chore(deps-dev): bump @tinacms/cli from 2.4.4 to 2.7.0

[dependabot]

Bumps @tinacms/cli from 2.4.4 to 2.7.0.

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.7.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

Patch Changes

• #7476 f48009e Thanks @​kulesy! - chore(tinacms-pkgs): point repository.directory at each package's own folder

  Eight packages declared a repository.directory copied from whichever package they were forked from, so the "repository" link on their npm pages resolved to unrelated source. Also drops a dead generate:schema script from @tinacms/metrics, @tinacms/cli and @tinacms/schema-tools - it referenced a scripts/generateSchema.js that has never existed in the repo and nothing invoked it.

• #7491 9fa7a4f Thanks @​kulesy! - Surface the real error from TinaCloud when the tinacms build schema checks fail. Previously both remote checks read the response body without looking at the HTTP status or an errors array, so any server-side error was reported as "The remote GraphQL schema does not exist. Check indexing for this branch." (or its Tina schema equivalent), pointing users at indexing when indexing was fine. Both checks now throw with the server's own error message, include the HTTP status code for non-2xx responses, report an unparseable response body instead of failing with a JSON syntax error, and keep the "does not exist" message only for a successful response that genuinely contains no schema. When the server reports that DocumentFilter or DocumentMutation has no fields, the error also points at a stale tina/tina-lock.json, since that means the indexed schema has no collections.

• Updated dependencies [d340dab, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, 9a7092d, d340dab, aa686c6, 37f2e6a, d340dab]:

  • @​tinacms/schema-tools@​2.10.0
  • tinacms@3.13.0
  • @​tinacms/metrics@​2.1.3
  • @​tinacms/graphql@​2.4.11
  • @​tinacms/app@​2.5.13

@​tinacms/cli@​2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

@​tinacms/cli@​2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

  MediaManager.rename() dispatches media:rename:start, media:rename:success and media:rename:failure.

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.7.0

Minor Changes

• #7477 fd6aaaf Thanks @​joshbermanssw! - Make the image field's accept work on list: true fields, and filter by extension server-side everywhere. The list variant built each item input from a bare {component: 'image'}, so a gallery got no dropzone restriction and no insert guard. The local dev server now accepts an ext param on /media/list, filtering before it paginates, so the media manager's type filter no longer narrows a page after the fact. A staticMedia store reports no extension filtering and hides the control rather than showing one that would leave a near-empty grid.

Patch Changes

• #7476 f48009e Thanks @​kulesy! - chore(tinacms-pkgs): point repository.directory at each package's own folder

  Eight packages declared a repository.directory copied from whichever package they were forked from, so the "repository" link on their npm pages resolved to unrelated source. Also drops a dead generate:schema script from @tinacms/metrics, @tinacms/cli and @tinacms/schema-tools - it referenced a scripts/generateSchema.js that has never existed in the repo and nothing invoked it.

• #7491 9fa7a4f Thanks @​kulesy! - Surface the real error from TinaCloud when the tinacms build schema checks fail. Previously both remote checks read the response body without looking at the HTTP status or an errors array, so any server-side error was reported as "The remote GraphQL schema does not exist. Check indexing for this branch." (or its Tina schema equivalent), pointing users at indexing when indexing was fine. Both checks now throw with the server's own error message, include the HTTP status code for non-2xx responses, report an unparseable response body instead of failing with a JSON syntax error, and keep the "does not exist" message only for a successful response that genuinely contains no schema. When the server reports that DocumentFilter or DocumentMutation has no fields, the error also points at a stale tina/tina-lock.json, since that means the indexed schema has no collections.

• Updated dependencies [d340dab, 57707bf, f48009e, 2264a16, fd6aaaf, fd6aaaf, 7c21906, 9a7092d, d340dab, aa686c6, 37f2e6a, d340dab]:

  • @​tinacms/schema-tools@​2.10.0
  • tinacms@3.13.0
  • @​tinacms/metrics@​2.1.3
  • @​tinacms/graphql@​2.4.11
  • @​tinacms/app@​2.5.13

2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

... (truncated)

Commits

• e9e1f17 Version Packages (#7487)
• 9fa7a4f fix(@​tinacms/cli): surface remote GraphQL errors in schema check (#7491)
• fd6aaaf ✨ Filter the media manager by file type (#7477)
• f48009e chore(tinacms-pkgs): point repository.directory at each package's own folder ...
• f9f6a50 Version Packages (#7443)
• 00a8b82 🧹 Drop three unused deps and bump cloudinary to clear install warnings (#7468)
• ab7ef60 fix(deps): move @​tinacms/cli off the vulnerable js-yaml 4.1.1 (#7447)
• 7e8818b Version Packages (#7287)
• 4b7d9b9 feat: add tina-markdown web component (#7392)
• ece366b feat(media): add a Rename action to the Media Manager (local media store) (#7...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
modernplatforms.dev	Ready	Preview, v0	Sep 10, 2026 10:43pm UTC