chore(deps-dev): bump @tinacms/cli from 2.4.4 to 2.5.5

[dependabot]

Bumps @tinacms/cli from 2.4.4 to 2.5.5.

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.5.5

Patch Changes

• Updated dependencies []:
  • @​tinacms/app@​2.5.9
  • @​tinacms/graphql@​2.4.8
  • tinacms@3.10.1
  • @​tinacms/search@​1.2.22

@​tinacms/cli@​2.5.4

Patch Changes

• #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

  Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

@​tinacms/cli@​2.5.3

Patch Changes

• #7157 aef9de0 Thanks @​joshbermanssw! - Bump @tailwindcss/typography to 0.5.20

• Updated dependencies [c809733, 3a1b39a, de4a807, 8497110, 22d0c0d, 5148d67, ff10e65, b53a51c]:

  • tinacms@3.10.0
  • @​tinacms/schema-tools@​2.8.3
  • @​tinacms/graphql@​2.4.7
  • @​tinacms/app@​2.5.8
  • @​tinacms/search@​1.2.21

@​tinacms/cli@​2.5.2

Patch Changes

• #7111 211997c Thanks @​Aibono1225! - Reject cross-origin state-changing requests on the dev server. Previously the cors middleware only suppressed response headers, so an attacker-controlled page could still drive a cross-origin multipart upload to completion (writing files into the media root). State-changing routes (/media/upload, /media DELETE, searchIndex POST/DELETE, and /graphql POST) now reject disallowed origins server-side with a 403.

• #7113 4ce8757 Thanks @​Aibono1225! - Remove the unused legacy Express dev server (src/server). It was superseded by the Vite-based dev server years ago and is no longer reachable from the CLI. Its compiled output was still being published and deep-importable as @tinacms/cli/dist/server, exposing an un-gated media upload handler; deleting it removes that dead code path. The active tinacms dev server is unaffected.

• #7088 d44558e Thanks @​Aibono1225! - Fix media upload/delete paths to prevent access to storage keys outside mediaRoot.

• #7095 39c06f7 Thanks @​Aibono1225! - Harden npm publish pipeline and package manifests

• Updated dependencies [c1994b3, e74a7d6, caadf1f, 5ba482b, 8a86ffa, 19fcbdd, 871ce31, d44558e, 39c06f7, 4801b21]:

  • tinacms@3.9.4
  • @​tinacms/schema-tools@​2.8.2
  • @​tinacms/app@​2.5.7
  • @​tinacms/graphql@​2.4.6
  • @​tinacms/search@​1.2.20
  • @​tinacms/metrics@​2.1.1

@​tinacms/cli@​2.5.1

Patch Changes

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.5.5

Patch Changes

• Updated dependencies []:
  • @​tinacms/app@​2.5.9
  • @​tinacms/graphql@​2.4.8
  • tinacms@3.10.1
  • @​tinacms/search@​1.2.22

2.5.4

Patch Changes

• #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

  Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

2.5.3

Patch Changes

• #7157 aef9de0 Thanks @​joshbermanssw! - Bump @tailwindcss/typography to 0.5.20

• Updated dependencies [c809733, 3a1b39a, de4a807, 8497110, 22d0c0d, 5148d67, ff10e65, b53a51c]:

  • tinacms@3.10.0
  • @​tinacms/schema-tools@​2.8.3
  • @​tinacms/graphql@​2.4.7
  • @​tinacms/app@​2.5.8
  • @​tinacms/search@​1.2.21

2.5.2

Patch Changes

• #7111 211997c Thanks @​Aibono1225! - Reject cross-origin state-changing requests on the dev server. Previously the cors middleware only suppressed response headers, so an attacker-controlled page could still drive a cross-origin multipart upload to completion (writing files into the media root). State-changing routes (/media/upload, /media DELETE, searchIndex POST/DELETE, and /graphql POST) now reject disallowed origins server-side with a 403.

• #7113 4ce8757 Thanks @​Aibono1225! - Remove the unused legacy Express dev server (src/server). It was superseded by the Vite-based dev server years ago and is no longer reachable from the CLI. Its compiled output was still being published and deep-importable as @tinacms/cli/dist/server, exposing an un-gated media upload handler; deleting it removes that dead code path. The active tinacms dev server is unaffected.

• #7088 d44558e Thanks @​Aibono1225! - Fix media upload/delete paths to prevent access to storage keys outside mediaRoot.

• #7095 39c06f7 Thanks @​Aibono1225! - Harden npm publish pipeline and package manifests

• Updated dependencies [c1994b3, e74a7d6, caadf1f, 5ba482b, 8a86ffa, 19fcbdd, 871ce31, d44558e, 39c06f7, 4801b21]:

  • tinacms@3.9.4
  • @​tinacms/schema-tools@​2.8.2
  • @​tinacms/app@​2.5.7
  • @​tinacms/graphql@​2.4.6
  • @​tinacms/search@​1.2.20
  • @​tinacms/metrics@​2.1.1

... (truncated)

Commits

• adeafbc Version Packages (#7174)
• f9d50a0 Version Packages (#7170)
• 0a927a4 Scope TinaCloud authorization to the site's configured clientID (#7168)
• a1ebeda Version Packages (#7130)
• 9fb743f Version Packages (#7060)
• 4ce8757 Remove the unused legacy Express dev server from @​tinacms/cli (#7113)
• 211997c Reject cross-origin state-changing requests on the dev server (#7111)
• 39c06f7 Harden npm publish pipeline and package manifests (#7095)
• b6f613b Version Packages (#7057)
• c823688 Version Packages (#7045)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
modernplatforms.dev	Ready	Preview, Comment, Open in v0	Jul 13, 2026 10:41pm

[dependabot]

Superseded by #88.