Bump @tinacms/cli from 2.5.3 to 2.5.6

[dependabot]

Bumps @tinacms/cli from 2.5.3 to 2.5.6.

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.5.6

Patch Changes

• #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

• #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

  Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

  The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

  Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

• Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

  • tinacms@3.11.0
  • @​tinacms/app@​2.5.10
  • @​tinacms/graphql@​2.4.9
  • @​tinacms/search@​1.2.23

@​tinacms/cli@​2.5.5

Patch Changes

• Updated dependencies []:
  • @​tinacms/app@​2.5.9
  • @​tinacms/graphql@​2.4.8
  • tinacms@3.10.1
  • @​tinacms/search@​1.2.22

@​tinacms/cli@​2.5.4

Patch Changes

• #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

  Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

Changelog

Sourced from @​tinacms/cli's changelog.

2.5.6

Patch Changes

• #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

• #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

  Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

  The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

  Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

• Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

  • tinacms@3.11.0
  • @​tinacms/app@​2.5.10
  • @​tinacms/graphql@​2.4.9
  • @​tinacms/search@​1.2.23

2.5.5

Patch Changes

• Updated dependencies []:
  • @​tinacms/app@​2.5.9
  • @​tinacms/graphql@​2.4.8
  • tinacms@3.10.1
  • @​tinacms/search@​1.2.22

2.5.4

Patch Changes

• #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

  Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

Commits

• b636a22 Version Packages (#7205)
• 056ffc2 🐛 Publish internal package refs as ranges, not exact pins (~320 MB of duplica...
• 5daa624 🐛 Improve CLI error when tinacms/@​tinacms packages can't be resolved (#7176)
• adeafbc Version Packages (#7174)
• f9d50a0 Version Packages (#7170)
• 0a927a4 Scope TinaCloud authorization to the site's configured clientID (#7168)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
allocin.it	Ready	Preview, Comment	Jul 16, 2026 6:38pm