⬆️ NPM: Bump the tinacms group across 1 directory with 9 updates

[dependabot]

Bumps the tinacms group with 2 updates in the / directory: tinacms and @tinacms/cli.

Updates tinacms from 3.10.0 to 3.13.0

Release notes

Sourced from tinacms's releases.

tinacms@3.13.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Add accept to the image field, restricting which file types the field will take. It takes an extension, a category (image, video, audio, document), or an array of either. The field's own dropzone and the media picker's both refuse a file outside it, the picker narrows the library to matching files, and a selection outside it raises an alert instead of being written. jpg and jpeg are treated as the same type. Existing values are left alone.

• #7423 7c21906 Thanks @​Aibono1225! - Add TinaCloud media rename support to the Media Manager.

  Repo-backed media can now be renamed directly from the Media Manager. Renames on unprotected branches are applied directly, while renames on protected branches use the editorial workflow and create a pull request from a new workflow branch.

  Local media rename behavior is unchanged, and static or self-hosted repo media stores still do not expose the Rename action.

  Renaming does not update existing content references to the old media path. Rename failures from the assets API are surfaced in the UI with their specific error messages.

• #7494 37f2e6a Thanks @​lastenvoy30! - Render semantic <thead>/<th> for markdown tables in TinaMarkdown

  Markdown (GFM) tables previously rendered every row as <tbody><td>, with no <thead> or <th>. That diverges from standard GFM output and breaks accessibility (assistive tech relies on <th> to associate headers with data cells) as well as the th component override.

  The first row of a markdown table is now rendered as <thead><th>, matching the existing behavior for editor-authored MDX tables. Remaining rows render as <tbody><td> as before. Column alignment is preserved on both <th> and <td>.

  Breaking change: sites that styled table headers via td or tbody tr:first-child selectors will need to update those selectors to target th/thead instead.

  Breaking change: the default inline border: 1px solid #EDECF3 on <table> and the border/padding: 0.25rem on cells are no longer applied, and align is no longer leaked onto the DOM as a raw attribute. Tables now inherit your stylesheet instead of the inline styles that used to beat it on specificity, so a table that rendered as a boxed grid will look different until you style it yourself.

Patch Changes

• #7495 57707bf Thanks @​Aibono1225! - Show the configured Git author in the editorial workflow save dialog.

  When saving to a new branch, the dialog now shows whether commits will be made as the TinaCloud bot or as you, with a link to change the setting.

• #7467 2264a16 Thanks @​wicksipedia! - Download the mermaid diagram library only when a document actually contains a mermaid code block. The rich-text editor imported mermaid at the top of its code-block component, so the admin shipped the whole library to every editor session even when no project file used a diagram. The import now happens inside the code that parses and renders a diagram, which lets the bundler split mermaid into its own chunk. In the kitchen-sink admin build the entry chunk drops from 6,339,116 to 5,698,025 bytes (1,974,875 to 1,823,566 gzipped), and the 635,594-byte mermaid chunk (150,677 gzipped) is fetched on demand instead. A diagram preview shows a placeholder while the chunk loads, and a chunk that fails to load is reported in the same place the editor already reports diagram syntax errors.

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

• #7486 d340dab Thanks @​kulesy! - A session that expires mid-edit now returns the user to the login modal on every path. The content API client dispatches cms:session-expired and throws a typed SessionExpiredError when a GraphQL request comes back 401, and the REST transport (fetchWithToken, used by branch listing, billing, editorial-workflow polling, search indexing and the media store) notifies the same flow when a tokened request 401s, so saves, deletes, renames, folder creation and every panel land on the login modal instead of generic error dialogs, misleading unauthorized panels, or a success toast for a save that never ran. The auth wall suppresses new alerts between expiry and re-login so nothing paints over the login modal, session expiries are no longer recorded as save failures in analytics, a transient identity-API failure no longer reads as a logged-out session (one retry, then it surfaces as an error), and custom content APIs keep a console diagnostic for 401 loops caused by backend misconfiguration.

  Also fixes the registerApi event bridge this rides on: api.events was forwarded to the global bus with an unbound dispatch, so the api-to-cms direction documented on Client.events has never delivered an event. Both directions now forward, with guards scoped to the in-flight event so nested dispatches still bridge.

... (truncated)

Changelog

Sourced from tinacms's changelog.

3.13.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Add accept to the image field, restricting which file types the field will take. It takes an extension, a category (image, video, audio, document), or an array of either. The field's own dropzone and the media picker's both refuse a file outside it, the picker narrows the library to matching files, and a selection outside it raises an alert instead of being written. jpg and jpeg are treated as the same type. Existing values are left alone.

• #7423 7c21906 Thanks @​Aibono1225! - Add TinaCloud media rename support to the Media Manager.

  Repo-backed media can now be renamed directly from the Media Manager. Renames on unprotected branches are applied directly, while renames on protected branches use the editorial workflow and create a pull request from a new workflow branch.

  Local media rename behavior is unchanged, and static or self-hosted repo media stores still do not expose the Rename action.

  Renaming does not update existing content references to the old media path. Rename failures from the assets API are surfaced in the UI with their specific error messages.

• #7494 37f2e6a Thanks @​lastenvoy30! - Render semantic <thead>/<th> for markdown tables in TinaMarkdown

  Markdown (GFM) tables previously rendered every row as <tbody><td>, with no <thead> or <th>. That diverges from standard GFM output and breaks accessibility (assistive tech relies on <th> to associate headers with data cells) as well as the th component override.

  The first row of a markdown table is now rendered as <thead><th>, matching the existing behavior for editor-authored MDX tables. Remaining rows render as <tbody><td> as before. Column alignment is preserved on both <th> and <td>.

  Breaking change: sites that styled table headers via td or tbody tr:first-child selectors will need to update those selectors to target th/thead instead.

  Breaking change: the default inline border: 1px solid #EDECF3 on <table> and the border/padding: 0.25rem on cells are no longer applied, and align is no longer leaked onto the DOM as a raw attribute. Tables now inherit your stylesheet instead of the inline styles that used to beat it on specificity, so a table that rendered as a boxed grid will look different until you style it yourself.

Patch Changes

• #7495 57707bf Thanks @​Aibono1225! - Show the configured Git author in the editorial workflow save dialog.

  When saving to a new branch, the dialog now shows whether commits will be made as the TinaCloud bot or as you, with a link to change the setting.

• #7467 2264a16 Thanks @​wicksipedia! - Download the mermaid diagram library only when a document actually contains a mermaid code block. The rich-text editor imported mermaid at the top of its code-block component, so the admin shipped the whole library to every editor session even when no project file used a diagram. The import now happens inside the code that parses and renders a diagram, which lets the bundler split mermaid into its own chunk. In the kitchen-sink admin build the entry chunk drops from 6,339,116 to 5,698,025 bytes (1,974,875 to 1,823,566 gzipped), and the 635,594-byte mermaid chunk (150,677 gzipped) is fetched on demand instead. A diagram preview shows a placeholder while the chunk loads, and a chunk that fails to load is reported in the same place the editor already reports diagram syntax errors.

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

• #7486 d340dab Thanks @​kulesy! - A session that expires mid-edit now returns the user to the login modal on every path. The content API client dispatches cms:session-expired and throws a typed SessionExpiredError when a GraphQL request comes back 401, and the REST transport (fetchWithToken, used by branch listing, billing, editorial-workflow polling, search indexing and the media store) notifies the same flow when a tokened request 401s, so saves, deletes, renames, folder creation and every panel land on the login modal instead of generic error dialogs, misleading unauthorized panels, or a success toast for a save that never ran. The auth wall suppresses new alerts between expiry and re-login so nothing paints over the login modal, session expiries are no longer recorded as save failures in analytics, a transient identity-API failure no longer reads as a logged-out session (one retry, then it surfaces as an error), and custom content APIs keep a console diagnostic for 401 loops caused by backend misconfiguration.

  Also fixes the registerApi event bridge this rides on: api.events was forwarded to the global bus with an unbound dispatch, so the api-to-cms direction documented on Client.events has never delivered an event. Both directions now forward, with guards scoped to the in-flight event so nested dispatches still bridge.

... (truncated)

Commits

• e9e1f17 Version Packages (#7487)
• 37f2e6a fix(rich-text): render semantic thead/th for markdown tables (#7494)
• aa686c6 🐛 Make shift+Enter produce a line break that survives a save (#6555, #7408) (...
• d6161d6 fix(tinacms): media manager stops refreshing on events after paging (#7497)
• d340dab fix(tinacms): detect session expiry at the content API client (#7486)
• 57707bf Show configured Git author in the editorial workflow save modal (#7495)
• fd6aaaf ✨ Filter the media manager by file type (#7477)
• 7c21906 Add TinaCloud media rename support to the Media Manager (#7423)
• 2264a16 perf(tinacms): the rich-text editor downloads mermaid even when nothing uses ...
• f9f6a50 Version Packages (#7443)
• Additional commits viewable in compare view

Updates @tinacms/cli from 2.5.3 to 2.7.0

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.7.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

Patch Changes

• #7476 f48009e Thanks @​kulesy! - chore(tinacms-pkgs): point repository.directory at each package's own folder

  Eight packages declared a repository.directory copied from whichever package they were forked from, so the "repository" link on their npm pages resolved to unrelated source. Also drops a dead generate:schema script from @tinacms/metrics, @tinacms/cli and @tinacms/schema-tools - it referenced a scripts/generateSchema.js that has never existed in the repo and nothing invoked it.

• #7491 9fa7a4f Thanks @​kulesy! - Surface the real error from TinaCloud when the tinacms build schema checks fail. Previously both remote checks read the response body without looking at the HTTP status or an errors array, so any server-side error was reported as "The remote GraphQL schema does not exist. Check indexing for this branch." (or its Tina schema equivalent), pointing users at indexing when indexing was fine. Both checks now throw with the server's own error message, include the HTTP status code for non-2xx responses, report an unparseable response body instead of failing with a JSON syntax error, and keep the "does not exist" message only for a successful response that genuinely contains no schema. When the server reports that DocumentFilter or DocumentMutation has no fields, the error also points at a stale tina/tina-lock.json, since that means the indexed schema has no collections.

• Updated dependencies [d340dab, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, 9a7092d, d340dab, aa686c6, 37f2e6a, d340dab]:

  • @​tinacms/schema-tools@​2.10.0
  • tinacms@3.13.0
  • @​tinacms/metrics@​2.1.3
  • @​tinacms/graphql@​2.4.11
  • @​tinacms/app@​2.5.13

@​tinacms/cli@​2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

@​tinacms/cli@​2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

  MediaManager.rename() dispatches media:rename:start, media:rename:success and media:rename:failure.

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.7.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

Patch Changes

• #7476 f48009e Thanks @​kulesy! - chore(tinacms-pkgs): point repository.directory at each package's own folder

  Eight packages declared a repository.directory copied from whichever package they were forked from, so the "repository" link on their npm pages resolved to unrelated source. Also drops a dead generate:schema script from @tinacms/metrics, @tinacms/cli and @tinacms/schema-tools - it referenced a scripts/generateSchema.js that has never existed in the repo and nothing invoked it.

• #7491 9fa7a4f Thanks @​kulesy! - Surface the real error from TinaCloud when the tinacms build schema checks fail. Previously both remote checks read the response body without looking at the HTTP status or an errors array, so any server-side error was reported as "The remote GraphQL schema does not exist. Check indexing for this branch." (or its Tina schema equivalent), pointing users at indexing when indexing was fine. Both checks now throw with the server's own error message, include the HTTP status code for non-2xx responses, report an unparseable response body instead of failing with a JSON syntax error, and keep the "does not exist" message only for a successful response that genuinely contains no schema. When the server reports that DocumentFilter or DocumentMutation has no fields, the error also points at a stale tina/tina-lock.json, since that means the indexed schema has no collections.

• Updated dependencies [d340dab, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, 9a7092d, d340dab, aa686c6, 37f2e6a, d340dab]:

  • @​tinacms/schema-tools@​2.10.0
  • tinacms@3.13.0
  • @​tinacms/metrics@​2.1.3
  • @​tinacms/graphql@​2.4.11
  • @​tinacms/app@​2.5.13

2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

... (truncated)

Commits

• e9e1f17 Version Packages (#7487)
• 9fa7a4f fix(@​tinacms/cli): surface remote GraphQL errors in schema check (#7491)
• fd6aaaf ✨ Filter the media manager by file type (#7477)
• f48009e chore(tinacms-pkgs): point repository.directory at each package's own folder ...
• f9f6a50 Version Packages (#7443)
• 00a8b82 🧹 Drop three unused deps and bump cloudinary to clear install warnings (#7468)
• ab7ef60 fix(deps): move @​tinacms/cli off the vulnerable js-yaml 4.1.1 (#7447)
• 7e8818b Version Packages (#7287)
• 4b7d9b9 feat: add tina-markdown web component (#7392)
• ece366b feat(media): add a Rename action to the Media Manager (local media store) (#7...
• Additional commits viewable in compare view

Updates @tinacms/app from 2.5.8 to 2.5.13

Release notes

Sourced from @​tinacms/app's releases.

@​tinacms/app@​2.5.13

Patch Changes

• #7486 d340dab Thanks @​kulesy! - Session expiry during a visual-editing save no longer paints the generic "There was a problem saving your document" dialog over the login modal; the save handler now lets SessionExpiredError pass through like the admin's other save paths.

• Updated dependencies [d0593a3, dbd9234, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, d340dab, aa686c6, 16b9ca1, 37f2e6a]:

  • @​tinacms/mdx@​2.2.2
  • tinacms@3.13.0

@​tinacms/app@​2.5.12

Patch Changes

• #7469 e24fc0e Thanks @​joshbermanssw! - Bump the final-form family to the TypeScript releases

  final-form 4.20.10 → ^5.0.1, final-form-arrays ^3.1.0 → ^4.0.1, react-final-form ^6.5.9 → ^7.0.1. All three majors are the same event: a coordinated Flow → TypeScript rewrite published on 2025-06-07 and labelled as carrying no API changes. react-final-form@7 is where React 19 was added to the peer range, which clears the last unmet peer warning on install outside the GraphiQL chain.

  They must move together because each peers on the next: react-final-form@7 requires final-form@^5, and final-form-arrays@3 peers on final-form@^4. final-form-set-field-data stays put — its peer is >=1.2.0.

• #7433 5544a42 Thanks @​fetzu! - Move the GraphQL playground off the 2023 graphiql pre-release (3.0.0-alpha.1) to ^4.1.2.

  The catalog pinned an exact alpha published four days before stable 3.0.0, so no downstream consumer could override it. It carried @graphiql/react@0.18.0 → markdown-it@12.3.2 → linkify-it@3.0.3, keeping GHSA-6v5v-wf23-fmfq (markdown-it) and GHSA-22p9-wv53-3rq4 / GHSA-v245-v573-v5vm (linkify-it) alive for everyone installing @tinacms/app.

  Bumping graphiql alone was not enough: both @graphiql/react and typedoc declare markdown-it: ^14.1.0, and pnpm deduped that to 14.1.0 — below the 14.1.2 fix. A markdown-it: ^14.3.0 override resolves both chains to patched versions (markdown-it@14.3.0, linkify-it@5.0.2).

  graphiql 5 was evaluated and deliberately not taken: it replaces CodeMirror with a bundled Monaco (undoing the recent 73 MB monaco-editor removal, and requiring a setup-workers import that changes the Vite build contract for every consumer building @tinacms/app from source), and it drops the controlled query / variables props the playground's "Queries" sidebar depends on. Version 4 keeps CodeMirror and that prop contract, so the migration is the CSS import path plus one latent-bug fix.

  defaultTabs={[]} is removed. An empty array is a valid-looking but impossible state — zero tabs — and v4 dereferences tabs[activeTabIndex] when recording history, so executing any query crashed the playground with "Cannot read properties of undefined (reading 'query')". v3 only survived it because a ?? short-circuit happened to skip the same lookup. Without the prop, GraphiQL creates the single default tab seeded from query/variables, which is what the playground wanted.

• Updated dependencies [e24fc0e, d7cdea7, 4f90806, 00a8b82, 00a8b82, e24fc0e, 8d94e35, e24fc0e, 4d08c25, 37ca62b, e24fc0e, de5c7d7, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/mdx@​2.2.1

@​tinacms/app@​2.5.11

Patch Changes

• #7429 7df6e04 Thanks @​wicksipedia! - Switching a rich-text field to raw markdown no longer blanks the whole admin.

  Two things could take the editing session down. The raw editor arrives as a lazy chunk, so a failed fetch after a deploy or on a flaky connection tore the page down. It also serializes the field while rendering, so content it cannot represent threw with the chunk already loaded. Applying inline code and then bolding a word inside it was enough. Either way you got a blank page: no message, no way back, and unsaved work in the other fields gone with it.

  The failure now stays inside the field it came from. You get the thrown message, which for the formatting case names what to undo, and a button back to the rich-text editor.

• #7218 4499dcb Thanks @​wicksipedia! - Remove typescript from @tinacms/app's production dependencies.

  It was declared in both dependencies and devDependencies, but nothing in src/ imports it — the package ships raw source and is compiled by @tinacms/cli. Every TinaCMS user was installing a second copy of the TypeScript compiler (~23 MB) for nothing. It remains a devDependency for type-checking.

• #7388 17931b7 Thanks @​brookjeynes-ssw! - feat: add announcements banner

• #7216 cf75e5b Thanks @​wicksipedia! - Collapse three icon libraries into lucide-react (~85 MB).

  tinacms declared react-icons (84 MB), lucide-react (32 MB) and @heroicons/react as production dependencies, so every user installed all three. Icon usage is entirely internal admin chrome — there is no icon-picker, no icon schema field type, and no dynamic whole-set import — so react-icons and @heroicons/react have been removed in favour of lucide-react, which was already the de-facto house set.

... (truncated)

Changelog

Sourced from @​tinacms/app's changelog.

2.5.13

Patch Changes

• #7486 d340dab Thanks @​kulesy! - Session expiry during a visual-editing save no longer paints the generic "There was a problem saving your document" dialog over the login modal; the save handler now lets SessionExpiredError pass through like the admin's other save paths.

• Updated dependencies [d0593a3, dbd9234, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, d340dab, aa686c6, 16b9ca1, 37f2e6a]:

  • @​tinacms/mdx@​2.2.2
  • tinacms@3.13.0

2.5.12

Patch Changes

• #7469 e24fc0e Thanks @​joshbermanssw! - Bump the final-form family to the TypeScript releases

  final-form 4.20.10 → ^5.0.1, final-form-arrays ^3.1.0 → ^4.0.1, react-final-form ^6.5.9 → ^7.0.1. All three majors are the same event: a coordinated Flow → TypeScript rewrite published on 2025-06-07 and labelled as carrying no API changes. react-final-form@7 is where React 19 was added to the peer range, which clears the last unmet peer warning on install outside the GraphiQL chain.

  They must move together because each peers on the next: react-final-form@7 requires final-form@^5, and final-form-arrays@3 peers on final-form@^4. final-form-set-field-data stays put — its peer is >=1.2.0.

• #7433 5544a42 Thanks @​fetzu! - Move the GraphQL playground off the 2023 graphiql pre-release (3.0.0-alpha.1) to ^4.1.2.

  The catalog pinned an exact alpha published four days before stable 3.0.0, so no downstream consumer could override it. It carried @graphiql/react@0.18.0 → markdown-it@12.3.2 → linkify-it@3.0.3, keeping GHSA-6v5v-wf23-fmfq (markdown-it) and GHSA-22p9-wv53-3rq4 / GHSA-v245-v573-v5vm (linkify-it) alive for everyone installing @tinacms/app.

  Bumping graphiql alone was not enough: both @graphiql/react and typedoc declare markdown-it: ^14.1.0, and pnpm deduped that to 14.1.0 — below the 14.1.2 fix. A markdown-it: ^14.3.0 override resolves both chains to patched versions (markdown-it@14.3.0, linkify-it@5.0.2).

  graphiql 5 was evaluated and deliberately not taken: it replaces CodeMirror with a bundled Monaco (undoing the recent 73 MB monaco-editor removal, and requiring a setup-workers import that changes the Vite build contract for every consumer building @tinacms/app from source), and it drops the controlled query / variables props the playground's "Queries" sidebar depends on. Version 4 keeps CodeMirror and that prop contract, so the migration is the CSS import path plus one latent-bug fix.

  defaultTabs={[]} is removed. An empty array is a valid-looking but impossible state — zero tabs — and v4 dereferences tabs[activeTabIndex] when recording history, so executing any query crashed the playground with "Cannot read properties of undefined (reading 'query')". v3 only survived it because a ?? short-circuit happened to skip the same lookup. Without the prop, GraphiQL creates the single default tab seeded from query/variables, which is what the playground wanted.

• Updated dependencies [e24fc0e, d7cdea7, 4f90806, 00a8b82, 00a8b82, e24fc0e, 8d94e35, e24fc0e, 4d08c25, 37ca62b, e24fc0e, de5c7d7, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/mdx@​2.2.1

2.5.11

Patch Changes

• #7429 7df6e04 Thanks @​wicksipedia! - Switching a rich-text field to raw markdown no longer blanks the whole admin.

  Two things could take the editing session down. The raw editor arrives as a lazy chunk, so a failed fetch after a deploy or on a flaky connection tore the page down. It also serializes the field while rendering, so content it cannot represent threw with the chunk already loaded. Applying inline code and then bolding a word inside it was enough. Either way you got a blank page: no message, no way back, and unsaved work in the other fields gone with it.

  The failure now stays inside the field it came from. You get the thrown message, which for the formatting case names what to undo, and a button back to the rich-text editor.

• #7218 4499dcb Thanks @​wicksipedia! - Remove typescript from @tinacms/app's production dependencies.

  It was declared in both dependencies and devDependencies, but nothing in src/ imports it — the package ships raw source and is compiled by @tinacms/cli. Every TinaCMS user was installing a second copy of the TypeScript compiler (~23 MB) for nothing. It remains a devDependency for type-checking.

• #7388 17931b7 Thanks @​brookjeynes-ssw! - feat: add announcements banner

... (truncated)

Commits

• e9e1f17 Version Packages (#7487)
• d340dab fix(tinacms): detect session expiry at the content API client (#7486)
• f9f6a50 Version Packages (#7443)
• 5544a42 fix(@​tinacms/app): move graphiql off the 2023 pre-release pin (#7433)
• 7e8818b Version Packages (#7287)
• 17931b7 feat: add announcements banner (#7388)
• 7df6e04 fix(@​tinacms/app): stop a failed raw markdown editor blanking the whole admin...

[dependabot]

Labels

The following labels could not be found: Type: Dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 11, 2026 6:35am UTC