Directus v12.2: A New Editor Engine + Tighter Guardrails by Default

Directus 12.2.0 does two things at once. It replaces the editor powering every WYSIWYG field in Studio, and it closes a handful of gaps where the platform was more permissive than it should have been by default. Neither change is flashy. Both matter if you run Directus in production.

Tiptap replaces TinyMCE

The WYSIWYG interface has run on TinyMCE for years. As of this release, it runs on Tiptap instead (#27754, built by @alvarosabu).

Why we made this change: keeping TinyMCE up to date with security patches had become something we could no longer sustain. That made this a natural moment to switch - and we used it to align with our new product Monospace which also uses Tiptap. Overall we are excited to move to an editor that's more modern, with a feature set we can actually build on going forward.

If you have not touched tinymceOverrides, custom TinyMCE plugins, or the global tinymce object, you probably will not notice the switch beyond a cleaner editing experience. If you have, here is what changes:

• tinymceOverrides no longer does anything. The value stays in your config, a warning is logged, but the editor ignores it. Use the toolbar's font size and font family menus, plus customFormats, instead.

• TinyMCE is no longer bundled with the app. Any custom plugins, skins, or content CSS that depended on it stop applying.

The part we spent the most care on is existing content. If a field already contains HTML that Tiptap would normalize differently, that field locks to read-only and shows a warning dialog. You have to confirm the warning before you can edit or let autosave run again, and raw-value editing is disabled while the field is locked. That is deliberate: we would rather stop you for a second than let an editor swap quietly rewrite your content.

Settings and permissions get stricter

A few fixes in this release tighten what the platform exposes by default, rather than what it can be configured to expose.

Accounts with minimal app access could previously read directus_settings fields they had no real use for, including admin-only and AI configuration fields (#27996, by @br41nslug). That set is now scoped down to what non-admin users actually need. Existing policies keep their current behavior; this only applies going forward for new ones.

A few related fixes landed alongside it: the IP denylist is now enforced on AI chat file downloads (#27994), manual flows can no longer be triggered by unauthenticated users (#27997), and license key previews are restricted to administrators after a project's initial setup (#27886). None of these are dramatic on their own. Together, they reduce the number of places where a non-admin role, or no role at all, could see or trigger more than intended.

Imports and transforms now have limits

Multi-collection flat data imports are new in this release, along with a mode parameter and partial snapshot support on the schema diff endpoint, so you can diff or apply a subset of collections instead of the whole schema (#27984, by @ComfortablyCoding).

That feature came with a side effect worth calling out: import size was previously unbounded. A new IMPORT_MAX_FILE_SIZE environment variable caps uploaded import files and schema snapshots at 50mb by default. If you rely on larger imports, raise that variable; otherwise, files over the limit now get rejected instead of silently processed.

Image transforms got the same treatment. ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION now rejects transformation requests that would output an image larger than 3000px on either axis (#27995), throwing an IllegalAssetTransformationError instead of letting the request through.

On the reliability side, background imports that hung and imported nothing when running behind a streaming proxy or CDN are fixed (#27862, by @dstockton), and the background query flag on POST /utils/import/:collection now treats a valueless ?background as true, matching how most people were already using it.

What this means for upgrades

If you use the WYSIWYG field with custom TinyMCE configuration, check your tinymceOverrides and any custom plugins before upgrading. If you run large imports or generate large image transforms, check the new environment variable defaults so nothing you rely on gets rejected unexpectedly. Everything else in this release is the kind of tightening you want happening in the background: less exposed by default, fewer silent failures, same API you already know.