Skip to content

chore(deps-dev): bump @tinacms/cli from 2.4.4 to 2.5.3 - #83

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tinacms/cli-2.5.3
Closed

chore(deps-dev): bump @tinacms/cli from 2.4.4 to 2.5.3#83
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/tinacms/cli-2.5.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Bumps @tinacms/cli from 2.4.4 to 2.5.3.

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.5.3

Patch Changes

@​tinacms/cli@​2.5.2

Patch Changes

  • #7111 211997c Thanks @​Aibono1225! - Reject cross-origin state-changing requests on the dev server. Previously the cors middleware only suppressed response headers, so an attacker-controlled page could still drive a cross-origin multipart upload to completion (writing files into the media root). State-changing routes (/media/upload, /media DELETE, searchIndex POST/DELETE, and /graphql POST) now reject disallowed origins server-side with a 403.

  • #7113 4ce8757 Thanks @​Aibono1225! - Remove the unused legacy Express dev server (src/server). It was superseded by the Vite-based dev server years ago and is no longer reachable from the CLI. Its compiled output was still being published and deep-importable as @tinacms/cli/dist/server, exposing an un-gated media upload handler; deleting it removes that dead code path. The active tinacms dev server is unaffected.

  • #7088 d44558e Thanks @​Aibono1225! - Fix media upload/delete paths to prevent access to storage keys outside mediaRoot.

  • #7095 39c06f7 Thanks @​Aibono1225! - Harden npm publish pipeline and package manifests

  • Updated dependencies [c1994b3, e74a7d6, caadf1f, 5ba482b, 8a86ffa, 19fcbdd, 871ce31, d44558e, 39c06f7, 4801b21]:

    • tinacms@3.9.4
    • @​tinacms/schema-tools@​2.8.2
    • @​tinacms/app@​2.5.7
    • @​tinacms/graphql@​2.4.6
    • @​tinacms/search@​1.2.20
    • @​tinacms/metrics@​2.1.1

@​tinacms/cli@​2.5.1

Patch Changes

@​tinacms/cli@​2.5.0

Minor Changes

  • #7049 29a0e2e Thanks @​0xharkirat! - Add Astro as a first-class framework in tinacms init (now listed first). Selecting Astro:

    • auto-sets the public assets folder to public (no prompt) and wraps the package.json dev/build scripts (tinacms dev -c "astro dev", tinacms build && astro build)
    • installs @tinacms/astro plus an @astrojs/node adapter pinned to the project's Astro major (node 9 for Astro 5, node 10 for Astro 6), and matched react/react-dom (^18.3.1) as dev dependencies — the site stays React-free, but the admin SPA is built with React and a bare Astro project ships none (skipped when the project already declares both)
    • wires astro.config for SSR + visual editing, or — when your config is already customized — prints exactly what to add
    • scaffolds a self-contained, fully editable visual-editing demo at /tinacms-demo: a dark hero whose eyebrow, headline, tagline, and both call-to-action buttons (label + link) are all click-to-edit, with scoped styles and a procedural SVG starfield (no CSS framework or image assets). CMS-editable button links are passed through sanitizeHref.

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.5.3

Patch Changes

2.5.2

Patch Changes

  • #7111 211997c Thanks @​Aibono1225! - Reject cross-origin state-changing requests on the dev server. Previously the cors middleware only suppressed response headers, so an attacker-controlled page could still drive a cross-origin multipart upload to completion (writing files into the media root). State-changing routes (/media/upload, /media DELETE, searchIndex POST/DELETE, and /graphql POST) now reject disallowed origins server-side with a 403.

  • #7113 4ce8757 Thanks @​Aibono1225! - Remove the unused legacy Express dev server (src/server). It was superseded by the Vite-based dev server years ago and is no longer reachable from the CLI. Its compiled output was still being published and deep-importable as @tinacms/cli/dist/server, exposing an un-gated media upload handler; deleting it removes that dead code path. The active tinacms dev server is unaffected.

  • #7088 d44558e Thanks @​Aibono1225! - Fix media upload/delete paths to prevent access to storage keys outside mediaRoot.

  • #7095 39c06f7 Thanks @​Aibono1225! - Harden npm publish pipeline and package manifests

  • Updated dependencies [c1994b3, e74a7d6, caadf1f, 5ba482b, 8a86ffa, 19fcbdd, 871ce31, d44558e, 39c06f7, 4801b21]:

    • tinacms@3.9.4
    • @​tinacms/schema-tools@​2.8.2
    • @​tinacms/app@​2.5.7
    • @​tinacms/graphql@​2.4.6
    • @​tinacms/search@​1.2.20
    • @​tinacms/metrics@​2.1.1

2.5.1

Patch Changes

2.5.0

Minor Changes

  • #7049 29a0e2e Thanks @​0xharkirat! - Add Astro as a first-class framework in tinacms init (now listed first). Selecting Astro:

    • auto-sets the public assets folder to public (no prompt) and wraps the package.json dev/build scripts (tinacms dev -c "astro dev", tinacms build && astro build)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps-dev): bump @tinacms/cli from 2.4.4 to 2.5.3
71768f7 
Bumps [@tinacms/cli](https://github.com/tinacms/tinacms/tree/HEAD/packages/@tinacms/cli) from 2.4.4 to 2.5.3.
- [Release notes](https://github.com/tinacms/tinacms/releases)
- [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/@tinacms/cli/CHANGELOG.md)
- [Commits](https://github.com/tinacms/tinacms/commits/@tinacms/cli@2.5.3/packages/@tinacms/cli)

---
updated-dependencies:
- dependency-name: "@tinacms/cli"
  dependency-version: 2.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 6, 2026
@vercel

vercel Bot commented Jul 6, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
modernplatforms.dev Ready Ready Preview, Comment, Open in v0 Jul 6, 2026 10:40pm

@dependabot dependabot Bot mentioned this pull request Jul 6, 2026
Closed
@dependabot @github

dependabot Bot commented on behalf of github Jul 13, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #85.

@dependabot dependabot Bot closed this Jul 13, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/tinacms/cli-2.5.3 branch July 13, 2026 22:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants