code · pull · Jul 6, 2026 · Jul 6, 2026 · Jul 6, 2026 · Jul 6, 2026
diff --git a/.changeset/blue-vans-begin.md b/.changeset/blue-vans-begin.md
diff --git a/.changeset/editorial-workflow-save-metrics.md b/.changeset/editorial-workflow-save-metrics.md
diff --git a/.changeset/editorial-workflow-save-options.md b/.changeset/editorial-workflow-save-options.md
diff --git a/.changeset/gentle-planets-fail.md b/.changeset/gentle-planets-fail.md
diff --git a/.changeset/shared-error-constants.md b/.changeset/shared-error-constants.md
diff --git a/.changeset/use-edit-state-origin-validation.md b/.changeset/use-edit-state-origin-validation.md
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -285,6 +285,9 @@ jobs:
           publish: pnpm run publish
           createGithubReleases: true
           setupGitUser: false
+          # github-api mode makes GitHub create and sign the Version Packages
+          # commit server-side, satisfying main's required-signatures rule
+          commitMode: github-api
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token  }}
           NPM_CONFIG_PROVENANCE: true

diff --git a/examples/astro/kitchen-sink/package.json b/examples/astro/kitchen-sink/package.json
@@ -42,7 +42,7 @@
     "@playwright/test": "catalog:",
     "autoprefixer": "catalog:",
     "cross-env": "^7.0.3",
-    "postcss": "^8.5.2",
+    "postcss": "catalog:",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.3"
   }

diff --git a/examples/hugo/kitchen-sink/package.json b/examples/hugo/kitchen-sink/package.json
@@ -33,7 +33,7 @@
     "autoprefixer": "catalog:",
     "cross-env": "^7.0.3",
     "hugo-extended": "^0.158.0",
-    "postcss": "^8.5.2",
+    "postcss": "catalog:",
     "postcss-cli": "^11.0.0",
     "tailwindcss": "^4.0.0",
     "@playwright/test": "catalog:",

diff --git a/examples/next/kitchen-sink/package.json b/examples/next/kitchen-sink/package.json
@@ -39,7 +39,7 @@
     "@types/node": "^25.1.0",
     "autoprefixer": "catalog:",
     "cross-env": "^7.0.3",
-    "postcss": "^8.5.2",
+    "postcss": "catalog:",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.3"
   }

diff --git a/examples/next/tina-self-hosted-demo/package.json b/examples/next/tina-self-hosted-demo/package.json
@@ -40,7 +40,7 @@
     "autoprefixer": "catalog:",
     "cross-env": "^7.0.3",
     "eslint": "^8.57.1",
-    "postcss": "^8.5.2",
+    "postcss": "catalog:",
     "postcss-import": "catalog:",
     "postcss-nesting": "catalog:",
     "tailwindcss": "^3.4.17",

diff --git a/examples/react/kitchen-sink/package.json b/examples/react/kitchen-sink/package.json
@@ -36,9 +36,9 @@
     "@vitejs/plugin-react": "^4.3.0",
     "autoprefixer": "catalog:",
     "cross-env": "^7.0.3",
-    "postcss": "^8.5.2",
+    "postcss": "catalog:",
     "tailwindcss": "^4.0.0",
-    "@playwright/test": "^1.49.0",
+    "@playwright/test": "catalog:",
     "typescript": "^5.7.3",
     "vite": "^6.0.0"
   }

diff --git a/packages/@tinacms/app/CHANGELOG.md b/packages/@tinacms/app/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @tinacms/app
 
+## 2.5.8
+
+### Patch Changes
+
+- Updated dependencies [[`c809733`](https://github.com/tinacms/tinacms/commit/c809733ce8037d81937e81f0c8781a6cf222099b), [`3a1b39a`](https://github.com/tinacms/tinacms/commit/3a1b39ad9a2bbeb82a539fbca6985d5b714238dd), [`de4a807`](https://github.com/tinacms/tinacms/commit/de4a80771e83afa8502f834227351cff54c5f236), [`8497110`](https://github.com/tinacms/tinacms/commit/8497110ada7554f97807ce7a09a3624b5efc5713), [`22d0c0d`](https://github.com/tinacms/tinacms/commit/22d0c0d095b79e116677a798d07b35591ccb816e), [`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419), [`b53a51c`](https://github.com/tinacms/tinacms/commit/b53a51c92ee8ddecbb654f5b57c7d10673a06626)]:
+  - tinacms@3.10.0
+  - @tinacms/mdx@2.1.9
+
 ## 2.5.7
 
 ### Patch Changes

diff --git a/packages/@tinacms/app/package.json b/packages/@tinacms/app/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@tinacms/app",
-	"version": "2.5.7",
+	"version": "2.5.8",
 	"main": "src/main.tsx",
 	"files": [
 		"src",

diff --git a/packages/@tinacms/cli/CHANGELOG.md b/packages/@tinacms/cli/CHANGELOG.md
@@ -1,5 +1,18 @@
 # tinacms-cli
 
+## 2.5.3
+
+### Patch Changes
+
+- [#7157](https://github.com/tinacms/tinacms/pull/7157) [`aef9de0`](https://github.com/tinacms/tinacms/commit/aef9de0dabff72e0815ea6dfc03ce720dd8c4a7b) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - Bump `@tailwindcss/typography` to 0.5.20
+
+- Updated dependencies [[`c809733`](https://github.com/tinacms/tinacms/commit/c809733ce8037d81937e81f0c8781a6cf222099b), [`3a1b39a`](https://github.com/tinacms/tinacms/commit/3a1b39ad9a2bbeb82a539fbca6985d5b714238dd), [`de4a807`](https://github.com/tinacms/tinacms/commit/de4a80771e83afa8502f834227351cff54c5f236), [`8497110`](https://github.com/tinacms/tinacms/commit/8497110ada7554f97807ce7a09a3624b5efc5713), [`22d0c0d`](https://github.com/tinacms/tinacms/commit/22d0c0d095b79e116677a798d07b35591ccb816e), [`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419), [`b53a51c`](https://github.com/tinacms/tinacms/commit/b53a51c92ee8ddecbb654f5b57c7d10673a06626)]:
+  - tinacms@3.10.0
+  - @tinacms/schema-tools@2.8.3
+  - @tinacms/graphql@2.4.7
+  - @tinacms/app@2.5.8
+  - @tinacms/search@1.2.21
+
 ## 2.5.2
 
 ### Patch Changes

diff --git a/packages/@tinacms/cli/package.json b/packages/@tinacms/cli/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@tinacms/cli",
     "type": "module",
-    "version": "2.5.2",
+    "version": "2.5.3",
     "main": "dist/index.js",
     "typings": "dist/index.d.ts",
     "files": [

diff --git a/packages/@tinacms/datalayer/CHANGELOG.md b/packages/@tinacms/datalayer/CHANGELOG.md
@@ -1,5 +1,12 @@
 # tina-graphql
 
+## 2.0.27
+
+### Patch Changes
+
+- Updated dependencies [[`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419)]:
+  - @tinacms/graphql@2.4.7
+
 ## 2.0.26
 
 ### Patch Changes

diff --git a/packages/@tinacms/datalayer/package.json b/packages/@tinacms/datalayer/package.json
@@ -1,7 +1,7 @@
 {
 	"name": "@tinacms/datalayer",
 	"type": "module",
-	"version": "2.0.26",
+	"version": "2.0.27",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
 	"files": [

diff --git a/packages/@tinacms/graphql/CHANGELOG.md b/packages/@tinacms/graphql/CHANGELOG.md
@@ -1,5 +1,17 @@
 # tina-graphql
 
+## 2.4.7
+
+### Patch Changes
+
+- [#7123](https://github.com/tinacms/tinacms/pull/7123) [`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - refactor: replace hardcoded error-message string checks with shared error-identifier constants in `@tinacms/schema-tools`, so producers and consumers reference one source of truth instead of fragile `error.message.includes('...')` matching (#6777)
+
+- [#7143](https://github.com/tinacms/tinacms/pull/7143) [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419) Thanks [@kulesy](https://github.com/kulesy)! - Unify folder-name validation with the document-filename and backend `relativePath` allowlist. The Create Folder modal now rejects names with disallowed characters (e.g. spaces) inline instead of letting the request fail on the backend, and a project-level `folderNameRegex` is layered on top of that baseline. The allowlist lives in a single shared constant in `@tinacms/schema-tools`.
+
+- Updated dependencies [[`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419)]:
+  - @tinacms/schema-tools@2.8.3
+  - @tinacms/mdx@2.1.9
+
 ## 2.4.6
 
 ### Patch Changes

diff --git a/packages/@tinacms/graphql/package.json b/packages/@tinacms/graphql/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@tinacms/graphql",
     "type": "module",
-    "version": "2.4.6",
+    "version": "2.4.7",
     "main": "dist/index.js",
     "module": "./dist/index.js",
     "files": [

diff --git a/packages/@tinacms/graphql/src/resolver/index.ts b/packages/@tinacms/graphql/src/resolver/index.ts
@@ -18,7 +18,7 @@ import type {
   TinaField,
   TinaSchema,
 } from '@tinacms/schema-tools';
-import { ERR_ALREADY_EXISTS } from '@tinacms/schema-tools';
+import { ERR_ALREADY_EXISTS, RELATIVE_PATH_REGEX } from '@tinacms/schema-tools';
 
 import type { GraphQLConfig } from '../types';
 
@@ -698,7 +698,7 @@ export class Resolver {
         'Invalid path: relativePath cannot have leading or trailing whitespace'
       );
     }
-    if (!/^[a-zA-Z0-9\-_./]+$/.test(relativePath)) {
+    if (!RELATIVE_PATH_REGEX.test(relativePath)) {
       throw new Error('Invalid path: relativePath contains invalid characters');
     }
   }

diff --git a/packages/@tinacms/mdx/CHANGELOG.md b/packages/@tinacms/mdx/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @tinacms/mdx
 
+## 2.1.9
+
+### Patch Changes
+
+- Updated dependencies [[`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419)]:
+  - @tinacms/schema-tools@2.8.3
+
 ## 2.1.8
 
 ### Patch Changes

diff --git a/packages/@tinacms/mdx/package.json b/packages/@tinacms/mdx/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@tinacms/mdx",
-	"version": "2.1.8",
+	"version": "2.1.9",
 	"type": "module",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",

diff --git a/packages/@tinacms/schema-tools/CHANGELOG.md b/packages/@tinacms/schema-tools/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @tinacms/schema-tools
 
+## 2.8.3
+
+### Patch Changes
+
+- [#7123](https://github.com/tinacms/tinacms/pull/7123) [`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710) Thanks [@joshbermanssw](https://github.com/joshbermanssw)! - refactor: replace hardcoded error-message string checks with shared error-identifier constants in `@tinacms/schema-tools`, so producers and consumers reference one source of truth instead of fragile `error.message.includes('...')` matching (#6777)
+
+- [#7143](https://github.com/tinacms/tinacms/pull/7143) [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419) Thanks [@kulesy](https://github.com/kulesy)! - Unify folder-name validation with the document-filename and backend `relativePath` allowlist. The Create Folder modal now rejects names with disallowed characters (e.g. spaces) inline instead of letting the request fail on the backend, and a project-level `folderNameRegex` is layered on top of that baseline. The allowlist lives in a single shared constant in `@tinacms/schema-tools`.
+
 ## 2.8.2
 
 ### Patch Changes

diff --git a/packages/@tinacms/schema-tools/package.json b/packages/@tinacms/schema-tools/package.json
@@ -1,7 +1,7 @@
 {
 	"name": "@tinacms/schema-tools",
 	"type": "module",
-	"version": "2.8.2",
+	"version": "2.8.3",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
 	"files": [

diff --git a/packages/@tinacms/schema-tools/src/index.ts b/packages/@tinacms/schema-tools/src/index.ts
@@ -4,5 +4,6 @@ export * from './validate';
 export * from './util/namer';
 export * from './util/parseURL';
 export * from './util/normalizePath';
+export * from './util/relativePath';
 export * from './util/headingLevels';
 export * from './errors';
diff --git a/packages/@tinacms/schema-tools/src/util/relativePath.spec.ts b/packages/@tinacms/schema-tools/src/util/relativePath.spec.ts
@@ -0,0 +1,27 @@
+/**
+
+*/
+
+import { isValidRelativePath } from './relativePath';
+
+describe('isValidRelativePath', () => {
+  it('accepts allowed characters', () => {
+    expect(isValidRelativePath('my-document')).toEqual(true);
+    expect(isValidRelativePath('My_Document.en')).toEqual(true);
+    expect(isValidRelativePath('sub-folder/My_Document')).toEqual(true);
+    expect(isValidRelativePath('a-b-c-d')).toEqual(true);
+    expect(isValidRelativePath('parent/child')).toEqual(true);
+  });
+
+  it('rejects spaces', () => {
+    expect(isValidRelativePath('a b c d')).toEqual(false);
+    expect(isValidRelativePath('hello world')).toEqual(false);
+  });
+
+  it('rejects other disallowed characters', () => {
+    expect(isValidRelativePath('name!')).toEqual(false);
+    expect(isValidRelativePath('name@example')).toEqual(false);
+    expect(isValidRelativePath('name#1')).toEqual(false);
+    expect(isValidRelativePath('')).toEqual(false);
+  });
+});
diff --git a/packages/@tinacms/schema-tools/src/util/relativePath.ts b/packages/@tinacms/schema-tools/src/util/relativePath.ts
@@ -0,0 +1,10 @@
+/** Allowlist for a relativePath segment (filename or folder name); source of truth shared with the resolver's validateRelativePath so the UI can reject invalid names inline. */
+export const RELATIVE_PATH_REGEX = /^[a-zA-Z0-9\-_./]+$/;
+
+/** Inline form-validation message for {@link RELATIVE_PATH_REGEX}. */
+export const RELATIVE_PATH_ALLOWED_CHARS_MESSAGE =
+  'Must contain only a-z, A-Z, 0-9, -, _, ., or /.';
+
+/** True when `value` contains only characters allowed in a relativePath. */
+export const isValidRelativePath = (value: string): boolean =>
+  RELATIVE_PATH_REGEX.test(value);
diff --git a/packages/@tinacms/search/CHANGELOG.md b/packages/@tinacms/search/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @tinacms/search
 
+## 1.2.21
+
+### Patch Changes
+
+- Updated dependencies [[`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419)]:
+  - @tinacms/schema-tools@2.8.3
+  - @tinacms/graphql@2.4.7
+
 ## 1.2.20
 
 ### Patch Changes

diff --git a/packages/@tinacms/search/package.json b/packages/@tinacms/search/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@tinacms/search",
     "type": "module",
-    "version": "1.2.20",
+    "version": "1.2.21",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",
     "files": [

diff --git a/packages/@tinacms/vercel-previews/CHANGELOG.md b/packages/@tinacms/vercel-previews/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Change Log
 
+## 0.2.17
+
+### Patch Changes
+
+- Updated dependencies [[`c809733`](https://github.com/tinacms/tinacms/commit/c809733ce8037d81937e81f0c8781a6cf222099b), [`3a1b39a`](https://github.com/tinacms/tinacms/commit/3a1b39ad9a2bbeb82a539fbca6985d5b714238dd), [`de4a807`](https://github.com/tinacms/tinacms/commit/de4a80771e83afa8502f834227351cff54c5f236), [`8497110`](https://github.com/tinacms/tinacms/commit/8497110ada7554f97807ce7a09a3624b5efc5713), [`22d0c0d`](https://github.com/tinacms/tinacms/commit/22d0c0d095b79e116677a798d07b35591ccb816e), [`5148d67`](https://github.com/tinacms/tinacms/commit/5148d679049bc53e34b287a586bc721db7cb7710), [`ff10e65`](https://github.com/tinacms/tinacms/commit/ff10e657e48f1acc67cafd3e1a99bef23c8ac419), [`b53a51c`](https://github.com/tinacms/tinacms/commit/b53a51c92ee8ddecbb654f5b57c7d10673a06626)]:
+  - tinacms@3.10.0
+
 ## 0.2.16
 
 ### Patch Changes

diff --git a/packages/@tinacms/vercel-previews/package.json b/packages/@tinacms/vercel-previews/package.json
@@ -1,7 +1,7 @@
 {
 	"name": "@tinacms/vercel-previews",
 	"type": "module",
-	"version": "0.2.16",
+	"version": "0.2.17",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
 	"keywords": [

diff --git a/packages/create-tina-app/CHANGELOG.md b/packages/create-tina-app/CHANGELOG.md
@@ -1,5 +1,11 @@
 # create-tina-app
 
+## 2.1.10
+
+### Patch Changes
+
+- [#7122](https://github.com/tinacms/tinacms/pull/7122) [`90833f1`](https://github.com/tinacms/tinacms/commit/90833f10d700aaa6940a8104c48d47e9b4aabe0a) Thanks [@kulesy](https://github.com/kulesy)! - feat(create-tina-app): stream live install activity on the spinner
+
 ## 2.1.9
 
 ### Patch Changes

diff --git a/packages/create-tina-app/package.json b/packages/create-tina-app/package.json
@@ -1,6 +1,6 @@
 {
     "name": "create-tina-app",
-    "version": "2.1.9",
+    "version": "2.1.10",
     "type": "module",
     "main": "dist/index.js",
     "files": [

diff --git a/packages/create-tina-app/src/index.ts b/packages/create-tina-app/src/index.ts
@@ -37,6 +37,8 @@ import { osInfo as getOsSystemInfo } from 'systeminformation';
 
 const DISCORD_SUPPORT_URL = 'https://discord.com/invite/zumN63Ybpf';
 const FAQ_URL = 'https://tina.io/docs/faq';
+// Truncate the install activity line so the spinner stays on a single row.
+const MAX_ACTIVITY_LINE = 56;
 
 let posthogClient: PostHog | null = null;
 async function initializePostHog(
@@ -442,8 +444,15 @@ export async function run() {
 
   spinner.start('Installing packages.');
   try {
-    await install(pkgManager as PackageManager, opts.verbose);
-    spinner.succeed();
+    // Reflect the package manager's latest line on the spinner as live activity.
+    await install(pkgManager as PackageManager, opts.verbose, (line) => {
+      const text =
+        line.length > MAX_ACTIVITY_LINE
+          ? `${line.slice(0, MAX_ACTIVITY_LINE - 1)}…`
+          : line;
+      spinner.text = `Installing packages, ${text}`;
+    });
+    spinner.succeed('Installing packages.');
   } catch (err) {
     const error = err instanceof Error ? err : new Error(String(err));
     const reason = error.message || String(err);