UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Changes
Made it more clear that TRUSTED_HOST value must not be quoted in docker-compose file, both in documentation and messages (#1453)
Import: document EDA/KiCad columns, add regression tests, fix eda_invisible inversion by @Sebbeben in #1436
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
If you are using Part-DB it would be helpful if you fill out this short survey on your usage of Part-DB (Google Forms): https://forms.gle/Q15twx3YYq3qCNfe8
Part-DB 2.13.2
Bug fixes
Respect the attachment file limits, when Part-DB downloads a file, or a file gets uploaded base64 encoded via API
Prevent formula injection when exporting tables as excel files
Fixed problem with javascript and CSS not loading when using apache with mod_php (#1423)
UpSnap is, and always will be, free and open source software.
If someone is asking you to pay money for access to UpSnap binaries, source code, or licenses, you are being scammed.
The official and only trusted source for UpSnap is this repository (and its linked releases).
Do not pay third parties for something that is provided here for free.
typescript-utils: bump internal deps to 5.50.1 (#26946)
β οΈ Changes to be aware of
Admin auth cookie name
You can set admin.auth.cookie.name in admin config to rename the access-token cookie (default remains jwtToken). Useful when another app on a shared parent domain sets a jwtToken cookie and breaks admin login.
In v5, status is reserved for draft/published filtering. If a content type has Draft & Publish enabled and a custom status field, Strapi now logs a startup warning instead of failing boot. The Content-Type Builder still blocks adding status or enabling D&P when status already exists.
@strapi/upgrade now warns and offers to pin ranged @strapi/* dependencies (e.g. ^5.50.0) before upgrading, so upgrades don't silently report "already up-to-date" when node_modules resolved ahead of package.json.
sandboxing can fail in too many creative ways (funky linux distros with funky filesystem layouts and policies) so autoconfiguring bwrap is not feasible
to enable it, set use-bwrap: y after adjusting th-bwrap to match your OS/env
see the default th-bwrap value in --help on your server for a best-effort guess
there is a discord server with an @everyone in case of future important updates, such as vulnerabilities (most recently 2026-07-06)
β οΈ ATTN: this release fixes a dirkey vulnerability
in volumes with bothdirkeys and filekeys enabled (default-disabled), a valid filekey could be converted into a dirkey, granting read-access to the containing folder
recent important news
v1.20.17 (2026-07-06) fixed a vuln when a volume has both filekeys and dirkeys enabled
v1.20.17 (2026-07-06) introduced csp nonces, possibly breaking some javascript-based plugins
π§ͺ new features
enforce csp nonces on javascript (additional xss defense) d3b9599
this could possibly break some aftermarket javascript-based plugins (--js-browser / --html-head)
now probably safe to disable the markdown/logue sandboxes (--no-sb-md / --no-sb-lg) in most deployments, avoiding #230
sandbox ffmpeg/ffprobe in bwrap to defend against future FFmpeg vulns efa43f885be3b8
doesn't work in docker / podman, so initcfg in the images have use-bwrap: n to disable it db68353
Log in
