Overview

Getting Started

The JavaScript toolkit for building content management interfaces

Content Modeling

Data Fetching

Contextual Editing

Extending Tina

Powerful Git-based content management for teams

Tina Cloud Dashboard

Using a project

Custom Fields

Rich text

tinacms

TinaCMS CLI

GraphQL API

Advanced Usage

@tinacms/cli

next-tinacms-cloudinary

The CMS

Forms

Text

Text Area

Number

Image

Color

Toggle

Radio Group

Select

List

Group

Group List

Blocks

Date & Time

Markdown

HTML

Field Plugins

Using the CMS Toolkit with Tina Cloud

Content Management

Using the CMS instance

Using Forms

Fields

Content Creators

Media

Using External APIs

Sidebar & Toolbar

Alerts

Custom Styles

User Interface

Events

Plugins

Screens

Toolbar Widgets

CMS Toolkit

Create an Account with TinaCMS

Getting up and running locally

Working with TinaCMS

Starter Structure

Using the Tina starter

Creating our Application

Content Modelling

Add Tina to our pages

Adding Plugins

Tina Cloud and Deployment

Next Steps

Adding TinaCMS to an existing Next.js app

TinaCMS

Inline Blocks

Strapi Backend

GitHub Backend

Experimental Guides

### Patch Changes

- [`124567b`](https://github.com/tinacms/tinacms/commit/124567b2e75e0f00b8d040d096532d8c6176f08f) Thanks [@Tyagiquamar](https://github.com/Tyagiquamar)! - Fix empty, index-less active field group when clicking a tinaField targeting an object list with fields.

- [#7923](https://github.com/tinacms/tinacms/pull/7923) [`a3d56c0`](https://github.com/tinacms/tinacms/commit/a3d56c0272f967b3f7d5bef2143ca12a1b9b17ed) Thanks [@RaphaelFakhri](https://github.com/RaphaelFakhri)! - Validate `required` on string list fields that use `ui.component: 'tags'`. The tags field plugin had no `validate` function, so a required tags field showed no "Required" error and the document saved with no tags. The field now reports "Required" when it holds no tags.

- Updated dependencies [[`80502f8`](https://github.com/tinacms/tinacms/commit/80502f86b0224fb67ec05f0644db71bf5d38fde4), [`19285c6`](https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618)]:
  - @tinacms/mdx@2.4.2

tinacms@3.15.1

### Patch Changes

- [#7951](https://github.com/tinacms/tinacms/pull/7951) [`80502f8`](https://github.com/tinacms/tinacms/commit/80502f86b0224fb67ec05f0644db71bf5d38fde4) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Fix saving a rich-text field that contains an empty bullet.

- [#7958](https://github.com/tinacms/tinacms/pull/7958) [`19285c6`](https://github.com/tinacms/tinacms/commit/19285c6deeee52c380e8b2fdeafedc9530dc0618) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Rich-text component values that contain a quote, backslash or newline now save and load back unchanged. Tina writes each value in a string, datetime, reference or image list as a JSON string literal. Values without those characters stay exactly as before.

  Negative numbers and image lists on rich-text components now load back. Before, a negative number turned the block into invalid markdown, and an image list failed to load.

  Number and boolean values must be real numbers or booleans. If one is not, the save fails with a message that names the field. If you clear a number field, Tina saves it as `null`. Tina drops a highlight colour that contains characters a CSS colour cannot have, and the text stays highlighted.

@tinacms/mdx@2.4.2

### Patch Changes

- [#7319](https://github.com/tinacms/tinacms/pull/7319) [`40cf662`](https://github.com/tinacms/tinacms/commit/40cf6628da02f81bd0cb5994a3ed78b71cba699a) Thanks [@Osamaali313](https://github.com/Osamaali313)! - Fix a crash when parsing rich-text containing an `image` field with `list: true`. The image-list branch called `.split(',')` on the array returned by `extractScalar`, throwing `TypeError: values.split is not a function`; the error was wrapped as a parse failure, so the block became an `invalid_markdown` node (content dropped in the editor) or failed `tinacms build`. It now maps over the array like the other list field types.

- [#7861](https://github.com/tinacms/tinacms/pull/7861) [`33bb5f3`](https://github.com/tinacms/tinacms/commit/33bb5f3a1e0c178fac0d9b8c8547fd0a2e4cee9d) Thanks [@Deea222](https://github.com/Deea222)! - A rich-text field holding two lists of the same kind in a row now reopens after it is saved. The MDX serializer separated such lists with an HTML comment (``), which MDX does not allow, so the whole document fell back to raw text on the next load. It now switches the list marker instead: `*` then `-`, `1.` then `1)`. Files already saved with the comment are not rewritten; remove the `` line by hand once. Fixes #5238.

@tinacms/mdx@2.4.1

### Minor Changes

- [#7145](https://github.com/tinacms/tinacms/pull/7145) [`46f5bab`](https://github.com/tinacms/tinacms/commit/46f5babc3bcb23a0390247dfd8b715661e8c814a) Thanks [@kulesy](https://github.com/kulesy)! - Add `Database.deleteIndexEntriesForPaths(paths)`. It removes every sort-index and reference entry for the given paths, including entries left over from an earlier value of a field. Left in place, those entries make a sorted collection list fail with "Error querying file" once the document is deleted, and make deleting or renaming a document it once referenced fail. Call it after `deleteContentByPaths` with the same paths.

### Patch Changes

- [#7863](https://github.com/tinacms/tinacms/pull/7863) [`2811d2c`](https://github.com/tinacms/tinacms/commit/2811d2c4d353a5ff45a12862b3cd4170d7119fd3) Thanks [@Apu-Emdad](https://github.com/Apu-Emdad)! - An optional image field left empty is no longer written to frontmatter as an empty string. Clearing an existing optional image now removes the key.

- Updated dependencies [[`40cf662`](https://github.com/tinacms/tinacms/commit/40cf6628da02f81bd0cb5994a3ed78b71cba699a), [`33bb5f3`](https://github.com/tinacms/tinacms/commit/33bb5f3a1e0c178fac0d9b8c8547fd0a2e4cee9d)]:
  - @tinacms/mdx@2.4.1

@tinacms/graphql@4.1.0

### Patch Changes

- [#7145](https://github.com/tinacms/tinacms/pull/7145) [`46f5bab`](https://github.com/tinacms/tinacms/commit/46f5babc3bcb23a0390247dfd8b715661e8c814a) Thanks [@kulesy](https://github.com/kulesy)! - `tinacms build --partial-reindex` now clears every index entry for deleted documents, including entries left over from an earlier value. Self-hosted sites that build this way no longer hit "Error querying file" on a collection sorted by a field that changed before the document was deleted.

- Updated dependencies [[`46f5bab`](https://github.com/tinacms/tinacms/commit/46f5babc3bcb23a0390247dfd8b715661e8c814a), [`2811d2c`](https://github.com/tinacms/tinacms/commit/2811d2c4d353a5ff45a12862b3cd4170d7119fd3)]:
  - @tinacms/graphql@4.1.0

@tinacms/cli@4.0.4

### Minor Changes

- [#7606](https://github.com/tinacms/tinacms/pull/7606) [`787c7a9`](https://github.com/tinacms/tinacms/commit/787c7a9daf7740dbfb148d25a74367948bcbaade) Thanks [@dependabot](https://github.com/apps/dependabot)! - Upgrade `react-router-dom` from 6.30 to 7.18, which fixes GHSA-wrjc-x8rr-h8h6 and GHSA-337j-9hxr-rhxg; no 6.x release carries these fixes. React Router 7 requires React 18 or later.

- [#7683](https://github.com/tinacms/tinacms/pull/7683) [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Rich-text fields can now colour text. A Text Color dropdown now appears next to Highlight in the default toolbar. Fields with a custom `overrides.toolbar` need `'textColor'` added to it. Coloured text saves as a `<span>` with a `color` style, inside any bold, italic, strikethrough or highlight. The palette can be set per field under `overrides.textColors` (a list of `{ label, value }`).

  Also fixes:
  - Adjacent text with different marks no longer picks up a neighbour's mark on save (e.g. bold italic text followed by italic text saved both as bold).
  - Renderers only apply plain CSS colours, so content can no longer inject arbitrary CSS through a highlight or text colour.

### Patch Changes

- [#7798](https://github.com/tinacms/tinacms/pull/7798) [`53ae895`](https://github.com/tinacms/tinacms/commit/53ae8954de8668e5eeb92d817bfbf12bf39cb17d) Thanks [@andrewwbuilds](https://github.com/andrewwbuilds)! - The date field's time picker now follows `timeFormat`. A format with a 24-hour hour token, such as `HH:mm`, opens a 24-hour picker with no AM/PM select. 12-hour formats and `timeFormat: true` keep the 12-hour picker.

- [#7734](https://github.com/tinacms/tinacms/pull/7734) [`abb7c15`](https://github.com/tinacms/tinacms/commit/abb7c153b2db6cd9bf42da6ddfaa5d2b08029861) Thanks [@wakqasahmed](https://github.com/wakqasahmed)! - List field descriptions now wrap onto multiple lines like other field descriptions, instead of being cut off with an ellipsis.

- Updated dependencies [[`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f)]:
  - @tinacms/mdx@2.4.0
  - @tinacms/schema-tools@2.11.0

tinacms@3.15.0

### Minor Changes

- [#7781](https://github.com/tinacms/tinacms/pull/7781) [`4010161`](https://github.com/tinacms/tinacms/commit/4010161720c2784e6cebd9fbec7ecbbeb5c7cbb4) Thanks [@kulesy](https://github.com/kulesy)! - Bump `sharp` from `^0.33.5` to `^0.35.5`.

  sharp 0.35 needs Node.js 20.9 or later. It also tunes lossy AVIF output with a new quality metric, so an AVIF served at the same `quality` setting can come out a different size. sharp 0.35 also refuses images with more than five channels, so the delivery handler now serves a TIFF like that as the original file instead of resizing it.

### Patch Changes

- Updated dependencies [[`53ae895`](https://github.com/tinacms/tinacms/commit/53ae8954de8668e5eeb92d817bfbf12bf39cb17d), [`787c7a9`](https://github.com/tinacms/tinacms/commit/787c7a9daf7740dbfb148d25a74367948bcbaade), [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f), [`abb7c15`](https://github.com/tinacms/tinacms/commit/abb7c153b2db6cd9bf42da6ddfaa5d2b08029861)]:
  - tinacms@3.15.0

next-tinacms-azure@15.2.0

### Patch Changes

- [#7744](https://github.com/tinacms/tinacms/pull/7744) [`3d23cd7`](https://github.com/tinacms/tinacms/commit/3d23cd7b5405bf073305d93ff3650177d86d3b86) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `systeminformation` from `^5.27.13` to `^5.31.7`, which fixes four command-injection advisories. Machines where `systeminformation` cannot read a hardware UUID now get a random anonymous telemetry ID instead of all sharing one.

create-tina-app@2.2.4

### Patch Changes

- [#7846](https://github.com/tinacms/tinacms/pull/7846) [`3a7c39b`](https://github.com/tinacms/tinacms/commit/3a7c39b1f39ceb2a9d9aa29353465ae0f43d01d4) Thanks [@dependabot](https://github.com/apps/dependabot)! - Update dompurify to 3.4.17 for its sanitizer hardening fixes

@tinacms/web-components@0.2.3

### Minor Changes

- [#7683](https://github.com/tinacms/tinacms/pull/7683) [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Rich-text fields can now colour text. A Text Color dropdown now appears next to Highlight in the default toolbar. Fields with a custom `overrides.toolbar` need `'textColor'` added to it. Coloured text saves as a `<span>` with a `color` style, inside any bold, italic, strikethrough or highlight. The palette can be set per field under `overrides.textColors` (a list of `{ label, value }`).

  Also fixes:
  - Adjacent text with different marks no longer picks up a neighbour's mark on save (e.g. bold italic text followed by italic text saved both as bold).
  - Renderers only apply plain CSS colours, so content can no longer inject arbitrary CSS through a highlight or text colour.

@tinacms/schema-tools@2.11.0

### Minor Changes

- [#7683](https://github.com/tinacms/tinacms/pull/7683) [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Rich-text fields can now colour text. A Text Color dropdown now appears next to Highlight in the default toolbar. Fields with a custom `overrides.toolbar` need `'textColor'` added to it. Coloured text saves as a `<span>` with a `color` style, inside any bold, italic, strikethrough or highlight. The palette can be set per field under `overrides.textColors` (a list of `{ label, value }`).

  Also fixes:
  - Adjacent text with different marks no longer picks up a neighbour's mark on save (e.g. bold italic text followed by italic text saved both as bold).
  - Renderers only apply plain CSS colours, so content can no longer inject arbitrary CSS through a highlight or text colour.

### Patch Changes

- Updated dependencies [[`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f)]:
  - @tinacms/schema-tools@2.11.0

@tinacms/mdx@2.4.0

### Patch Changes

- [#7782](https://github.com/tinacms/tinacms/pull/7782) [`dc74885`](https://github.com/tinacms/tinacms/commit/dc7488576604c019bb3284401a7088777dcfbe90) Thanks [@kulesy](https://github.com/kulesy)! - Bump `js-yaml` to `^4.3.2` in `@tinacms/cli` and `^3.15.2` in `@tinacms/graphql`, which fixes a high-severity advisory in each.

- [#7851](https://github.com/tinacms/tinacms/pull/7851) [`e627dc9`](https://github.com/tinacms/tinacms/commit/e627dc9c20b59d851b59a36c015f8232359448c0) Thanks [@sarahanntolsma-ff](https://github.com/sarahanntolsma-ff)! - Find a document's references by walking it against its schema rather than by evaluating schema-derived JSONPath over it. The expressions could not describe a templated list item, which is tagged `_template` rather than nested under a key of that name, and could not reach inside a `rich-text` field, which is stored as text. References in either shape were missing from the index, so `_sys.hasReferences` reported false for them and renaming or deleting such a document left those references pointing at a path that no longer existed. `findReferences` also took the default page of 50, which silently capped how many a rename or delete went on to fix.

  Existing indexes keep answering lookups, but entries the old build wrote are not replaced on a single document write — reindex to pick up the references it missed and to clear stale entries.

- [#7133](https://github.com/tinacms/tinacms/pull/7133) [`d828a9e`](https://github.com/tinacms/tinacms/commit/d828a9efdd40c0c554df5adc4d635e5818f96598) Thanks [@kulesy](https://github.com/kulesy)! - A collection list sorted by a field now loads when that field's sort index still lists a deleted document. The query skips the missing document instead of failing the whole list with "Error querying file ... from collection". A full reindex removes the stale entry.

- [#7295](https://github.com/tinacms/tinacms/pull/7295) [`5750d3b`](https://github.com/tinacms/tinacms/commit/5750d3bc84c18d4fb6332aa5a499d33fca973b0f) Thanks [@shininglegend](https://github.com/shininglegend)! - Fix an intermittent, silent hang at "Indexing local files" in `tinacms dev`/`build`/`audit`. `TinaLevelClient.openConnection` connected to the in-process datalayer server without waiting for the server's `listen()` to complete; when the connection lost that race, `many-level` queued every database operation forever with no error. The connection is now retried (100 ms × 50), and if it ultimately fails the RPC stream is destroyed so queued operations reject with `LEVEL_CONNECTION_LOST` instead of hanging. The race is timing-sensitive: on Node 25 it was lost almost every run, on Node 22 occasionally.

- Updated dependencies [[`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f)]:
  - @tinacms/mdx@2.4.0
  - @tinacms/schema-tools@2.11.0

@tinacms/graphql@4.0.1

### Patch Changes

- [#7782](https://github.com/tinacms/tinacms/pull/7782) [`dc74885`](https://github.com/tinacms/tinacms/commit/dc7488576604c019bb3284401a7088777dcfbe90) Thanks [@kulesy](https://github.com/kulesy)! - Bump `js-yaml` to `^4.3.2` in `@tinacms/cli` and `^3.15.2` in `@tinacms/graphql`, which fixes a high-severity advisory in each.

- [#7741](https://github.com/tinacms/tinacms/pull/7741) [`c89dfca`](https://github.com/tinacms/tinacms/commit/c89dfca256247c0fb3512fedcc4132c32cc96684) Thanks [@haigou-web](https://github.com/haigou-web)! - Return plain objects from the self-hosted database client

  `graphql-js` builds its result objects with a `null` prototype. React Server
  Components reject those when they cross the server/client boundary ("Only plain
  objects can be passed to Client Components"), so self-hosted queries failed in
  the Next.js App Router. The generated `databaseRequest()` now normalises the
  result before returning it.

- Updated dependencies [[`53ae895`](https://github.com/tinacms/tinacms/commit/53ae8954de8668e5eeb92d817bfbf12bf39cb17d), [`dc74885`](https://github.com/tinacms/tinacms/commit/dc7488576604c019bb3284401a7088777dcfbe90), [`787c7a9`](https://github.com/tinacms/tinacms/commit/787c7a9daf7740dbfb148d25a74367948bcbaade), [`e627dc9`](https://github.com/tinacms/tinacms/commit/e627dc9c20b59d851b59a36c015f8232359448c0), [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f), [`d828a9e`](https://github.com/tinacms/tinacms/commit/d828a9efdd40c0c554df5adc4d635e5818f96598), [`5750d3b`](https://github.com/tinacms/tinacms/commit/5750d3bc84c18d4fb6332aa5a499d33fca973b0f), [`abb7c15`](https://github.com/tinacms/tinacms/commit/abb7c153b2db6cd9bf42da6ddfaa5d2b08029861)]:
  - tinacms@3.15.0
  - @tinacms/graphql@4.0.1
  - @tinacms/app@2.6.0
  - @tinacms/schema-tools@2.11.0

@tinacms/cli@4.0.3

@tinacms/astro@0.8.0

### Minor Changes

- [#7606](https://github.com/tinacms/tinacms/pull/7606) [`787c7a9`](https://github.com/tinacms/tinacms/commit/787c7a9daf7740dbfb148d25a74367948bcbaade) Thanks [@dependabot](https://github.com/apps/dependabot)! - Upgrade `react-router-dom` from 6.30 to 7.18, which fixes GHSA-wrjc-x8rr-h8h6 and GHSA-337j-9hxr-rhxg; no 6.x release carries these fixes. React Router 7 requires React 18 or later.

### Patch Changes

- Updated dependencies [[`53ae895`](https://github.com/tinacms/tinacms/commit/53ae8954de8668e5eeb92d817bfbf12bf39cb17d), [`787c7a9`](https://github.com/tinacms/tinacms/commit/787c7a9daf7740dbfb148d25a74367948bcbaade), [`034e88f`](https://github.com/tinacms/tinacms/commit/034e88ff9fb8035b1443397b5d981313a44fa30f), [`abb7c15`](https://github.com/tinacms/tinacms/commit/abb7c153b2db6cd9bf42da6ddfaa5d2b08029861)]:
  - tinacms@3.15.0
  - @tinacms/mdx@2.4.0

@tinacms/app@2.6.0

### Patch Changes

- [#7791](https://github.com/tinacms/tinacms/pull/7791) [`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d) Thanks [@sarahanntolsma-ff](https://github.com/sarahanntolsma-ff)! - Give the form's saved/unsaved indicator an accessible name. It was a coloured dot with no text, so its state reached neither a screen reader nor anyone who cannot distinguish the two colours.

- [#7789](https://github.com/tinacms/tinacms/pull/7789) [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a) Thanks [@sarahanntolsma-ff](https://github.com/sarahanntolsma-ff)! - Fix the form fields shown after navigating back to a nested block through the breadcrumb. A path ending on a list field rather than on one of its items returned the surrounding group with its field names unprefixed, and an unprefixed name addresses the top of the document. Where a nested list shared a name with a top-level field, the breadcrumb therefore rendered the top-level list under the nested list's templates, and the list's add, remove and reorder reached the wrong array.

- [#7790](https://github.com/tinacms/tinacms/pull/7790) [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c) Thanks [@sarahanntolsma-ff](https://github.com/sarahanntolsma-ff)! - Report the status code when a failed TinaCloud response carries no status text, and keep the HTTP error when the response body is not JSON. Over HTTP/2 the error read `Unable to complete request, ` with nothing after the comma, and a gateway answering with HTML replaced the error with a JSON parse error. This also applies to creating branches and pull requests, checking the latest version, and polling editorial workflow status.

- [#7738](https://github.com/tinacms/tinacms/pull/7738) [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127) Thanks [@kulesy](https://github.com/kulesy)! - Error modals now show their own title in the header, size the action button to its label, and link to the TinaCloud troubleshooting guide with descriptive text. `ErrorDialog` now renders as modal content instead of a standalone styled card, and its `title` prop is deprecated in favour of `cms.alerts.error(message, { title })`.

- Updated dependencies []:
  - @tinacms/search@1.2.26

tinacms@3.14.4

### Patch Changes

- Updated dependencies [[`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8)]:
  - @tinacms/datalayer@3.0.0

tinacms-gitprovider-github@5.0.0

### Patch Changes

- [#7722](https://github.com/tinacms/tinacms/pull/7722) [`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Document the `authCollection.admins` database option.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4

tinacms-authjs@24.0.5

### Patch Changes

- [`d908d7f`](https://github.com/tinacms/tinacms/commit/d908d7f8e01b56b3ceb24ba8a2faebb00a996c03) Thanks [@wicksipedia](https://github.com/wicksipedia)! - The upload URL now includes the file's content type, and the upload must send that same type. The API route does not issue upload URLs for HTML, XML, script or multipart types. If a media store from an earlier version sends no content type, the route uses the standard type for the file extension. A plus sign in a file name is kept, and the media URL encodes it as `%2B`.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4

next-tinacms-s3@24.0.5

### Patch Changes

- [`d908d7f`](https://github.com/tinacms/tinacms/commit/d908d7f8e01b56b3ceb24ba8a2faebb00a996c03) Thanks [@wicksipedia](https://github.com/wicksipedia)! - The upload route checks the content type the browser sends and returns 415 for HTML, XML, script or multipart types, so it no longer stores a file that a browser would run as a page.

- [#7666](https://github.com/tinacms/tinacms/pull/7666) [`53686ee`](https://github.com/tinacms/tinacms/commit/53686eef0b9511e1cf638b9530c84e1b36630c89) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `multer` from `2.2.0` to `2.4.0`, which fixes CVE-2026-88932 and the four CVEs fixed in 2.3.0.

  Uploads behave the same. Both adapters accept one file in the `file` field and read `directory` from the body. The behaviour changes in 2.3 and 2.4 cover upload limits, which neither adapter sets, and escaped characters in field names.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4

next-tinacms-dos@24.0.6

### Patch Changes

- [#7666](https://github.com/tinacms/tinacms/pull/7666) [`53686ee`](https://github.com/tinacms/tinacms/commit/53686eef0b9511e1cf638b9530c84e1b36630c89) Thanks [@dependabot](https://github.com/apps/dependabot)! - Bump `multer` from `2.2.0` to `2.4.0`, which fixes CVE-2026-88932 and the four CVEs fixed in 2.3.0.

  Uploads behave the same. Both adapters accept one file in the `file` field and read `directory` from the body. The behaviour changes in 2.3 and 2.4 cover upload limits, which neither adapter sets, and escaped characters in field names.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4

next-tinacms-cloudinary@27.0.6

### Patch Changes

- [#7780](https://github.com/tinacms/tinacms/pull/7780) [`fe16aa5`](https://github.com/tinacms/tinacms/commit/fe16aa5c6585aa5d00bc51798d3716a315684097) Thanks [@kulesy](https://github.com/kulesy)! - Update dompurify to 3.4.16 and make tina-markdown render raw HTML as plain text in DOM environments where the sanitizer cannot remove unsafe markup

@tinacms/web-components@0.2.2

### Patch Changes

- Updated dependencies [[`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8)]:
  - @tinacms/graphql@4.0.0

@tinacms/search@1.2.26

### Major Changes

- [#7722](https://github.com/tinacms/tinacms/pull/7722) [`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Add the `authCollection` option to `createDatabase`. On self-hosted sites with an auth collection, only users listed in `authCollection.admins` can add, edit, or remove users from the admin. Every user can still change their own password. To keep managing users from the admin, add your username: `createDatabase({ ..., authCollection: { admins: ['your-username'] } })`.

  Breaking: `authenticate` now answers only sign-in requests from a database client generated by this version of `@tinacms/cli`. A client generated by an older CLI can't sign in. Update `@tinacms/cli`, then run `tinacms build` or `tinacms dev` to regenerate `tina/__generated__/databaseClient` before you deploy.

@tinacms/graphql@4.0.0

### Major Changes

- [#7722](https://github.com/tinacms/tinacms/pull/7722) [`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8) Thanks [@wicksipedia](https://github.com/wicksipedia)! - Update to `@tinacms/graphql` 4. Sign-in now needs a database client generated by the matching `@tinacms/cli`. Update `@tinacms/cli` with this package, then run `tinacms build` or `tinacms dev` to regenerate `tina/__generated__/databaseClient`. Self-hosted sites with an auth collection also need `authCollection.admins` to manage users from the admin.

### Patch Changes

- Updated dependencies [[`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8)]:
  - @tinacms/graphql@4.0.0

@tinacms/datalayer@3.0.0

### Patch Changes

- [#7051](https://github.com/tinacms/tinacms/pull/7051) [`5b3bcfb`](https://github.com/tinacms/tinacms/commit/5b3bcfb7bcdbbf7868e89bd2ffbfc6ec57ca6e4e) Thanks [@kulesy](https://github.com/kulesy)! - `tinacms build` now regenerates `tina/tina-lock.json`, which TinaCloud reads to index your schema. Before this, only `tinacms dev` wrote it, so a project that changed its schema and only ran `tinacms build` locally committed a stale lock file. A build in CI still doesn't commit the file, so after a schema change run `tinacms build` or `tinacms dev` locally and push `tina/tina-lock.json`.

- [#7786](https://github.com/tinacms/tinacms/pull/7786) [`34e54fa`](https://github.com/tinacms/tinacms/commit/34e54faecddca4ea057b74f44e43b91a195f0d59) Thanks [@kulesy](https://github.com/kulesy)! - When `tinacms build` stops on a failed TinaCloud index, print the reason TinaCloud gives, such as the YAML error behind "Unable to seed", instead of only the file name or the word "undefined".

- [#7722](https://github.com/tinacms/tinacms/pull/7722) [`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8) Thanks [@wicksipedia](https://github.com/wicksipedia)! - The self-hosted init template now shows the `authCollection.admins` option. `tinacms init` now notes that the built-in self-hosted login is not production grade and points to dedicated auth providers.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`f3cf692`](https://github.com/tinacms/tinacms/commit/f3cf6922cfa178e0e301547df88d6565d8a305a8), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4
  - @tinacms/graphql@4.0.0
  - @tinacms/app@2.5.15
  - @tinacms/search@1.2.26

@tinacms/cli@4.0.2

### Patch Changes

- [#7738](https://github.com/tinacms/tinacms/pull/7738) [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127) Thanks [@kulesy](https://github.com/kulesy)! - Error modals now show their own title in the header, size the action button to its label, and link to the TinaCloud troubleshooting guide with descriptive text. `ErrorDialog` now renders as modal content instead of a standalone styled card, and its `title` prop is deprecated in favour of `cms.alerts.error(message, { title })`.

- Updated dependencies [[`7998180`](https://github.com/tinacms/tinacms/commit/799818046dcea70ea6367199cea025d7ff4b0e3d), [`15818bc`](https://github.com/tinacms/tinacms/commit/15818bce7a4b83072d2b0d4a9e96025b6ac8f14a), [`12cdee6`](https://github.com/tinacms/tinacms/commit/12cdee614c5273d1f772ee8dc18ce37b91a2197c), [`4f2758e`](https://github.com/tinacms/tinacms/commit/4f2758e3067ca2a2db40593a0e4a1040b51ad127)]:
  - tinacms@3.14.4

@tinacms/app@2.5.15

### Patch Changes

- [#7658](https://github.com/tinacms/tinacms/pull/7658) [`d281cdf`](https://github.com/tinacms/tinacms/commit/d281cdf3a1dc1d5ef42d2bfd15c29224acc9d201) Thanks [@isaaclombardssw](https://github.com/isaaclombardssw)! - Show an orange border when hovering over a populated image selector.

tinacms@3.14.3

### Patch Changes

- [`5db1597`](https://github.com/tinacms/tinacms/commit/5db1597953eb4dd24c23c7b5e441702b749d46ac) Thanks [@Aibono1225](https://github.com/Aibono1225)! - Validate media upload file types on the server and reject active document types (e.g. `.html`, `.js`, `.xml`) instead of relying on the client-side accept filter alone.

- Updated dependencies [[`d281cdf`](https://github.com/tinacms/tinacms/commit/d281cdf3a1dc1d5ef42d2bfd15c29224acc9d201)]:
  - tinacms@3.14.3

Docs

Release Notes

Latest Release

Patch Changes

Previous Releases