This is a third security release in the continuation of 1.30.x, mostly to address some severe PHP vulnerabilities and update our official default Docker images (Debian) (but not our alternative Alpine images yet, which are delayed).
Note that our rolling-release channel (edge) is recommended for faster security patches.
docs: contributor docs are excluded from prettier checks (#28062)
lint: eslint fails to parse vitest.config.ts in admin/server packages (#28064)
lint: extra-policy oxlint perf on the blocking gate (#27671)
review-workflows: migrate unit tests from jest to vitest (#27388)
review-workflows: stop passing ignored populate to workflow create and update (#27865)
types: centralise the window.strapi type in @strapi/types (#26213)
upload: enforce the media MCP ambient guard by construction (#27617)
π Enhancement
database: describe connection pool timeouts (#28000)
utils: avoid rebuilding curried traversal wrappers on every call (#27947)
utils: remove per-key allocations from the query traversal (#27233)
β οΈ Changes to be aware of
Database driver update (knex 3.3.0)
Custom code that uses strapi.db.connection and calls delete() with limit or having, or truncate() with where, having or limit, now throws on PostgreSQL and SQLite. MySQL now applies the LIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as [database] knex: β¦.
Token and role names are limited to 255 characters
The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.
Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The engines field still says >=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.
The upload plugin now applies sharp.limitInputPixels. Strapi refuses to start if the value is not true, false or an integer of 0 or more. A value read straight from an environment variable is a string, so use env.int().
Known issue: deleting an entry changes past releases
When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.
In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example X-CX-D instead of X-D). Check the header names before you save.
Log in
