This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Affected surfaces
Summary
AI summaryBroad release touches Breaking Changes, Bug Fixes, New Features, and esm.
Full changelog
The following packages have been updated
@keystone-6/[email protected]
@keystone-6/[email protected]
@keystone-6/[email protected]
@keystone-6/[email protected]
@keystone-6/[email protected]
[email protected]
Breaking Changes
[core]Upgrades Prisma major version to 7.prismaand@prisma/clientare now peer dependencies of@keystone-6/core. You will need to install them in your project along with the relevant adapter for your database (e.g.@prisma/adapter-pg). Thedb.url,db.shadowDatabaseUrl, anddb.enableLoggingconfig options have been replaced with aprismaClientOptionsoption, this is a function which should return the configuring Prisma adapter and any other options you want to pass to the Prisma client. The Prisma Client is now generated intogenerated/prismaby default now (#9872) @emmatown[core]Removes thekeystone prismacommand, you should useprismadirectly. (#9872) @emmatown[core]Removes thekeystone migratecommands and the--with-migrationsoption, you should useprismadirectly. (#9872) @emmatown[core]Replaces@keystone-6/core/testing'sresetDatabasefunction with new implementations in@keystone-6/core/testing/postgresql,@keystone-6/core/testing/sqliteand@keystone-6/core/testing/mysql(#9872) @emmatown[auth, cloudinary, core, create-keystone-app, document-renderer, fields-document]Changes package to exclusively Node ESM. This is intended to be used byrequire(esm)and should not affect consumers beyond requiring a modern Node version.keystone buildoutputs are still CommonJS. (#9929) @emmatown[core]Moves the default field mode configuration fromui.*.defaultFieldModetofieldDefaults.ui.*.fieldModeon lists and field groups. (#9882) @emmatown[core]Fixes thepasswordfield to throw an error for inputs longer than 72 bytes when using the defaultbcryptkey derivation function (KDF) (#9486) @emmatown[core]Changes thesudoboolean on GraphQL schema extensions toscope, which is either'public'or'internal'. Code that previously checkedschema.extensions.sudoshould now checkschema.extensions.scope === 'internal'. (#9914) @emmatown[core]ChangesdisplayMode: 'count'on relationship fields to requireitemView.fieldMode: 'read'or a dynamicfieldModethat only resolves to'read'or'hidden'. (#9528) @emmatown[auth]RemovesmagicAuthLinkandpasswordResetLinkfunctionality from@keystone-6/auth(#9245) @dcousens[core]Removes{list}.descriptionand{list}.ui.description, retains{list}.graphql.descriptionfunctionality (#9672) @dcousens[core]Removesnullvalue from{field}.ui.description, replace with empty string or omit the key (#9672) @dcousens[core]Changes field meta from{field}.pathto{field}.key, as used by field views (#9671) @dcousens[core]Movesstorageconfiguration toimageandfilefields, with a newStorageStrategyinterface that directly defines howput,deleteandurlfunctions (#9529) @emmatown[auth, core, fields-document]Updates tographql@^16.14.2,graphqlis now also a peer dependency in addition to a normal dependency so if you have a dependency ongraphqlyourself, you must have a compatible version installed (#9956) @emmatown[core]Moves{field}.labelto{field}.ui.label(#9631) @dcousens[core]Changes the type forui.getAdditionalFilesto be flattened, prefer function composition when wrapping (#9681) @dcousens[core]Removes the deprecated--fixflag fromkeystone postinstall(#9190) @gautamsi[core]Updates@apollo/serverto v5 (#9880) @trickreich[core]AddsitemField,originalItemField,inputFieldDataandresolvedFieldDataparameters to field hooks (#9600) @dcousens[core]Removes theisFilterable,isOrderable,defaultIsFilterable, anddefaultIsOrderableconfiguration options. Field read access can now distinguish between reading an item, filtering, and ordering throughaccess.read.item,access.read.filter, andaccess.read.order. The corresponding GraphQL schema fields can be omitted throughgraphql.omit.read, with list-wide defaults configured throughfieldDefaults.accessandfieldDefaults.graphql.omit. (#9883) @emmatown[create-keystone-app]Removes auto-install, use your preferred package manager to install dependencies instead (#9942) @emmatown[core]Changes the method by which.sudo()bypasses access control, withcontext.sudo().graphql.schemanow retaining access control as part of the GraphQL schema (#9731) @dcousens[core]Removes deprecatedvalidateInputandvalidateDeletehooks and adds object hook syntax to fields. (#9204) @gautamsi[core]Adds support for[field].graphql.isNonNull: true(#9234) @dcousens[core]Upgrades@graphql-ts/schemato1.0.0(#9535) @emmatown[auth]RemovesinitFirstItem, including the/initAdmin UI page and thecreateInitial*GraphQL mutation. Usedb.onConnectto seed an initial user instead. (#9915) @emmatown[core]Adds list-levelui.listView.initialFilterto apply a filter to the list view by default (#9629) @emmatown[auth, core]Updates@apollo/clientto v4 (#9740) @emmatown[core]Updates theconfigfunction to default any missing values to what is used internally; compatible with the internal typeResolvedKeystoneConfig(#9189) @gautamsi[core]Moves item field parameters from list.itemView() to list() in the KeystoneAdminMeta GraphQL type (#9684) @dcousens[core]Removes.itemQueryNameand.listQueryNamefromKeystoneAdminUIListMeta, use.graphql.names.*QueryNameinstead (#9253) @dcousens[core]Removes the@keystone-ui/*design system, you should upgrade your custom components to@keystar/ui. When you depend on@keystar/ui, you should pin@keystar/uiand@keystone-6/coreto matching versions based on the version in@keystone-6/core'speerDependencies, whenever updating@keystone-6/core, you should also update@keystar/uito the matching version. (#9253) @dcousens[core]Changesitemargument type infield.*View.field*functions to be nullable (#9253) @dcousens[fields-document]Removes@keystone-6/fields-document/primitivesfrom exports (#9253) @dcousens[core]Removes theendSessionGraphQL mutation addition whencontext.session.endis defined, extend this yourself or use@keystone-6/authwhich addsendSessionif required (#9253) @dcousens[core]RemovesauthenticatedItemfrom@keystone-6/core/admin-ui/componentsexports (#9253) @dcousens[core]ChangesisHiddentohideNavigationon the AdminMeta list GraphQL type (#9253) @dcousens[create-keystone-app]Updates thekeystone-appconfiguration to the newest major version (#9253) @dcousens[core]Fixes enum names on *select field types from switching to their singular form (#9696) @dcousens[core]Upgrades express major version to 5 (#9344) @renovate[core]Upgrades Next major version to 16,nextis also now a peer dependency so it must be installed directly in your project. (#9421) @gautamsi[auth, cloudinary, core, fields-document]Movesreactandreact-domto peer dependencies. (#9421) @gautamsi[cloudinary, core, fields-document]RemovesjsonFieldTypePolyfilledForSQLitesince Prisma now supports the Json scalar for SQLite (#9541) @emmatown[core]Updates defaulttypes.pathtogenerated/keystone/types.ts(#9925) @emmatown[auth, core]Changes thepasswordfield options frombcryptandworkFactorto the new generickdfoption. (#9471) @emmatown[core]Changes Prisma client error handling so Prisma operations no longer returnGraphQLError. Using the Prisma client will now throw errors normally. Prisma errors that are not caught in resolvers will now have all information beyond the fact that they're Prisma errors removed before they're returned over the network. You can usegraphql.apolloConfig.formatErrorin your config to override this. (#9476) @emmatown[core]Adds{list}.graphql.singularoption (#9644) @dcousens[core]Fixes the computed GraphQL list plural to retain the original casing (#9644) @dcousens
New Features
[core]Adds support for importing TypeScript (and similar) packages in a monorepo without a separate build step. @dcousens[core]Addsui.{sort,filter}options to relationship fields withui.displayMode: 'select', with sort defaulting to the foreign list's{list}.ui.listView.{initialSort}option (#9688) @dcousens[core]Addsui.{createView,itemView}.isRequiredfor control ofisRequiredUI functionality (#9626) @emmatown[core]Adds conditional client-state filters forui.*.fieldMode(#9620) @emmatown[core]Adds support for@opentelemetry/apitracing for Keystone's internal operations (#9696) @dcousens[core]Addslist.actionsto the list configuration (#9689) @dcousens[core]Addssetinput field for*RelateToManyUpdateInputGraphQL type on many relationships (#9645) @dcousens[core]AddsitemFieldandfieldKeyparameters to fieldui.fieldModeandui.fieldPositionfunctions (#9600) @dcousens[fields-document]AddscomponentBlocks?: 'inherit'option to block child fields (#9574) @emmatown[core]Addsaccess.operation.query.one,access.operation.query.many, andaccess.operation.query.countfor access control for specific kinds of queries. Theaccess.operation.queryfunctions also receivekind: 'one' | 'many' | 'count'. Specific kinds of queries can be omitted from the GraphQL schema throughgraphql.omit.query.one,graphql.omit.query.many, andgraphql.omit.query.count. (#9883) @emmatown[core]Adds support fordisplayMode: 'table'on relationship fields (#9523) @emmatown[core]Addscontext.internal()to spawn a context unaffected bygraphql.omiton lists or fields (#9731) @dcousens[core]Adds a--quietflag tokeystoneCLI commands, suppressing most output except for errors (#9682) @dcousens[core]Adds support for extra id types (cuid2, uuid v7, ulid, nanoid) added to Prisma (#9481) @emmatown[fields-document]Adds.labelFieldsupport for inline and component block relationship fields (#9655) @dcousens[auth]Changes the type ofwithAuth's first parameter to be aResolvedKeystoneConfig, rather thanKeystoneConfig(#9189) @gautamsi[fields-document]AddsdisplayModetofields.text(#9588) @emmatown[fields-document]Adds.descriptionsupport for component block relationship fields (#9668) @dcousens[cloudinary]Adds the pre-existing metawidth,heightandfilesizeto theCloudinaryImage_FileGraphQL output type (#9253) @dcousens[auth]Adds theendSessionGraphQL mutation addition whencontext.session.endis defined (#9253) @dcousens[core]Adds support fornullas adefaultValueonbigint,decimal,floatandinteger(#9253) @dcousens[core]Changes the relationship field to only call the GraphQLcreatemutation when saving the item, not on blur (#9253) @dcousens[fields-document]Addsfilterandsortoptions to inline and component relationship fields (#9666) @dcousens[core]Changes thegraphqlexport name tog-graphqlis still exported but is deprecated and may be removed in a future release. In projects, usegWithContextto bindgto your specific context type. (#9460) @emmatown[core]Addsui.listView.hiddenFilter, a hidden Admin UI list view filter that is always applied to the list query but is not shown in the filter UI. (#9866) @emmatown[core]Adds support for uniquely filtering items by 1-to-1 relationships (#9595) @dcousens[core]Fixes the common field type of.isIndexedto acceptboolean, not onlytrue(#9595) @dcousens[core]AddslistDefaultsconfiguration forgraphql.omitandgraphql.maxTake(#9926) @emmatown[document-renderer]Adds exports for theElement,TextandNodetypes (#9556) @emmatown
Bug Fixes
[core]FixesisolationLeveltype incontext.transaction(#9902) @emmatown[fields-document]Adds tighter document field relationship validation error handling. (#9881) @emmatown[core]Adds startup log messages to inform users of telemetry status (#9822) @abhijnyan-codes[core]Adds support for theBytesPrisma type in TypeScript types when implementing custom field types (#9483) @emmatown[core]Updates relationship fields to implicitly setui.hideCreate: truewhengraphql.omit.create: falseis set on the related list (#9480) @emmatown[fields-document]Updates document structure validation with clearer error messages (#9604) @emmatown[fields-document]Fixes normalising multiple dividers in component blocks (#9605) @emmatown[fields-document]Changes DocumentFieldConfig to accept?: boolean, not?: trueformatting options (#9569) @dcousens[core]Fixes lists with hideNavigation showing on the dashboard (#9642) @emmatown[core]Fixes Prisma build errors with Node.js 22 and Node.js 24. Thanks @sfodor for the fix (#9692) @gautamsi[fields-document]Removes checking excess properties on component blocks (#9641) @emmatown[core]Fixes race inkeystone buildwhen writing admin files with duplicate output paths (#9808) @andoan16[core]Fixes AdminUI create view not supporting{field}.graphql.isNonNullforcreateoperations (#9253) @dcousens[core]Adds more specific types for thelistsargument passed invirtualfields when using existing list types (#9536) @emmatown[core]Changes esbuild to use the automatic JSX runtime to align with the Next build process (#9558) @emmatown[fields-document]Fixes new component-block form fields failing validation on existing data (#9640) @emmatown[fields-document]Changes fields-document missing item error message to match@keystone-6/core(#9595) @dcousens[core]Adds more specific types tocacheHintand respectscacheHintonfindOnequeries. (#9524) @lushkovsky-s[core]ChangesfieldModeandfieldPositiononKeystoneAdminUIFieldMetaItemViewto non-nullable (#9510) @emmatown
:seedling: New Contributors
Thanks to the following developers for making their first contributions to the project!
- @abhijnyan-codes (#9822)
- @andoan16 (#9808)
- @Bojun-Vvibe (#9815)
- @dwidge (#9422)
- @emilshr (#9474)
- @envsecure (#9830)
- @kamilbiela (#9582)
- @lushkovsky-s (#9524)
- @MauriceArikoglu (#9660)
- @mroforolhc (#9677)
- @OlleMattsson (#9719)
- @trickreich (#9880,#9879)
- @unrevised6419 (#9610)
:blue_heart: Acknowledgements
Lastly, thanks to @benderham (#9952), @borisno2 (#9807), @dcousens (#9850,#9849,#9806,#9786,#9783,#9781,#9780,#9752,#9730,#9729,#9701,#9700,#9696,#9698,#9691,#9690,#9687,#9686,#9675,#9674,#9673,#9670,#9669,#9667,#9664,#9663,#9659,#9658,#9652,#9649,#9632,#9630,#9613,#9568,#9532,#9465), @emmatown (#9960,#9959,#9958,#9957,#9955,#9954,#9953,#9951,#9949,#9947,#9946,#9945,#9944,#9943,#9941,#9940,#9939,#9938,#9937,#9936,#9935,#9934,#9933,#9932,#9931,#9930,#9928,#9927,#9924,#9923,#9922,#9921,#9918,#9917,#9916,#9913,#9912,#9910,#9909,#9908,#9907,#9904,#9903,#9900,#9899,#9898,#9897,#9896,#9895,#9894,#9893,#9888,#9892,#9891,#9890,#9889,#9887,#9886,#9885,#9878,#9877,#9876,#9875,#9874,#9873,#9871,#9870,#9869,#9868,#9867,#9865,#9863,#9864,#9862,#9861,#9858,#9854,#9852,#9851,#9787,#9848,#9805,#9793,#9794,#9792,#9791,#9749,#9748,#9737,#9736,#9699,#9650,#9648,#9639,#9638,#9637,#9621,#9615,#9614,#9606,#9586,#9583,#9580,#9575,#9572,#9570,#9555,#9567,#9566,#9565,#9564,#9560,#9559,#9557,#9554,#9551,#9550,#9547,#9544,#9543,#9540,#9538,#9537,#9533,#9531,#9527,#9487,#9518,#9517,#9516,#9515,#9514,#9513,#9495,#9509,#9508,#9507,#9506,#9504,#9500,#9498,#9499,#9497,#9492,#9491,#9489,#9482,#9479,#9475,#9472,#9470,#9457,#9459,#9453), @gautamsi (#9706,#9694,#9522,#9417), @mikehazell (#9402), @renovate (#9827,#9839,#9847,#9842,#9841,#9833,#9828,#9825,#9823,#9821,#9788,#9585,#9817,#9816,#9814,#9812,#9813,#9810,#9776,#9775,#9771,#9770,#9769,#9773,#9767,#9756,#9744,#9755,#9760,#9754,#9746,#9745,#9741,#9735,#9738,#9733,#9732,#9728,#9717,#9727,#9711,#9715,#9708,#9726,#9704,#9725,#9722,#9718,#9724,#9702,#9721,#9710,#9596,#9680,#9656,#9661,#9651,#9646,#9647,#9622,#9623,#9627,#9619,#9618,#9616,#9617,#9598,#9599,#9594,#9592,#9593,#9591,#9590,#9581,#9577,#9562,#9561,#9548,#9549,#9546,#9545,#9539,#9534,#9521,#9526,#9493,#9512,#9501,#9503,#9502,#9488,#9484,#9485,#9467,#9469,#9415,#9451,#9464,#9461,#9458,#9455,#9454,#9449,#9448,#9447,#9446,#9443,#9442,#9441,#9439,#9438,#9436,#9435,#9429,#9427,#9424,#9425,#9426,#9423,#9413,#9414,#9411,#9405,#9406,#9407,#9408,#9404) for changes not shown above, but none-the-less appreciated.
:eyes: Review
See https://github.com/keystonejs/keystone/compare/2026-07-21...2026-07-28 to compare with our previous release.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Beta — feedback welcome: [email protected]