Bump tinacms from 2.8.3 to 3.12.1

[dependabot]

Bumps tinacms from 2.8.3 to 3.12.1.

Release notes

Sourced from tinacms's releases.

tinacms@3.12.1

Patch Changes

• #7469 e24fc0e Thanks @​joshbermanssw! - Bump the final-form family to the TypeScript releases

  final-form 4.20.10 → ^5.0.1, final-form-arrays ^3.1.0 → ^4.0.1, react-final-form ^6.5.9 → ^7.0.1. All three majors are the same event: a coordinated Flow → TypeScript rewrite published on 2025-06-07 and labelled as carrying no API changes. react-final-form@7 is where React 19 was added to the peer range, which clears the last unmet peer warning on install outside the GraphiQL chain.

  They must move together because each peers on the next: react-final-form@7 requires final-form@^5, and final-form-arrays@3 peers on final-form@^4. final-form-set-field-data stays put — its peer is >=1.2.0.

• #7472 d7cdea7 Thanks @​kulesy! - Fix Button and IconButton not passing disabled to the DOM. Both components used the prop only to pick styling (pointer-events-none), which blocks the pointer but not the keyboard, so every disabled button in the CMS stayed focusable and could still be activated with Enter or Space. busy is now treated as disabled too, closing a double-submit path on in-flight buttons. disabled is omitted when Button renders as a tag that does not support it (as='a').

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• #7469 e24fc0e Thanks @​joshbermanssw! - Declare the field props that react-final-form's index signature used to cover

  FieldRenderProps carried [otherProp: string]: any in v6, so the extras FieldsBuilder passes to every field plugin — tinaForm, index, children, experimental_focusIntent — type-checked implicitly. v7's TypeScript rewrite dropped that index signature, so they are now declared on FieldProps directly. The rich-text plugin's rawMode, setRawMode and rawEditor are declared on its own props rather than the shared type.

  No runtime change; these props were always being passed.

• #6763 8d94e35 Thanks @​kulesy! - Fix "Save to new branch" failing with "Branch operation failed" when the derived branch name is not a valid Git ref, e.g. when a collection's path has a trailing slash, producing content/articles//foo.mdx and the invalid ref tina/articles//foo. The default branch name derived from the file path, and any user-typed name, are now normalised to a valid ref: repeated and leading/trailing slashes collapse, characters Git forbids in refs (whitespace, control characters, ~ ^ : ? * [ \ and the @{ sequence) become hyphens, .. runs collapse, and leading dots and trailing . / .lock are stripped per path component. Saving is disabled while the name normalises to an empty string. The same normalisation now runs when creating a branch from the branch switcher and from the deleted-branch recovery modal, and the duplicated formatBranchName helpers are unified into a single util (the legacy branch switcher previously deleted invalid characters; it now replaces them with hyphens like the main switcher).

• #7469 e24fc0e Thanks @​joshbermanssw! - Add data-test hooks to group-list and blocks field controls

  Mirrors the hooks already on simple list fields, so end-to-end tests can target the add button and field wrapper of an object list or a blocks field without depending on Tailwind classes. Nested fields carry their full path, e.g. add-item-blocks.0.actions.

• #7483 4d08c25 Thanks @​kulesy! - Fix two admin regressions that appear once the TinaCloud session check starts failing. Making the collection list settle instead of spinning left the previously fetched data in place, so switching collections rendered the last collection's documents under the new collection's heading; on a fresh mount it left collection undefined with no error set, so GetCollection ran its auto-open effect against it and threw, which the top-level error boundary caught and replaced the admin with a raw TypeError card. A failed session check now sends the user straight back to the login modal with a "Your session has ended" message, and signing back in returns them to the page they were on. GetCollection and GetDocument also stop handing undefined to their children, showing an "Unable to load" popup for non-auth load failures, and GetCollection's auto-open effect bails out early, which clears the same crash on a failed fetchCollection.

• #7445 37ca62b Thanks @​kulesy! - Skip TinaCloud identity requests when no auth token is stored. Logged-out admin loads no longer produce misleading 401/CORS console errors; a clear console message now points at the login popup console instead. Also fixes an unawaited auth guard in GetDocument, stops the document view from loading forever when that guard rejects the request, and fixes an unhandled promise rejection when the project settings request fails.

• #7469 e24fc0e Thanks @​joshbermanssw! - Add data-test hooks to list field controls

  The add and delete buttons on list: true fields had no stable selector, so end-to-end tests had to target Tailwind classes. Adds data-test="list-<name>" on the field wrapper, data-test="add-item-<name>" on the add button, and data-test="delete-item-<name>.<index>" on the delete button shared with group-list and blocks fields.

  Every hook carries the full field path. The wrapper hook lands on the outer field wrapper, so a nested list's delete buttons are descendants of the outer list's wrapper; a bare id would make [data-test="list-x"] [data-test="delete-item"] match the wrong row once lists nest.

• #7445 37ca62b Thanks @​kulesy! - Fix the collection list and collection search hanging on the loading screen when the session check says the user is not signed in. Both now settle and render instead of spinning until the page is reloaded.

• Updated dependencies [4f90806, 00a8b82, 00a8b82, de5c7d7]:

  • @​tinacms/mdx@​2.2.1
  • @​tinacms/search@​1.2.24
  • @​tinacms/bridge@​0.3.1
  • @​tinacms/schema-tools@​2.9.0

tinacms@3.12.0

Minor Changes

• #7391 ece366b Thanks @​Aibono1225! - Add a Rename action to the Media Manager, backed by the local dev server.

... (truncated)

Changelog

Sourced from tinacms's changelog.

3.12.1

Patch Changes

• #7469 e24fc0e Thanks @​joshbermanssw! - Bump the final-form family to the TypeScript releases

  final-form 4.20.10 → ^5.0.1, final-form-arrays ^3.1.0 → ^4.0.1, react-final-form ^6.5.9 → ^7.0.1. All three majors are the same event: a coordinated Flow → TypeScript rewrite published on 2025-06-07 and labelled as carrying no API changes. react-final-form@7 is where React 19 was added to the peer range, which clears the last unmet peer warning on install outside the GraphiQL chain.

  They must move together because each peers on the next: react-final-form@7 requires final-form@^5, and final-form-arrays@3 peers on final-form@^4. final-form-set-field-data stays put — its peer is >=1.2.0.

• #7472 d7cdea7 Thanks @​kulesy! - Fix Button and IconButton not passing disabled to the DOM. Both components used the prop only to pick styling (pointer-events-none), which blocks the pointer but not the keyboard, so every disabled button in the CMS stayed focusable and could still be activated with Enter or Space. busy is now treated as disabled too, closing a double-submit path on in-flight buttons. disabled is omitted when Button renders as a tag that does not support it (as='a').

• #7468 00a8b82 Thanks @​joshbermanssw! - Drop the deprecated crypto-js dependency

  @tinacms/cli used it in one place, to generate the default NEXTAUTH_SECRET offered during tinacms init. crypto.lib.WordArray.random(16).toString() is replaced with randomBytes(16).toString('hex') from node:crypto, which produces the same 32-character hex string. tinacms declared the dependency without ever importing it.

• #7469 e24fc0e Thanks @​joshbermanssw! - Declare the field props that react-final-form's index signature used to cover

  FieldRenderProps carried [otherProp: string]: any in v6, so the extras FieldsBuilder passes to every field plugin — tinaForm, index, children, experimental_focusIntent — type-checked implicitly. v7's TypeScript rewrite dropped that index signature, so they are now declared on FieldProps directly. The rich-text plugin's rawMode, setRawMode and rawEditor are declared on its own props rather than the shared type.

  No runtime change; these props were always being passed.

• #6763 8d94e35 Thanks @​kulesy! - Fix "Save to new branch" failing with "Branch operation failed" when the derived branch name is not a valid Git ref, e.g. when a collection's path has a trailing slash, producing content/articles//foo.mdx and the invalid ref tina/articles//foo. The default branch name derived from the file path, and any user-typed name, are now normalised to a valid ref: repeated and leading/trailing slashes collapse, characters Git forbids in refs (whitespace, control characters, ~ ^ : ? * [ \ and the @{ sequence) become hyphens, .. runs collapse, and leading dots and trailing . / .lock are stripped per path component. Saving is disabled while the name normalises to an empty string. The same normalisation now runs when creating a branch from the branch switcher and from the deleted-branch recovery modal, and the duplicated formatBranchName helpers are unified into a single util (the legacy branch switcher previously deleted invalid characters; it now replaces them with hyphens like the main switcher).

• #7469 e24fc0e Thanks @​joshbermanssw! - Add data-test hooks to group-list and blocks field controls

  Mirrors the hooks already on simple list fields, so end-to-end tests can target the add button and field wrapper of an object list or a blocks field without depending on Tailwind classes. Nested fields carry their full path, e.g. add-item-blocks.0.actions.

• #7483 4d08c25 Thanks @​kulesy! - Fix two admin regressions that appear once the TinaCloud session check starts failing. Making the collection list settle instead of spinning left the previously fetched data in place, so switching collections rendered the last collection's documents under the new collection's heading; on a fresh mount it left collection undefined with no error set, so GetCollection ran its auto-open effect against it and threw, which the top-level error boundary caught and replaced the admin with a raw TypeError card. A failed session check now sends the user straight back to the login modal with a "Your session has ended" message, and signing back in returns them to the page they were on. GetCollection and GetDocument also stop handing undefined to their children, showing an "Unable to load" popup for non-auth load failures, and GetCollection's auto-open effect bails out early, which clears the same crash on a failed fetchCollection.

• #7445 37ca62b Thanks @​kulesy! - Skip TinaCloud identity requests when no auth token is stored. Logged-out admin loads no longer produce misleading 401/CORS console errors; a clear console message now points at the login popup console instead. Also fixes an unawaited auth guard in GetDocument, stops the document view from loading forever when that guard rejects the request, and fixes an unhandled promise rejection when the project settings request fails.

• #7469 e24fc0e Thanks @​joshbermanssw! - Add data-test hooks to list field controls

  The add and delete buttons on list: true fields had no stable selector, so end-to-end tests had to target Tailwind classes. Adds data-test="list-<name>" on the field wrapper, data-test="add-item-<name>" on the add button, and data-test="delete-item-<name>.<index>" on the delete button shared with group-list and blocks fields.

  Every hook carries the full field path. The wrapper hook lands on the outer field wrapper, so a nested list's delete buttons are descendants of the outer list's wrapper; a bare id would make [data-test="list-x"] [data-test="delete-item"] match the wrong row once lists nest.

• #7445 37ca62b Thanks @​kulesy! - Fix the collection list and collection search hanging on the loading screen when the session check says the user is not signed in. Both now settle and render instead of spinning until the page is reloaded.

• Updated dependencies [4f90806, 00a8b82, 00a8b82, de5c7d7]:

  • @​tinacms/mdx@​2.2.1
  • @​tinacms/search@​1.2.24
  • @​tinacms/bridge@​0.3.1
  • @​tinacms/schema-tools@​2.9.0

3.12.0

Minor Changes

... (truncated)

Commits

• f9f6a50 Version Packages (#7443)
• 4d08c25 fix(tinacms): guard the admin against an undefined collection or document (#7...
• d7cdea7 fix(tinacms): Button and IconButton never passed disabled to the DOM (#7472)
• e24fc0e ⬆️ Bump the final-form family to the TypeScript releases (#7469)
• 00a8b82 🧹 Drop three unused deps and bump cloudinary to clear install warnings (#7468)
• 74ae2c5 revert the media accept commits that bypassed review
• a711b88 image field plugin accpet
• 57ea7f2 media manager accept
• 780ab54 media contract
• 8d94e35 fix(tinacms): normalise slashes in editorial-workflow branch name (#6763)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tinacms since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
allocin.it	Error		Aug 27, 2026 6:42pm