v12.4.0

### ⚠️ Potential Breaking Changes

**Updated MapLibre GL JS from 1.15.3 to 6.9.0 ([#28216](https://github.com/directus/directus/pull/28216))**
The map layout and the geometry interface now require WebGL2, which MapLibre has mandated since v3. Browsers that only support WebGL1, chiefly Safari 14 and earlier and older Android devices, will no longer render maps.

Dragging with a pointer or a mouse wheel keeps the hovered item popup pinned to the cursor as before. Touch drags no longer reposition it, since the underlying touch event carries no cursor coordinates.

**Updated Unhead from 1.11.20 to 3.4.1 ([#28248](https://github.com/directus/directus/pull/28248))**
`@directus/themes` now requires `@unhead/vue` 3.x as a peer dependency. Projects that pair it with their own Unhead instance need to upgrade and follow the [v2](https://unhead.unjs.io/docs/migration-guide/v2) and [v3](https://unhead.unjs.io/docs/vue/migration-guide/v3) migration guides.

**Updated outdated type definitions for `directus_comments`, `directus_flows`, `directus_operations`, `directus_presets`, `directus_roles`, and `directus_versions` ([#27956](https://github.com/directus/directus/pull/27956))**
The following fields are now correctly marked as nullable:

- `@directus/types`: `Comment.user_created`, `Comment.user_updated`, `FlowRaw.user_created`, `OperationRaw.options`, `OperationRaw.user_created`, `Preset.collection`, `Role.description`, and `ContentVersion.hash`
- `@directus/sdk`: `DirectusRole.parent` and `DirectusVersion.hash`

**Updated outdated type definitions for `directus_relations`, `directus_policies`, `directus_shares`, `directus_access`, `directus_comments`, and `directus_versions` ([#27970](https://github.com/directus/directus/pull/27970))**
Breaking changes in `@directus/sdk`:

- `DirectusRelation.meta` and `DirectusRelation.schema` are now nullable
- `DirectusPolicy.ip_access` and `DirectusRelation.meta.one_allowed_collections` are now correctly typed as `string[]`

Breaking changes in `@directus/types`:
- `Policy.enforce_tfa` is no longer nullable
- `Share.name`, `role`, `password`, `user_created`, `date_created` and `times_used` are now nullable

**Fixed read permissions not enforced when resolving item keys for `updateByQuery` and `deleteByQuery` ([#28143](https://github.com/directus/directus/pull/28143))**
Update/delete by query now resolves the affected items with the read permissions enforced:

- Read access to the collection's primary key field is now required.
- The affected items are scoped to what the role can read, irrespective of update rights.
- Nested o2m saves require read access on the child collection.

**Added native `mailtrap` email transport support via `EMAIL_TRANSPORT=mailtrap` ([#27873](https://github.com/directus/directus/pull/27873))**
The transport is configured through the following environment variables:

- `EMAIL_MAILTRAP_TOKEN` — an API token from https://mailtrap.io/api-tokens. Required.
- `EMAIL_MAILTRAP_SANDBOX` — send to the testing inbox instead of real recipients.
- `EMAIL_MAILTRAP_TEST_INBOX_ID` — which testing inbox to send to. Required in sandbox mode.
- `EMAIL_MAILTRAP_BULK` — send via the bulk stream. Cannot be combined with sandbox mode.

- **@directus/app**
  - Updated MapLibre GL JS from 1.15.3 to 6.9.0 ([#28216](https://github.com/directus/directus/pull/28216) by @br41nslug)
- **@directus/themes**
  - Updated Unhead from 1.11.20 to 3.4.1 ([#28248](https://github.com/directus/directus/pull/28248) by @br41nslug)
- **@directus/types**
  - Updated outdated type definitions for `directus_relations`, `directus_policies`, `directus_shares`, `directus_access`, `directus_comments`, and `directus_versions` ([#27970](https://github.com/directus/directus/pull/27970) by @kheiner)
- **@directus/sdk**
  - Updated outdated type definitions for `directus_relations`, `directus_policies`, `directus_shares`, `directus_access`, `directus_comments`, and `directus_versions` ([#27970](https://github.com/directus/directus/pull/27970) by @kheiner)
  - Removed the unused helper types `ToTuple` and `TupleToUnion` ([#27956](https://github.com/directus/directus/pull/27956) by @kheiner)

### ✨ New Features & Improvements

- **@directus/app**
  - Disabled inactive collections in the Studio, preventing them from being selected or used while being viewable ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
  - Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
  - Added support for setting the From Name in the Send Email operation ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/api**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
  - Added support for hiding a manual Flow's own button, so it runs only from a Manual Flow field ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
  - Added support for setting the From Name in the Send Email operation ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
  - Added native `mailtrap` email transport support via `EMAIL_TRANSPORT=mailtrap` ([#27873](https://github.com/directus/directus/pull/27873) by @tsokolovs)
- **@directus/system-data**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/specs**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/types**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/cli**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/sdk**
  - Moved Flows into its own module and improved how they're organized and managed, including folders, search and filtering, import and export, and duplication ([#28206](https://github.com/directus/directus/pull/28206) by @robluton)
- **@directus/env**
  - Added native `mailtrap` email transport support via `EMAIL_TRANSPORT=mailtrap` ([#27873](https://github.com/directus/directus/pull/27873) by @tsokolovs)

### 🐛 Bug Fixes & Optimizations

- **@directus/app**
  - Fixed the image editor's error notice rendering as an unstyled info message instead of an error ([#28245](https://github.com/directus/directus/pull/28245) by @Nitwel)
  - Updated Unhead from 1.11.20 to 3.4.1 ([#28248](https://github.com/directus/directus/pull/28248) by @br41nslug)
  - Fixed relational edits made in quick succession saving duplicate create or update entries for the same row, which made the stale entry win and dropped block editor changes inside translations ([#28247](https://github.com/directus/directus/pull/28247) by @alvarosabu)
  - Fixed the filter delete (x) button in the search bar's filter popover becoming unclickable on hover. ([#28114](https://github.com/directus/directus/pull/28114) by @aniruddhav25)
  - Fixed table row context menus staying open when opening the menu on another row ([#28191](https://github.com/directus/directus/pull/28191) by @robluton)
  - Updated outdated type definitions for `directus_comments`, `directus_flows`, `directus_operations`, `directus_presets`, `directus_roles`, and `directus_versions` ([#27956](https://github.com/directus/directus/pull/27956) by @kheiner)
  - Updated outdated type definitions for `directus_relations`, `directus_policies`, `directus_shares`, `directus_access`, `directus_comments`, and `directus_versions` ([#27970](https://github.com/directus/directus/pull/27970) by @kheiner)
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
  - Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs ([#28242](https://github.com/directus/directus/pull/28242) by @br41nslug)
  - Fixed the date picker calendar showing English weekday names and starting the week on Sunday regardless of the user language ([#28147](https://github.com/directus/directus/pull/28147) by @lazerg)
  - Replaced `lodash` with `lodash-es` in the Studio ([#28245](https://github.com/directus/directus/pull/28245) by @Nitwel)
  - Added new DEV_APP_PORT env var for setting the app port while in development mode ([#28112](https://github.com/directus/directus/pull/28112) by @robluton)
- **@directus/api**
  - Updated outdated type definitions for `directus_comments`, `directus_flows`, `directus_operations`, `directus_presets`, `directus_roles`, and `directus_versions` ([#27956](https://github.com/directus/directus/pull/27956) by @kheiner)
  - Updated outdated type definitions for `directus_relations`, `directus_policies`, `directus_shares`, `directus_access`, `directus_comments`, and `directus_versions` ([#27970](https://github.com/directus/directus/pull/27970) by @kheiner)
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
  - Updated dompurify, joi, express, qs, uuid, diff, pm2, OpenTelemetry and AI SDK dependencies to address CVEs ([#28242](https://github.com/directus/directus/pull/28242) by @br41nslug)
  - Updated stream-json from 1.9.1 to 3.6.0 ([#28251](https://github.com/directus/directus/pull/28251) by @br41nslug)
  - Fixed read permissions not enforced when resolving item keys for `updateByQuery` and `deleteByQuery` ([#28143](https://github.com/directus/directus/pull/28143) by @br41nslug)
  - Fixed relational fields ordering to align with the order of fields in query parameters. ([#28197](https://github.com/directus/directus/pull/28197) by @wakqasahmed)
  - Fixed Oracle JSON filtering and `json()` function returning quoted strings for scalar string values ([#28264](https://github.com/directus/directus/pull/28264) by @wofiporia)
  - Fixed schema cache synchronization timeouts leaving stale bus subscriptions and pending timers behind ([#28178](https://github.com/directus/directus/pull/28178) by @lazerg)
  - Fixed the global access cache ignoring the client IP ([#28190](https://github.com/directus/directus/pull/28190) by @br41nslug)
  - Updated sharp, nodemailer, tiptap, js-yaml and mysql2 dependencies ([#28219](https://github.com/directus/directus/pull/28219) by @br41nslug)
  - Fixed the block editor flickering and losing its controls while editing a version ([#28105](https://github.com/directus/directus/pull/28105) by @alvarosabu)
  - Fixed schema diff generation for nested metadata additions and removals ([#27880](https://github.com/directus/directus/pull/27880) by @thribhuvan003)
  - Fixed `FilesService.uploadOne` to prevent client payloads from overwriting system fields (e.g., `uploaded_by`, `created_on` etc) ([#28208](https://github.com/directus/directus/pull/28208) by @br41nslug)
  - Fixed `year()` function on Oracle returning the ISO week-numbering year instead of the calendar year, and made the Oracle date part functions (`year`, `month`, `week`, `day`, `weekday`, `hour`, `minute`, `second`) return numbers instead of zero padded strings ([#28257](https://github.com/directus/directus/pull/28257) by @galshir)
  - Fixed `uploaded_on` not being set for TUS uploads ([#28043](https://github.com/directus/directus/pull/28043) by @kheiner)
  - Fixed comment updates and deletes enforcement ([#28162](https://github.com/directus/directus/pull/28162) by @kheiner)
  - Fixed foreign key constraints being dropped when updating a relation with a partial payload ([#28137](https://github.com/directus/directus/pull/28137) by @lazerg)
  - Updated Flows and Operations tools to automatically fix incorrect X/Y positions for flow operations when used through ([#28159](https://github.com/directus/directus/pull/28159) by @bryantgillespie)
    MCP and AI Assistant
- **@directus/types**
  - Updated outdated type definitions for `directus_comments`, `directus_flows`, `directus_operations`, `directus_presets`, `directus_roles`, and `directus_versions` ([#27956](https://github.com/directus/directus/pull/27956) by @kheiner)
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
- **@directus/sdk**
  - Updated outdated type definitions for `directus_comments`, `directus_flows`, `directus_operations`, `directus_presets`, `directus_roles`, and `directus_versions` ([#27956](https://github.com/directus/directus/pull/27956) by @kheiner)
  - Added missing empty-parameter validation to `readRelationByCollection`, `createField`, `deleteCollection`, `utilsExport`, `utilsImport`, `utilitySort`, `triggerFlow`, and `readShareInfo` ([#27970](https://github.com/directus/directus/pull/27970) by @kheiner)
  - Updated known-but-not-enforced string fields on `directus_users`, `directus_settings`, `directus_deployment_runs` ([#28129](https://github.com/directus/directus/pull/28129) by @kheiner)
- **@directus/errors**
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
- **@directus/schema-builder**
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
- **@directus/utils**
  - Blocked crud usage for inactive collections and added a `COLLECTION_INACTIVE` error ([#27792](https://github.com/directus/directus/pull/27792) by @br41nslug)
- **@directus/memory**
  - Fixed the local key-value store treating equal `setMax` values as updates ([#28172](https://github.com/directus/directus/pull/28172) by @jashkarangiya)
  - Fixed concurrent local KV updates losing increments or overwriting larger values in `setMax`. ([#28194](https://github.com/directus/directus/pull/28194) by @jashkarangiya)
- **@directus/release-notes-generator**
  - Renamed the blackbox test package to e2e ([#28226](https://github.com/directus/directus/pull/28226) by @Nitwel)

### 📦 Published Versions

- `@directus/app@18.0.0`
- `@directus/api@39.2.0`
- `@directus/cli@12.3.0`
- `@directus/composables@11.6.3`
- `create-directus-extension@12.1.5`
- `@directus/env@6.3.0`
- `@directus/errors@2.5.2`
- `@directus/extensions@4.0.5`
- `@directus/extensions-registry@4.0.4`
- `@directus/extensions-sdk@18.0.5`
- `@directus/memory@4.0.5`
- `@directus/pressure@4.0.5`
- `@directus/release-notes-generator@3.0.2`
- `@directus/schema-builder@1.0.3`
- `@directus/specs@15.2.0`
- `@directus/storage-driver-azure@13.0.5`
- `@directus/storage-driver-cloudinary@14.0.2`
- `@directus/storage-driver-gcs@13.0.5`
- `@directus/storage-driver-s3@14.0.2`
- `@directus/storage-driver-supabase@5.0.2`
- `@directus/system-data@4.7.0`
- `@directus/themes@3.0.0`
- `@directus/types@17.0.0`
- `@directus/utils@13.5.5`
- `@directus/validation@3.0.5`
- `@directus/sdk@26.0.0`