Bump @tinacms/cli from 2.5.3 to 2.6.1

[dependabot]

Bumps @tinacms/cli from 2.5.3 to 2.6.1.

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

@​tinacms/cli@​2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

  MediaManager.rename() dispatches media:rename:start, media:rename:success and media:rename:failure.

• #7323 4a19d66 Thanks @​joshbermanssw! - Add media-manager search and a folder/file filter, and refresh the grid.

  Search filters the library by file path (debounced, recursive across folders); the All | Folders | Files toggle narrows the view. Folders and files render in labelled sections, files show a type badge (JPEG/PNG/MP4…), and videos show a play overlay.

  Search works against both TinaCloud media and local dev media. The local dev-server media endpoint (@tinacms/cli) now honours a search query param, matching paths recursively within the requested folder (case-insensitive) and staying within the media root. Matching is on the folder-relative path, so a folder name matches the files beneath it, and matching folders surface as their own folder results (local dev media; TinaCloud parity to follow). Results are paginated with the same limit/cursor contract as an unfiltered listing.

  The search box is opt-in per media store via a new searchable flag on the MediaStore interface. The default (TinaCloud/local) store sets it; a custom or self-hosted store shows the box only once it sets searchable and reads options.search in its list(), so stores that don't support search don't get a box that returns unfiltered results.

  Also fixes the breadcrumb rendering a duplicate root crumb — and Back not returning to the root — for folder names that carry a trailing slash.

• #7392 4b7d9b9 Thanks @​brookjeynes-ssw! - feat: add tina-markdown web component feat: add visual-editing library for web components

• #7283 1c89c44 Thanks @​kulesy! - tinacms dev and tinacms build now warn at startup when the tinacms, @tinacms/graphql, or @tinacms/schema-tools versions resolved from the project don't satisfy the ranges the CLI was published with, or when two different copies of tinacms are installed. A held-back package (stale lockfile entry, partial upgrade, pnpm minimumReleaseAge) previously failed silently: the admin built fine but served an older tinacms where newer documented features were missing.

Patch Changes

• #7297 f74e2d9 Thanks @​wicksipedia! - Bump vite off the EOL 4.x line (^4.5.9, resolving to the last-ever 4.5.14) to ^6.4.3, and @vitejs/plugin-react 3 → 4, closing several path-traversal / file-disclosure advisories that were never backported to vite 4.x.

  Dev server: Vite 6 serves its dev endpoints (@vite/client, @react-refresh, and the SPA entry) under the configured base — Vite 4 served them at the server root. The injected dev HTML now prefixes those URLs with the admin base path, so tinacms dev loads the editor again instead of failing with "Failed loading TinaCMS assets".

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.6.1

Patch Changes

• #7454 41263f5 Thanks @​kulesy! - Bump js-yaml to 4.3.1, picking up an upstream security fix (GHSA-5p4m-2wfm-xmqj)

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• Updated dependencies [e24fc0e, 195087d, d7cdea7, 00a8b82, 00a8b82, 00a8b82, e24fc0e, 8d94e35, 5544a42, e24fc0e, 4d08c25, 37ca62b, e24fc0e, 37ca62b]:

  • tinacms@3.12.1
  • @​tinacms/app@​2.5.12
  • @​tinacms/graphql@​2.4.10
  • @​tinacms/metrics@​2.1.2
  • @​tinacms/search@​1.2.24
  • @​tinacms/schema-tools@​2.9.0

2.6.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

  Selecting a file in the media preview now offers Rename alongside Insert and Delete. The modal edits the basename, keeps the extension, previews the sanitised result using the same rules uploads apply, and reports collisions and missing files specifically instead of a generic failure. Every open media picker refreshes afterwards, and pickers previewing the renamed file follow it to its new path.

  Renaming does not update content that already references the old path — the modal says so explicitly.

  The action only appears when the media store implements rename. TinaMediaStore implements it for local development via a new POST /media/rename route on the CLI dev server; TinaCloud, static and self-hosted repo-media stores do not advertise it, so the action stays hidden there rather than failing on click. Third-party stores (S3, Cloudinary, DigitalOcean Spaces, Azure) can opt in by implementing MediaStore.rename.

  MediaManager.rename() dispatches media:rename:start, media:rename:success and media:rename:failure.

• #7323 4a19d66 Thanks @​joshbermanssw! - Add media-manager search and a folder/file filter, and refresh the grid.

  Search filters the library by file path (debounced, recursive across folders); the All | Folders | Files toggle narrows the view. Folders and files render in labelled sections, files show a type badge (JPEG/PNG/MP4…), and videos show a play overlay.

  Search works against both TinaCloud media and local dev media. The local dev-server media endpoint (@tinacms/cli) now honours a search query param, matching paths recursively within the requested folder (case-insensitive) and staying within the media root. Matching is on the folder-relative path, so a folder name matches the files beneath it, and matching folders surface as their own folder results (local dev media; TinaCloud parity to follow). Results are paginated with the same limit/cursor contract as an unfiltered listing.

  The search box is opt-in per media store via a new searchable flag on the MediaStore interface. The default (TinaCloud/local) store sets it; a custom or self-hosted store shows the box only once it sets searchable and reads options.search in its list(), so stores that don't support search don't get a box that returns unfiltered results.

  Also fixes the breadcrumb rendering a duplicate root crumb — and Back not returning to the root — for folder names that carry a trailing slash.

• #7392 4b7d9b9 Thanks @​brookjeynes-ssw! - feat: add tina-markdown web component feat: add visual-editing library for web components

• #7283 1c89c44 Thanks @​kulesy! - tinacms dev and tinacms build now warn at startup when the tinacms, @tinacms/graphql, or @tinacms/schema-tools versions resolved from the project don't satisfy the ranges the CLI was published with, or when two different copies of tinacms are installed. A held-back package (stale lockfile entry, partial upgrade, pnpm minimumReleaseAge) previously failed silently: the admin built fine but served an older tinacms where newer documented features were missing.

Patch Changes

• #7297 f74e2d9 Thanks @​wicksipedia! - Bump vite off the EOL 4.x line (^4.5.9, resolving to the last-ever 4.5.14) to ^6.4.3, and @vitejs/plugin-react 3 → 4, closing several path-traversal / file-disclosure advisories that were never backported to vite 4.x.

... (truncated)

Commits

• f9f6a50 Version Packages (#7443)
• 00a8b82 🧹 Drop three unused deps and bump cloudinary to clear install warnings (#7468)
• ab7ef60 fix(deps): move @​tinacms/cli off the vulnerable js-yaml 4.1.1 (#7447)
• 7e8818b Version Packages (#7287)
• 4b7d9b9 feat: add tina-markdown web component (#7392)
• ece366b feat(media): add a Rename action to the Media Manager (local media store) (#7...
• 643bd37 Fix: NextJS blog starter cli template grammatical error (#7360)
• 4a19d66 ✨ Add media manager search and folder/file filter (#7323)
• 74ea991 🐛 Move graphql-codegen to v7 — lodash ×6 → ×1 (~33 MB) (#7228)
• f74e2d9 fix(@​tinacms/cli): bump vite off EOL 4.x to 6.4.3 (#7212) (#7297)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
allocin.it	Ready	Preview	Aug 27, 2026 6:39pm