decap-cms-core 3.13.0 → 3.15.0

package/dist/esm/constants/configSchema.js

@@ -1,7 +1,6 @@
 import AJV from 'ajv';
 import { select, uniqueItemProperties, instanceof as instanceOf, prohibited } from 'ajv-keywords/dist/keywords';
 import ajvErrors from 'ajv-errors';
-import { v4 as uuid } from 'uuid';
 import { frontmatterFormats, extensionFormatters } from '../formats/formats';
 import { getWidgets } from '../lib/registry';
 import { I18N_STRUCTURE, I18N_FIELD } from '../lib/i18n';
@@ -49,7 +48,7 @@ const i18nField = {
  * Config for fields in both file and folder collections.
  */
 function fieldsConfig() {
-  const id = uuid();
+  const id = crypto.randomUUID();
   return {
     $id: `fields_${id}`,
     type: 'array',
@@ -470,7 +469,7 @@ function getConfigSchema() {
                       type: 'string'
                     }
                   },
-                  required: ['label', 'widget', 'index_file']
+                  required: ['label', 'widget']
                 }
               },
               additionalProperties: false,

package/dist/esm/lib/registry.js

@@ -266,7 +266,10 @@ export async function invokeEvent({
       };
     }
   }
-  return _data.entry.get('data');
+  // Return the full entry object with all metadata (slug, path, meta, etc.)
+  // rather than just the data payload. Callers like invokePreSaveEvent expect
+  // the complete entry object to be preserved through the event handler chain.
+  return _data.entry;
 }
 export function removeEventListener({
   name,

package/dist/esm/reducers/entries.js

@@ -379,14 +379,16 @@ function getGroup(entry, selectedGroup) {
   if (selectedGroup.has('pattern')) {
     const pattern = selectedGroup.get('pattern');
     let value = '';
-    try {
-      const regex = new RegExp(pattern);
-      const matched = dataAsString.match(regex);
-      if (matched) {
-        value = matched[0];
+    if (pattern !== undefined) {
+      try {
+        const regex = new RegExp(pattern);
+        const matched = dataAsString.match(regex);
+        if (matched) {
+          value = matched[0];
+        }
+      } catch (e) {
+        console.warn(`Invalid view group pattern '${pattern}' for field '${field}'`, e);
       }
-    } catch (e) {
-      console.warn(`Invalid view group pattern '${pattern}' for field '${field}'`, e);
     }
     return {
       id: `${label}${value}`,

package/dist/esm/reducers/entryDraft.js

@@ -1,7 +1,7 @@
 import { Map, List, fromJS } from 'immutable';
-import { v4 as uuid } from 'uuid';
 import get from 'lodash/get';
-import { join } from 'path';
+import { join, basename } from 'path';
+import { sanitizeSlug } from '../lib/urlHelper';
 import { DRAFT_CREATE_FROM_ENTRY, DRAFT_CREATE_EMPTY, DRAFT_DISCARD, DRAFT_CHANGE_FIELD, DRAFT_VALIDATION_ERRORS, DRAFT_CLEAR_ERRORS, DRAFT_LOCAL_BACKUP_RETRIEVED, DRAFT_CREATE_FROM_LOCAL_BACKUP, DRAFT_CREATE_DUPLICATE_FROM_ENTRY, ENTRY_PERSIST_REQUEST, ENTRY_PERSIST_SUCCESS, ENTRY_PERSIST_FAILURE, ENTRY_DELETE_SUCCESS, ADD_DRAFT_ENTRY_MEDIA_FILE, REMOVE_DRAFT_ENTRY_MEDIA_FILE } from '../actions/entries';
 import { UNPUBLISHED_ENTRY_PERSIST_REQUEST, UNPUBLISHED_ENTRY_PERSIST_SUCCESS, UNPUBLISHED_ENTRY_PERSIST_FAILURE, UNPUBLISHED_ENTRY_STATUS_CHANGE_REQUEST, UNPUBLISHED_ENTRY_STATUS_CHANGE_SUCCESS, UNPUBLISHED_ENTRY_STATUS_CHANGE_FAILURE, UNPUBLISHED_ENTRY_PUBLISH_REQUEST, UNPUBLISHED_ENTRY_PUBLISH_SUCCESS, UNPUBLISHED_ENTRY_PUBLISH_FAILURE } from '../actions/editorialWorkflow';
 import { selectFolderEntryExtension, selectHasMetaPath } from './collections';
@@ -23,7 +23,7 @@ function entryDraftReducer(state = Map(), action) {
         state.set('fieldsMetaData', Map());
         state.set('fieldsErrors', Map());
         state.set('hasChanged', false);
-        state.set('key', uuid());
+        state.set('key', crypto.randomUUID());
       });
     case DRAFT_CREATE_EMPTY:
       // New Entry
@@ -33,7 +33,7 @@ function entryDraftReducer(state = Map(), action) {
         state.set('fieldsMetaData', Map());
         state.set('fieldsErrors', Map());
         state.set('hasChanged', false);
-        state.set('key', uuid());
+        state.set('key', crypto.randomUUID());
       });
     case DRAFT_CREATE_FROM_LOCAL_BACKUP:
       // Local Backup
@@ -46,7 +46,7 @@ function entryDraftReducer(state = Map(), action) {
         state.set('fieldsMetaData', Map());
         state.set('fieldsErrors', Map());
         state.set('hasChanged', true);
-        state.set('key', uuid());
+        state.set('key', crypto.randomUUID());
       });
     case DRAFT_CREATE_DUPLICATE_FROM_ENTRY:
       // Duplicate Entry
@@ -164,15 +164,47 @@ function entryDraftReducer(state = Map(), action) {
       return state;
   }
 }
+function cleanTitleForFilename(title) {
+  if (!title) return 'untitled';
+  const cleanedTitle = sanitizeSlug(title.toString().toLowerCase().trim(), {
+    sanitize_replacement: '-',
+    encoding: 'unicode'
+  });
+  return cleanedTitle || 'untitled';
+}
 export function selectCustomPath(collection, entryDraft) {
   if (!selectHasMetaPath(collection)) {
     return;
   }
   const meta = entryDraft.getIn(['entry', 'meta']);
   const path = meta && meta.get('path');
-  const indexFile = get(collection.toJS(), ['meta', 'path', 'index_file']);
+  if (!path) {
+    return;
+  }
   const extension = selectFolderEntryExtension(collection);
-  const customPath = path && join(collection.get('folder'), path, `${indexFile}.${extension}`);
+  const indexFile = get(collection.toJS(), ['meta', 'path', 'index_file']);
+
+  // If index_file is specified, use the old behavior for backward compatibility
+  if (indexFile) {
+    const customPath = join(collection.get('folder'), path, `${indexFile}.${extension}`);
+    return customPath;
+  }
+
+  // New behavior: generate filename from entry title
+  const isNewEntry = entryDraft.getIn(['entry', 'newRecord']);
+  const currentPath = entryDraft.getIn(['entry', 'path']);
+  let filename;
+  if (isNewEntry || !currentPath) {
+    // For new entries, generate filename from title
+    const entryData = entryDraft.getIn(['entry', 'data']);
+    const title = entryData && entryData.get('title');
+    filename = cleanTitleForFilename(title);
+  } else {
+    // For existing entries, preserve the current filename
+    const currentFilename = basename(currentPath, `.${extension}`);
+    filename = currentFilename;
+  }
+  const customPath = join(collection.get('folder'), path, `${filename}.${extension}`);
   return customPath;
 }
 export default entryDraftReducer;

package/dist/esm/reducers/mediaLibrary.js

@@ -1,5 +1,4 @@
 import { Map, List } from 'immutable';
-import { v4 as uuid } from 'uuid';
 import { dirname } from 'path';
 import { MEDIA_LIBRARY_OPEN, MEDIA_LIBRARY_CLOSE, MEDIA_LIBRARY_CREATE, MEDIA_INSERT, MEDIA_REMOVE_INSERTED, MEDIA_LOAD_REQUEST, MEDIA_LOAD_SUCCESS, MEDIA_LOAD_FAILURE, MEDIA_PERSIST_REQUEST, MEDIA_PERSIST_SUCCESS, MEDIA_PERSIST_FAILURE, MEDIA_DELETE_REQUEST, MEDIA_DELETE_SUCCESS, MEDIA_DELETE_FAILURE, MEDIA_DISPLAY_URL_REQUEST, MEDIA_DISPLAY_URL_SUCCESS, MEDIA_DISPLAY_URL_FAILURE } from '../actions/mediaLibrary';
 import { selectEditingDraft, selectMediaFolder } from './entries';
@@ -110,7 +109,7 @@ function mediaLibrary(state = Map(defaultState), action) {
         }
         const filesWithKeys = files.map(file => ({
           ...file,
-          key: uuid()
+          key: crypto.randomUUID()
         }));
         return state.withMutations(map => {
           map.set('isLoading', false);
@@ -151,7 +150,7 @@ function mediaLibrary(state = Map(defaultState), action) {
         return state.withMutations(map => {
           const fileWithKey = {
             ...file,
-            key: uuid()
+            key: crypto.randomUUID()
           };
           const files = map.get('files');
           const updatedFiles = [fileWithKey, ...files];

package/dist/esm/reducers/notifications.js

@@ -1,5 +1,4 @@
 import { produce } from 'immer';
-import { v4 as uuid } from 'uuid';
 import { NOTIFICATION_SEND, NOTIFICATION_DISMISS, NOTIFICATIONS_CLEAR } from '../actions/notifications';
 const defaultState = {
   notifications: []
@@ -14,7 +13,7 @@ const notifications = produce((state, action) => {
       break;
     case NOTIFICATION_SEND:
       state.notifications = [...state.notifications, {
-        id: uuid(),
+        id: crypto.randomUUID(),
         ...action.payload
       }];
       break;

package/index.d.ts

@@ -56,7 +56,7 @@ declare module 'decap-cms-core' {
     label?: string;
     required?: boolean;
     hint?: string;
-    pattern?: [string, string];
+    pattern?: [string | RegExp, string];
     i18n?: boolean | 'translate' | 'duplicate' | 'none';
     media_folder?: string;
     public_folder?: string;
@@ -170,6 +170,21 @@ declare module 'decap-cms-core' {
     editorComponents?: string[];
   }
 
+  export interface CmsFieldRichText {
+    widget: 'richtext';
+    default?: string;
+
+    minimal?: boolean;
+    buttons?: CmsMarkdownWidgetButton[];
+    editor_components?: string[];
+    modes?: ('raw' | 'rich_text')[];
+
+    /**
+     * @deprecated Use editor_components instead
+     */
+    editorComponents?: string[];
+  }
+
   export interface CmsFieldNumber {
     widget: 'number';
     default?: string | number;
@@ -257,6 +272,7 @@ declare module 'decap-cms-core' {
       | CmsFieldList
       | CmsFieldMap
       | CmsFieldMarkdown
+      | CmsFieldRichText
       | CmsFieldNumber
       | CmsFieldObject
       | CmsFieldRelation
@@ -283,7 +299,7 @@ declare module 'decap-cms-core' {
   export interface ViewFilter {
     label: string;
     field: string;
-    pattern: string;
+    pattern: string | boolean;
   }
 
   export interface ViewGroup {
@@ -323,7 +339,7 @@ declare module 'decap-cms-core' {
       depth: number;
       subfolders?: boolean;
     };
-    meta?: { path?: { label: string; widget: string; index_file: string } };
+    meta?: { path?: { label: string; widget: string; index_file?: string } };
 
     /**
      * It accepts the following values: yml, yaml, toml, json, md, markdown, html

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "decap-cms-core",
   "description": "Decap CMS core application, see decap-cms package for the main distribution.",
-  "version": "3.13.0",
+  "version": "3.15.0",
   "repository": "https://github.com/decaporg/decap-cms/tree/main/packages/decap-cms-core",
   "bugs": "https://github.com/decaporg/decap-cms/issues",
   "module": "dist/esm/index.js",
@@ -25,19 +25,19 @@
   "license": "MIT",
   "dependencies": {
     "@iarna/toml": "2.2.5",
-    "@reduxjs/toolkit": "^1.9.1",
     "@vercel/stega": "^0.1.2",
+    "ajv": "^8.17.1",
+    "ajv-errors": "^3.0.0",
+    "ajv-keywords": "^5.1.0",
     "buffer": "^6.0.3",
+    "common-tags": "^1.8.0",
     "dayjs": "^1.11.10",
     "deepmerge": "^4.2.2",
     "diacritics": "^1.3.0",
     "fuzzy": "^0.1.1",
-    "gotrue-js": "^0.9.24",
     "gray-matter": "^4.0.2",
     "history": "^4.7.2",
     "immer": "^9.0.0",
-    "js-base64": "^3.0.0",
-    "jwt-decode": "^3.0.0",
     "node-polyglot": "^2.3.0",
     "path-browserify": "^1.0.1",
     "prop-types": "^15.7.2",
@@ -62,11 +62,9 @@
     "react-window": "^1.8.5",
     "redux": "^4.0.5",
     "redux-devtools-extension": "^2.13.8",
-    "redux-notifications": "^4.0.1",
     "redux-thunk": "^2.3.0",
     "remark-gfm": "1.0.0",
     "sanitize-filename": "^1.6.1",
-    "semaphore": "^1.0.5",
     "tomlify-j0.4": "^3.0.0-alpha.0",
     "url": "^0.11.0",
     "url-join": "^4.0.1",
@@ -93,10 +91,11 @@
     "@types/iarna__toml": "^2.0.5",
     "@types/redux-mock-store": "^1.0.2",
     "@types/url-join": "^4.0.0",
+    "jest-mock": "^27.5.1",
     "redux-mock-store": "^1.5.3"
   },
   "browser": {
     "path": "path-browserify"
   },
-  "gitHead": "02e3fe3e42ffac8cf7ac50fde1984ef3bd4d788c"
+  "gitHead": "567a80101f4846853701ad7d8abdc29b5e4fab56"
 }

package/src/__tests__/backend.spec.js

@@ -391,6 +391,68 @@ describe('Backend', () => {
       expect(backend.entryToRaw).toHaveBeenCalledTimes(1);
       expect(backend.entryToRaw).toHaveBeenCalledWith(collection, newEntry);
     });
+
+    it('should preserve slug when preSave event handler modifies file collection entry', async () => {
+      const implementation = {
+        init: jest.fn(() => implementation),
+        persistEntry: jest.fn(() => implementation),
+      };
+
+      const config = {
+        backend: {
+          commit_messages: 'commit-messages',
+        },
+      };
+
+      // File collection with a single file
+      const collection = Map({
+        name: 'settings',
+        type: FILES,
+        files: List([
+          Map({
+            name: 'config',
+            file: 'data/config.json',
+            fields: List([Map({ name: 'title', widget: 'string' })]),
+          }),
+        ]),
+      });
+
+      const originalEntry = Map({
+        slug: 'config',
+        path: 'data/config.json',
+        data: Map({ title: 'original' }),
+        meta: Map({ path: 'data/config.json' }),
+      });
+
+      const entryDraft = Map({
+        entry: originalEntry,
+      });
+
+      const user = { login: 'login', name: 'name' };
+      const backend = new Backend(implementation, { config, backendName: 'github' });
+
+      backend.currentUser = jest.fn().mockResolvedValue(user);
+      backend.entryToRaw = jest.fn().mockReturnValue('content');
+
+      // Mock invokePreSaveEvent to simulate a preSave handler that modifies data
+      // This is what happens when custom widgets or event handlers modify entry data
+      // The key is that it returns the FULL entry with slug, not just the data
+      backend.invokePreSaveEvent = jest.fn().mockImplementation(async entry => {
+        // Simulate a preSave handler modifying the data field
+        return entry.setIn(['data', 'title'], 'modified');
+      });
+
+      await backend.persistEntry({ config, collection, entryDraft });
+
+      // Verify entryToRaw was called with an entry that has the slug
+      expect(backend.entryToRaw).toHaveBeenCalledTimes(1);
+      const entryPassedToRaw = backend.entryToRaw.mock.calls[0][1];
+
+      // Critical assertion: slug must be preserved
+      expect(entryPassedToRaw.get('slug')).toBe('config');
+      expect(entryPassedToRaw.get('path')).toBe('data/config.json');
+      expect(entryPassedToRaw.getIn(['data', 'title'])).toBe('modified');
+    });
   });
 
   describe('persistMedia', () => {
@@ -1006,4 +1068,156 @@ describe('Backend', () => {
       ]);
     });
   });
+
+  describe('persistEntry with nested collections', () => {
+    it('should pass hasSubfolders=true when subfolders is true (default)', async () => {
+      const implementation = {
+        init: jest.fn(() => implementation),
+        persistEntry: jest.fn(),
+      };
+
+      const config = {
+        backend: { commit_messages: {} },
+      };
+      const collection = Map({
+        name: 'pages',
+        type: FOLDER,
+        folder: '_pages',
+        create: true,
+        fields: List([Map({ name: 'title', widget: 'string' })]),
+        nested: Map({ depth: 10, subfolders: true }),
+        meta: Map({ path: Map({ label: 'Path', widget: 'string' }) }),
+      });
+      const entryDraft = Map({
+        entry: Map({
+          data: Map({ title: 'Test' }),
+          meta: Map({ path: 'blog' }),
+          newRecord: true,
+        }),
+      });
+      const user = { login: 'user', name: 'User' };
+      const backend = new Backend(implementation, { config, backendName: 'test' });
+
+      backend.currentUser = jest.fn().mockResolvedValue(user);
+      backend.entryToRaw = jest.fn().mockReturnValue('content');
+      backend.generateUniqueSlug = jest.fn().mockResolvedValue('test-slug');
+      backend.invokePreSaveEvent = jest.fn().mockResolvedValue(entryDraft.get('entry'));
+      backend.invokePostSaveEvent = jest.fn().mockResolvedValue();
+
+      await backend.persistEntry({
+        config,
+        collection,
+        entryDraft,
+        assetProxies: [],
+        usedSlugs: List(),
+      });
+
+      expect(implementation.persistEntry).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({
+          hasSubfolders: true,
+        }),
+      );
+    });
+
+    it('should pass hasSubfolders=false when subfolders is false', async () => {
+      const implementation = {
+        init: jest.fn(() => implementation),
+        persistEntry: jest.fn(),
+      };
+
+      const config = {
+        backend: { commit_messages: {} },
+      };
+      const collection = Map({
+        name: 'pages',
+        type: FOLDER,
+        folder: '_pages',
+        create: true,
+        fields: List([Map({ name: 'title', widget: 'string' })]),
+        nested: Map({ depth: 10, subfolders: false }),
+        meta: Map({ path: Map({ label: 'Path', widget: 'string' }) }),
+      });
+      const entryDraft = Map({
+        entry: Map({
+          data: Map({ title: 'Test' }),
+          meta: Map({ path: 'blog' }),
+          newRecord: true,
+        }),
+      });
+      const user = { login: 'user', name: 'User' };
+      const backend = new Backend(implementation, { config, backendName: 'test' });
+
+      backend.currentUser = jest.fn().mockResolvedValue(user);
+      backend.entryToRaw = jest.fn().mockReturnValue('content');
+      backend.generateUniqueSlug = jest.fn().mockResolvedValue('test-slug');
+      backend.invokePreSaveEvent = jest.fn().mockResolvedValue(entryDraft.get('entry'));
+      backend.invokePostSaveEvent = jest.fn().mockResolvedValue();
+
+      await backend.persistEntry({
+        config,
+        collection,
+        entryDraft,
+        assetProxies: [],
+        usedSlugs: List(),
+      });
+
+      expect(implementation.persistEntry).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({
+          hasSubfolders: false,
+        }),
+      );
+    });
+
+    it('should default to hasSubfolders=true when subfolders is not specified', async () => {
+      const implementation = {
+        init: jest.fn(() => implementation),
+        persistEntry: jest.fn(),
+      };
+
+      const config = {
+        backend: { commit_messages: {} },
+      };
+      const collection = Map({
+        name: 'pages',
+        type: FOLDER,
+        folder: '_pages',
+        create: true,
+        fields: List([Map({ name: 'title', widget: 'string' })]),
+        nested: Map({ depth: 10 }),
+        meta: Map({ path: Map({ label: 'Path', widget: 'string' }) }),
+      });
+      const entryDraft = Map({
+        entry: Map({
+          data: Map({ title: 'Test' }),
+          meta: Map({ path: 'blog' }),
+          newRecord: true,
+        }),
+      });
+      const user = { login: 'user', name: 'User' };
+      const backend = new Backend(implementation, { config, backendName: 'test' });
+
+      backend.currentUser = jest.fn().mockResolvedValue(user);
+      backend.entryToRaw = jest.fn().mockReturnValue('content');
+      backend.generateUniqueSlug = jest.fn().mockResolvedValue('test-slug');
+      backend.invokePreSaveEvent = jest.fn().mockResolvedValue(entryDraft.get('entry'));
+      backend.invokePostSaveEvent = jest.fn().mockResolvedValue();
+
+      await backend.persistEntry({
+        config,
+        collection,
+        entryDraft,
+        assetProxies: [],
+        usedSlugs: List(),
+      });
+
+      expect(implementation.persistEntry).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({
+          hasSubfolders: true,
+        }),
+      );
+    });
+  });
 });

package/src/actions/__tests__/config.spec.js

@@ -862,6 +862,20 @@ describe('config', () => {
 
       assetFetchCalled('http://192.168.0.1:8081/api/v1');
     });
+
+    it('should return empty object when local_backend url has an unsafe scheme', async () => {
+      window.location = { hostname: 'localhost' };
+      global.fetch = jest.fn();
+      await expect(detectProxyServer({ url: 'file:///etc/passwd' })).resolves.toEqual({});
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+
+    it('should return empty object when local_backend url is not a valid URL', async () => {
+      window.location = { hostname: 'localhost' };
+      global.fetch = jest.fn();
+      await expect(detectProxyServer({ url: 'not a url' })).resolves.toEqual({});
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
   });
 
   describe('handleLocalBackend', () => {

package/src/actions/__tests__/editorialWorkflow.spec.js

@@ -8,9 +8,7 @@ import * as actions from '../editorialWorkflow';
 jest.mock('../../backend');
 jest.mock('../../valueObjects/AssetProxy');
 jest.mock('decap-cms-lib-util');
-jest.mock('uuid', () => {
-  return { v4: jest.fn().mockReturnValue('000000000000000000000') };
-});
+global.crypto.randomUUID = jest.fn().mockReturnValue('000000000000000000000');
 
 const middlewares = [thunk];
 const mockStore = configureMockStore(middlewares);

package/src/actions/__tests__/entries.spec.js

@@ -1,4 +1,4 @@
-import { fromJS, Map } from 'immutable';
+import { fromJS, List, Map } from 'immutable';
 import configureMockStore from 'redux-mock-store';
 import thunk from 'redux-thunk';
 
@@ -99,6 +99,41 @@ describe('entries', () => {
       });
     });
 
+    it('should populate draft entry from repeated URL param', () => {
+      const store = mockStore({ mediaLibrary: fromJS({ files: [] }) });
+
+      const collection = fromJS({
+        fields: [{ name: 'post', multiple: true }],
+      });
+
+      return store
+        .dispatch(createEmptyDraft(collection, '?post=2026-05-07-test&post=2026-05-08-test'))
+        .then(() => {
+          const actions = store.getActions();
+          expect(actions).toHaveLength(1);
+
+          expect(actions[0]).toEqual({
+            payload: {
+              author: '',
+              collection: undefined,
+              data: { post: List(['2026-05-07-test', '2026-05-08-test']) },
+              meta: {},
+              i18n: {},
+              isModification: null,
+              label: null,
+              mediaFiles: [],
+              partial: false,
+              path: '',
+              raw: '',
+              slug: '',
+              status: '',
+              updatedOn: '',
+            },
+            type: 'DRAFT_CREATE_EMPTY',
+          });
+        });
+    });
+
     it('should html escape URL params', () => {
       const store = mockStore({ mediaLibrary: fromJS({ files: [] }) });
 

package/src/actions/config.ts

@@ -308,11 +308,12 @@ export function applyDefaults(originalConfig: CmsConfig) {
         collection.folder = trim(folder, '/');
 
         if (meta && meta.path) {
+          const metaPath = meta.path;
           const metaField = {
             name: 'path',
             meta: true,
             required: true,
-            ...meta.path,
+            ...metaPath,
           };
           collection.fields = [metaField, ...(collection.fields || [])];
         }
@@ -458,6 +459,17 @@ export async function detectProxyServer(localBackend?: boolean | CmsLocalBackend
       ? defaultUrl
       : localBackend.url || defaultUrl.replace('localhost', location.hostname);
 
+  try {
+    const { protocol } = new URL(proxyUrl);
+    if (protocol !== 'http:' && protocol !== 'https:') {
+      console.log(`Decap CMS local_backend url must use http or https, ignoring '${proxyUrl}'`);
+      return {};
+    }
+  } catch {
+    console.log(`Decap CMS local_backend url '${proxyUrl}' is not a valid URL`);
+    return {};
+  }
+
   try {
     console.log(`Looking for Decap CMS Proxy Server at '${proxyUrl}'`);
     const res = await fetch(`${proxyUrl}`, {