes - [#7431](#7431) [`064b78e`](064b78e) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Serializer errors that a content editor can hit now say what to change. The raw markdown editor prints the thrown message verbatim in the field, so these are read by whoever is editing, not only by developers. "Marks inside inline code are not supported" put a Slate term in front of someone who has never met it, and messages naming internal node types did the same. Reworded: the two mark-combination errors, the block and inline node errors, and the one raised for a field type that cannot be written. Each now names what to remove. Schema and template errors are unchanged, since a developer hits those on first run and needs the exact term. - [#7403](#7403) [`a0e0d2e`](a0e0d2e) Thanks [@wicksipedia](https://github.com/wicksipedia)! - `parseMDX` now normalizes CRLF to LF before parsing. A carriage return used to survive micromark into the value of a text node, so a document authored on Windows carried `\r` into the editor. GFM task list items now keep their checked state through a round trip. `parseMDX` reads `checked` onto the `li` node, and both stringifiers write it back. A ticked checkbox previously came back unticked on save. `ListItemElement` gains an optional `checked?: boolean` — set only on task list items. - [#7427](#7427) [`2860f56`](2860f56) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Bold, italic and strikethrough now survive a leading or trailing space in the selection. Selecting `word ` and applying bold used to save `**word **`. CommonMark cannot close emphasis that sits against a space, so the published page showed literal asterisks and the formatting was lost, even though the editor still looked right. The space now sits outside the markers, giving `a **word** more`. Indentation at the start of a line is kept as well. A bare space there is whitespace a Markdown parser may discard, and four of them open an indented code block, so an indented line used to reload without its spaces on the `mdx` parser and as a code block on the `markdown` parser. This applies to the first line of a paragraph and to a line broken with Shift+Enter. The leading space is now written as ` `, so the text comes back the way it was left. The fix also covers marks holding only whitespace, empty marks, marks spanning several text nodes, marks inside a link, and combined bold and italic. Whitespace inside a mark, as in `**Hello *world*, again**`, still round trips unchanged. - Updated dependencies [[`d7a1641`](d7a1641), [`5050709`](5050709), [`4b7d9b9`](4b7d9b9)]: - @tinacms/schema-tools@2.9.0 ## @tinacms/schema-tools@2.9.0 ### Minor Changes - [#7392](#7392) [`4b7d9b9`](4b7d9b9) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add tina-markdown web component feat: add visual-editing library for web components ### Patch Changes - [#7304](#7304) [`d7a1641`](d7a1641) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - refactor: facilitate token refresh through tinacloud - [#7327](#7327) [`5050709`](5050709) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: when WorkOS is enabled, use a redirect-based workflow for authentication ## @tinacms/web-components@0.2.0 ### Minor Changes - [#7392](#7392) [`4b7d9b9`](4b7d9b9) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add tina-markdown web component feat: add visual-editing library for web components - [#7392](#7392) [`4b7d9b9`](4b7d9b9) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - Sanitise `html` / `html_inline` nodes in `tina-markdown` and add a `TinaMarkdown.components` map for per-node-type renderers, matching the `components` prop on the React and Astro renderers. ### Patch Changes - Updated dependencies []: - @tinacms/bridge@0.3.1 ## create-tina-app@2.2.0 ### Minor Changes - [#6961](#6961) [`e201abe`](e201abe) Thanks [@kulesy](https://github.com/kulesy)! - Make Astro the default starter. The interactive `What starter code would you like to use?` prompt now pre-selects `Astro Starter` (moved to the top of the list). When `create-tina-app` runs without a TTY and without a `--template` flag, the Astro starter is now selected automatically instead of the prompt receiving empty input and exiting as `user cancelled`. Note that a fully non-interactive run still needs `--pkg-manager` and a project name. Those two prompts have no non-TTY fallback yet, so a bare `create-tina-app` in CI still stops at the package manager question. ### Patch Changes - [#7320](#7320) [`b8c3c13`](b8c3c13) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `tar` to 7.5.21 ## tinacms@3.12.0 ### Minor Changes - [#7391](#7391) [`ece366b`](ece366b) Thanks [@Aibono1225](https://github.com/Aibono1225)! - Add a Rename action to the Media Manager, backed by the local dev server. Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path. Renaming does **not** update content that already references the old path — the modal says so explicitly. The action only appears when the media store implements `rename`. `TinaMediaStore` implements it for local development via a new `POST /media/rename` route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing `MediaStore.rename`. `MediaManager.rename()` dispatches `media:rename:start`, `media:rename:success` and `media:rename:failure`. - [#7323](#7323) [`4a19d66`](4a19d66) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Add media-manager search and a folder/file filter, and refresh the grid. Search filters the library by file path (debounced, recursive across folders); the `All | Folders | Files` toggle narrows the view. Folders and files render in labelled sections, files show a type badge (JPEG/PNG/MP4…), and videos show a play overlay. Search works against both TinaCloud media and local dev media. The local dev-server media endpoint (`@tinacms/cli`) now honours a `search` query param, matching paths recursively within the requested folder (case-insensitive) and staying within the media root. Matching is on the folder-relative path, so a folder name matches the files beneath it, and matching folders surface as their own folder results (local dev media; TinaCloud parity to follow). Results are paginated with the same `limit`/`cursor` contract as an unfiltered listing. The search box is opt-in per media store via a new `searchable` flag on the `MediaStore` interface. The default (TinaCloud/local) store sets it; a custom or self-hosted store shows the box only once it sets `searchable` and reads `options.search` in its `list()`, so stores that don't support search don't get a box that returns unfiltered results. Also fixes the breadcrumb rendering a duplicate root crumb — and Back not returning to the root — for folder names that carry a trailing slash. - [#7392](#7392) [`4b7d9b9`](4b7d9b9) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add tina-markdown web component feat: add visual-editing library for web components ### Patch Changes - [#7304](#7304) [`d7a1641`](d7a1641) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - refactor: facilitate token refresh through tinacloud - [#7422](#7422) [`f014558`](f014558) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `mermaid` to 11.16.1, picking up an upstream security fix (GHSA-c4c3-pg64-4m4v) - [#7388](#7388) [`17931b7`](17931b7) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add announcements banner - [#7216](#7216) [`cf75e5b`](cf75e5b) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Collapse three icon libraries into `lucide-react` (~85 MB). `tinacms` declared `react-icons` (84 MB), `lucide-react` (32 MB) and `@heroicons/react` as production dependencies, so every user installed all three. Icon usage is entirely internal admin chrome — there is no icon-picker, no `icon` schema field type, and no dynamic whole-set import — so `react-icons` and `@heroicons/react` have been removed in favour of `lucide-react`, which was already the de-facto house set. Not a breaking change for user content, schemas, or plugins: `ScreenPlugin.Icon` is typed `any`, and `CloudConfigOptions` is not publicly exported. The internal `IconType` prop type is now lucide's `LucideIcon`. Six icons have no exact lucide counterpart and were substituted: `BsCheckCircleFill`/`BsExclamationOctagonFill` → `CircleCheck`/`OctagonAlert` (lucide is outline-only), `MdSyncProblem` → `RefreshCwOff`, `TbLogs` → `ScrollText`, `BiRename` → `SquarePen`, `MdOutlineDataSaverOff` → `Info`. - [#7327](#7327) [`5050709`](5050709) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: when WorkOS is enabled, use a redirect-based workflow for authentication - [#7216](#7216) [`cf75e5b`](cf75e5b) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Drop `@headlessui/react` (~50 MB). Headless UI v2 pulls in the entire React Aria stack (`react-aria` 34.8 MB, `react-stately` 9.4 MB, `@internationalized/*`) — about 50 MB installed — to provide components Radix already covers. `tinacms` was shipping three headless component libraries at once (`@radix-ui/*` in 22 files, `@headlessui/react` in 11, `@ariakit/react` in 1). The 11 Headless UI files now use Radix (`Popover`, `DropdownMenu`) and local state, consolidating on the library that was already the majority. No new dependencies were added. `Transition`/`TransitionChild` are replaced by a small local equivalent with the same prop API (`show`, `appear`, `enter*`/`leave*`). It uses `element.getAnimations({ subtree: true })` so a parent transition with no classes of its own still waits for its children to finish leaving before unmounting. - [#7214](#7214) [`bd4df92`](bd4df92) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Stop shipping the `monaco-editor` package (~73 MB). Every import of `monaco-editor` in shipped source was **types-only**. The editor itself has always been fetched from a CDN at runtime by `@monaco-editor/loader`, so the 73 MB installed on every user's disk was never executed — and was a different version (0.31.0) from the one that actually runs (0.55.1, the loader's default). `monaco-editor` is a _required_ peer dependency of `@monaco-editor/react`, and npm 7+ auto-installs required peers, so removing it from our `dependencies` was not enough on its own. `@tinacms/app` now uses `@monaco-editor/loader` directly — the same loader `@monaco-editor/react` wraps, so the CDN and editor version are unchanged — and `monaco-editor` is kept as a devDependency for its types. The copy of the raw editor in `packages/tinacms` was dead code: nothing imported it, it was not exported, and its `parseMDX`/`stringifyMDX` were stubs returning empty values. The live raw editor lives in `@tinacms/app` and is injected into `tinacms` as the `rawEditor` prop. It has been deleted, letting `tinacms` drop both monaco packages entirely. No behaviour change: raw MDX mode still loads the same editor from the same CDN. - [#6403](#6403) [`566f977`](566f977) Thanks [@JackDevAU](https://github.com/JackDevAU)! - Fix the preview iframe going unresponsive after resizing the sidebar. Dragging the resize handle used to disable pointer events on the entire app so the drag would survive the cursor crossing into the preview. Releasing the drag over the preview left it dead to clicks and scrolling until you clicked the sidebar again. The handle now uses pointer capture, which keeps the drag targeting the handle without touching the rest of the page, so the preview stays interactive throughout. Also corrects the handle's fullscreen guard, which read a `fullscreen` key the sidebar context has never provided and so never fired. No behaviour change today, since nothing currently puts the sidebar into the fullscreen display state. - [#7233](#7233) [`5f14d96`](5f14d96) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Add a dedicated `@tinacms/mdx/sanitize-url` subpath export containing just the URL-scheme sanitizer, and point `tinacms`'s rich-text renderer (`TinaMarkdown` / `StaticTinaMarkdown`) at it instead of the root `@tinacms/mdx` entry. Previously, importing `sanitizeUrl` pulled in `@tinacms/mdx`'s full remark/mdast/micromark markdown-parsing bundle (~2MB) into every site's client bundle, even though rich-text rendering only needs the ~15-line sanitizer. The root `@tinacms/mdx` export of `sanitizeUrl` is unchanged and still works. - [#7322](#7322) [`b6199da`](b6199da) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - The media manager now lists assets from the v2 assets-api endpoint. Uploads and deletes are unchanged and stay on v1. Listing behaviour is identical — this is a transport-only move that sets up media search. - [#7231](#7231) [`5112e60`](5112e60) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Remove dead code left over from the `monaco-editor` removal in the mdx field plugin. - [#7428](#7428) [`8c8e297`](8c8e297) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Give the exported Plate plugin arrays (`plugins`, `viewPlugins`, `createEditorPlugins`) an explicit type, so their emitted declarations no longer carry a `.pnpm/` store path. The Plate satellite packages take `@udecode/plate` as a peer and never depend on `@udecode/plate-core` directly, so pnpm resolves it through the hoisted store. Once `@tinacms/rich-text` brought in a React 19 copy, the hoisted pick could land on a variant that nothing in `tinacms` is able to name, and `tsc` then failed with TS2742 rather than emit a declaration. Which copy wins varies per install, so the failure came and went. - Updated dependencies [[`d7a1641`](d7a1641), [`5050709`](5050709), [`064b78e`](064b78e), [`a0e0d2e`](a0e0d2e), [`2860f56`](2860f56), [`5f14d96`](5f14d96), [`4b7d9b9`](4b7d9b9)]: - @tinacms/schema-tools@2.9.0 - @tinacms/mdx@2.2.0 - @tinacms/bridge@0.3.1 - @tinacms/search@1.2.23 ## @tinacms/app@2.5.11 ### Patch Changes - [#7429](#7429) [`7df6e04`](7df6e04) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Switching a rich-text field to raw markdown no longer blanks the whole admin. Two things could take the editing session down. The raw editor arrives as a lazy chunk, so a failed fetch after a deploy or on a flaky connection tore the page down. It also serializes the field while rendering, so content it cannot represent threw with the chunk already loaded. Applying inline code and then bolding a word inside it was enough. Either way you got a blank page: no message, no way back, and unsaved work in the other fields gone with it. The failure now stays inside the field it came from. You get the thrown message, which for the formatting case names what to undo, and a button back to the rich-text editor. - [#7218](#7218) [`4499dcb`](4499dcb) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Remove `typescript` from `@tinacms/app`'s production dependencies. It was declared in both `dependencies` and `devDependencies`, but nothing in `src/` imports it — the package ships raw source and is compiled by `@tinacms/cli`. Every TinaCMS user was installing a second copy of the TypeScript compiler (~23 MB) for nothing. It remains a devDependency for type-checking. - [#7388](#7388) [`17931b7`](17931b7) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: add announcements banner - [#7216](#7216) [`cf75e5b`](cf75e5b) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Collapse three icon libraries into `lucide-react` (~85 MB). `tinacms` declared `react-icons` (84 MB), `lucide-react` (32 MB) and `@heroicons/react` as production dependencies, so every user installed all three. Icon usage is entirely internal admin chrome — there is no icon-picker, no `icon` schema field type, and no dynamic whole-set import — so `react-icons` and `@heroicons/react` have been removed in favour of `lucide-react`, which was already the de-facto house set. Not a breaking change for user content, schemas, or plugins: `ScreenPlugin.Icon` is typed `any`, and `CloudConfigOptions` is not publicly exported. The internal `IconType` prop type is now lucide's `LucideIcon`. Six icons have no exact lucide counterpart and were substituted: `BsCheckCircleFill`/`BsExclamationOctagonFill` → `CircleCheck`/`OctagonAlert` (lucide is outline-only), `MdSyncProblem` → `RefreshCwOff`, `TbLogs` → `ScrollText`, `BiRename` → `SquarePen`, `MdOutlineDataSaverOff` → `Info`. - [#7327](#7327) [`5050709`](5050709) Thanks [@brookjeynes-ssw](https://github.com/brookjeynes-ssw)! - feat: when WorkOS is enabled, use a redirect-based workflow for authentication - [#7216](#7216) [`cf75e5b`](cf75e5b) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Drop `@headlessui/react` (~50 MB). Headless UI v2 pulls in the entire React Aria stack (`react-aria` 34.8 MB, `react-stately` 9.4 MB, `@internationalized/*`) — about 50 MB installed — to provide components Radix already covers. `tinacms` was shipping three headless component libraries at once (`@radix-ui/*` in 22 files, `@headlessui/react` in 11, `@ariakit/react` in 1). The 11 Headless UI files now use Radix (`Popover`, `DropdownMenu`) and local state, consolidating on the library that was already the majority. No new dependencies were added. `Transition`/`TransitionChild` are replaced by a small local equivalent with the same prop API (`show`, `appear`, `enter*`/`leave*`). It uses `element.getAnimations({ subtree: true })` so a parent transition with no classes of its own still waits for its children to finish leaving before unmounting. - [#7214](#7214) [`bd4df92`](bd4df92) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Stop shipping the `monaco-editor` package (~73 MB). Every import of `monaco-editor` in shipped source was **types-only**. The editor itself has always been fetched from a CDN at runtime by `@monaco-editor/loader`, so the 73 MB installed on every user's disk was never executed — and was a different version (0.31.0) from the one that actually runs (0.55.1, the loader's default). `monaco-editor` is a _required_ peer dependency of `@monaco-editor/react`, and npm 7+ auto-installs required peers, so removing it from our `dependencies` was not enough on its own. `@tinacms/app` now uses `@monaco-editor/loader` directly — the same loader `@monaco-editor/react` wraps, so the CDN and editor version are unchanged — and `monaco-editor` is kept as a devDependency for its types. The copy of the raw editor in `packages/tinacms` was dead code: nothing imported it, it was not exported, and its `parseMDX`/`stringifyMDX` were stubs returning empty values. The live raw editor lives in `@tinacms/app` and is injected into `tinacms` as the `rawEditor` prop. It has been deleted, letting `tinacms` drop both monaco packages entirely. No behaviour change: raw MDX mode still loads the same editor from the same CDN. - Updated dependencies [[`d7a1641`](d7a1641), [`f014558`](f014558), [`17931b7`](17931b7), [`cf75e5b`](cf75e5b), [`5050709`](5050709), [`cf75e5b`](cf75e5b), [`bd4df92`](bd4df92), [`566f977`](566f977), [`064b78e`](064b78e), [`a0e0d2e`](a0e0d2e), [`2860f56`](2860f56), [`5f14d96`](5f14d96), [`b6199da`](b6199da), [`ece366b`](ece366b), [`4a19d66`](4a19d66), [`4b7d9b9`](4b7d9b9), [`5112e60`](5112e60), [`8c8e297`](8c8e297)]: - tinacms@3.12.0 - @tinacms/mdx@2.2.0 ## @tinacms/scripts@1.6.3 ### Patch Changes - [#7297](#7297) [`f74e2d9`](f74e2d9) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Bump `vite` off the EOL 4.x line (`^4.5.9`, resolving to the last-ever `4.5.14`) to `^6.4.3`, and `@vitejs/plugin-react` 3 → 4, closing several path-traversal / file-disclosure advisories that were never backported to vite 4.x. **Dev server:** Vite 6 serves its dev endpoints (`@vite/client`, `@react-refresh`, and the SPA entry) under the configured `base` — Vite 4 served them at the server root. The injected dev HTML now prefixes those URLs with the admin base path, so `tinacms dev` loads the editor again instead of failing with "Failed loading TinaCMS assets". **esbuild:** the `esbuild` catalog pin moves `^0.24.2` → `^0.25.0` to match the version vite 6 bundles, so `@tinacms/cli` installs a single esbuild native binary instead of two. **Other fallout from the majors:** `@vitejs/plugin-react` 4 removed the `fastRefresh` option, so Fast Refresh is now always on in `tinacms dev` (it had been explicitly disabled) — if editor HMR misbehaves, that's the knob that changed. `splitVendorChunkPlugin` (deprecated since Vite 5.2.7, still exported in 6.4.3) is deliberately dropped from the build config as a simplification — the admin build now emits a single bundle with no separate vendor chunk, unless a `manualChunks` split is reinstated. The `process.env` define switches from a `new Object(...)` wrapper to a plain JSON literal, since esbuild ≥0.25 (bundled by vite 6) rejects the old form. The Node.js floor for the `tinacms` binary rises from 14.18 to 18, matching vite 6's engine requirement. - [#7076](#7076) [`976a93c`](976a93c) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `esbuild` to 0.28.1, picking up upstream security fixes (GHSA-g7r4-m6w7-qqqr, GHSA-gv7w-rqvm-qjhr) ## next-tinacms-cloudinary@27.0.3 ### Patch Changes - [#7436](#7436) [`4ef6b6d`](4ef6b6d) Thanks [@kulesy](https://github.com/kulesy)! - Bump `multer` to 2.2.0. multer 1.x is end of life; 2.x changes file-handling behaviour, so review upload paths when upgrading. - [#7394](#7394) [`e66f1a4`](e66f1a4) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Escape the listing directory before interpolating it into the Cloudinary search expression, so folder names are always matched literally. - Updated dependencies [[`d7a1641`](d7a1641), [`f014558`](f014558), [`17931b7`](17931b7), [`cf75e5b`](cf75e5b), [`5050709`](5050709), [`cf75e5b`](cf75e5b), [`bd4df92`](bd4df92), [`566f977`](566f977), [`5f14d96`](5f14d96), [`b6199da`](b6199da), [`ece366b`](ece366b), [`4a19d66`](4a19d66), [`4b7d9b9`](4b7d9b9), [`5112e60`](5112e60), [`8c8e297`](8c8e297)]: - tinacms@3.12.0 ## next-tinacms-dos@24.0.3 ### Patch Changes - [#7436](#7436) [`4ef6b6d`](4ef6b6d) Thanks [@kulesy](https://github.com/kulesy)! - Bump `multer` to 2.2.0. multer 1.x is end of life; 2.x changes file-handling behaviour, so review upload paths when upgrading. - Updated dependencies [[`d7a1641`](d7a1641), [`f014558`](f014558), [`17931b7`](17931b7), [`cf75e5b`](cf75e5b), [`5050709`](5050709), [`cf75e5b`](cf75e5b), [`bd4df92`](bd4df92), [`566f977`](566f977), [`5f14d96`](5f14d96), [`b6199da`](b6199da), [`ece366b`](ece366b), [`4a19d66`](4a19d66), [`4b7d9b9`](4b7d9b9), [`5112e60`](5112e60), [`8c8e297`](8c8e297)]: - tinacms@3.12.0 Co-authored-by: release-bot-allow-prs-and-push[bot] <173871997+release-bot-allow-prs-and-push[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )