Document Directus 12.5.0

[ChristopherJennings]

Summary

Docs for the Directus 12.5.0 release, checked against the v12.4.1..v12.5.0 code diff. Also backfills one undocumented 12.4.0 breaking change.

Release pages

• Breaking changes, Version 12.5.0: a new section with these entries:
  • Stricter IP access and IMPORT_IP_DENY_LIST validation.
  • 2FA enforcement follows effective policies.
  • CACHE_SCHEMA_MAX_ITERATIONS is removed and CACHE_SCHEMA_SYNC_TIMEOUT now defaults to 60000.
  • GET /license returns invalid_reason instead of downgrade_reason.
  • License error classes are removed from @directus/errors.
  • File storage values must match a configured location.
  • SDK and type definitions are corrected.
• Changelog: a new October 2026 entry.
• 12.4.0 backfill: Flow folders now share directus_folders with a new type field. Admin GET /folders requests return Flow folders too. The 12.4.1 callout now says that release has no breaking changes of its own.

Feature and reference docs

• Manage Flows: activate or deactivate several Flows at once.
• Rich text: linked images and paste cleanup. Accessibility shortcuts and the supported HTML list are updated to match.
• Licensing:
  • the retry schedule
  • keeping the current license when a request fails
  • an invalid_reason values table
  • deactivating a key the licensing service no longer recognizes
  • a corrected PUBLIC_URL callout
• Auth:
  • valid IP access formats
  • IP allowlists now also gate 2FA
  • 2FA is required through a policy, not the user page, which was wrong before
• Config: CACHE_SCHEMA_SYNC_TIMEOUT, IMPORT_IP_DENY_LIST, LICENSE_KEY and LICENSE_TOKEN.
• Errors and files: added LICENSE_INVALID, and the storage location rule on uploads.

Notes for reviewers

• License endpoint path: the release notes say /server/license, but the route is GET /license (api/src/app.ts:370). These docs use /license.
• Removed license error codes: no endpoint returned them in 12.4.1, so only extensions that import them are affected.
• 2FA on refresh: the description of Fix TFA enforcement to use effective permissions directus#28176 says enforce_tfa is recalculated on token refresh. The merged code doesn't do that, so these docs don't claim it.
• Not in the release notes: the file storage validation (Guard local-driver extensions location in storage path validation directus#28077) and the Flow folders type change in 12.4.0 aren't flagged as breaking upstream. I documented both because API clients can hit them.

Related docs PRs

• Document preview base url setting for live preview #835 (Preview Base URL): should merge for this release. The changelog links to its #set-a-preview-base-url anchor, which goes nowhere until Document preview base url setting for live preview #835 merges. It needs two small fixes:
  • The page path should be Settings > Settings, not Settings > Project.
  • It should note that Visual Editor URLs don't use the Preview Base URL.
• Update security best practices docs for the public policy #839 (Public policy): accurate for 12.5. It also documents a Default Exports Folder setting from Directus exports - improve handling and messaging directus#28333, which is still open, so that part needs splitting out.
• Document Tiptap version policy for richtext extensions #840 and Document Responses API selection for custom models #837: hold. Their upstream PRs (te ← Share all @tiptap/pm subpaths with richtext extensions (CMS-3155) directus#28335 and #28329) are still open.

Test plan

• Ran pnpm dev and confirmed all 13 changed pages return 200.
• Every new section link resolves.
• Spot-checked the rendered breaking changes and licensing sections.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 7, 2026 9:34pm UTC