chore(deps): bump directus from 11.17.4 to 12.0.0 in /cms

[dependabot]

Bumps directus from 11.17.4 to 12.0.0.

Release notes

Sourced from directus's releases.

v12.0.0

License Enforcement

[!NOTE] Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

Directus 12 introduces active license enforcement. Self-hosted instances run on the Core tier by default. Higher limits and additional features require a valid license. See Licensing for a complete overview.

This change affects instances previously using features that now require a license, including:

• SSO — SSO login will no longer work. Users who authenticate through SSO will be unable to log in and must be converted to email and password users to regain access.
• Custom permission rules — custom rules on access policies will be ignored.
• Custom or self-hosted LLMs — connections to custom LLMs will no longer work.
• AI Translations — AI-powered translations are not available.

Enforcement is immediate on new instances. Instances upgrading to Directus 12 get a 30-day grace period from the time of upgrade, after which these are enforced unless a license that enables them is configured.

If your instance uses any of these features, add a license that includes them to continue to do so. If your instance uses only Core tier features, no action is required.

Changed license to MSCL-1.0-GPL (#27417)

• Breaking Change: Relicensed from BUSL-1.1 to MSCL-1.0-GPL (Monospace Sustainable Core License, Version 1.0).

Changed the default of IP_TRUST_PROXY from true to false to harden the default deployment against IP spoofing. (#27607)

• The IP_TRUST_PROXY default was changed from true to false. If you run Directus behind a reverse proxy and rely on X-Forwarded-For (or similar) headers for client IP resolution, you must now explicitly set IP_TRUST_PROXY to true or a more specific trust configuration.

Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160)

• Health checks are cached by default and shared across multi-instance deployments
  • /server/health will return 404 for unauthenticated requests, use /server/ping for liveness checks
  • cache, rateLimiter and rateLimiterGlobal health checks have been replaced by a generic redis check using the redis: prefix

Introduced VERSION_KEY_ constants and renamed main to published @​alvarosabu (#27397)*

• Backward Compatibility: You can now use ?version=published to resolve versions of the main item(s) via the version query parameter. For backward compatibility, ?version=main will continue to work.

Replaced status field with archived boolean in collection settings @​alvarosabu (#27397)

• Backward Compatibility: Existing collections with string-based status fields continue to work unchanged; newly created collections now default to a boolean "Archived" field instead of the string "Status" field

Deprecated the VResizeable component @​formfcw (#27437)

• Deprecation for extensions: The globally registered VResizeable component has been deprecated. Extension authors using <v-resizeable> should migrate to @directus/vue-split-panel or their own implementation.

Updated type system, borders, and theme variables @​formfcw (#27437)

• Potential breaking change for theme extensions: headerShadow and sidebarShadow removed from LayoutConfig interface
• Potential breaking change for theme extensions: boxShadow removed from header theme rules schema
• Potential breaking change for theme extensions: sidebarShadow no longer exposed in layout wrapper state

Updated module navigation bar spacing and styling @​HZooly (#27437)

• Potential breaking change in theme extensions: Removed navigation.project.borderColor / navigation.project.borderWidth / navigation.project.background from theming. No action is required — these props will simply no longer have any effect.

Locked published items in versioned collections from editing and added a header action button to edit in the draft version @​alvarosabu (#27397)

• Breaking change — new behavior for versioned collections Published items in versioned collections are now locked. Edits must be made through the draft version.

... (truncated)

Commits

• 33ec938 Release 12.0.0 (#27709)
• 4c32fcd Comment out tag check (#27708)
• 7ba4efb Add share to cache key (#27707)
• e522e02 Add TresJS shader background for public pages (#27428)
• 584dcff bump shell-quote (#27706)
• 0561a1f Vitest dependency update (#27686)
• ea4b5e8 Fix Postgres numeric overflow errors being misattributed to an unrelated fiel...
• 7efb208 Fix outdated updateExtension command and add missing deleteExtension and ...
• 7f31c4c Improve license test coverage (#27662)
• 1c2d226 Enable Anthropic prompt caching for the AI Assistant (#27545)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.