❌

Lees weergave

↗️

v5.52.2

βœ‡Strapi
Door: internal-releases[bot]

5.52.2 (2026-08-26)

✨ New Media Library (opt-in beta)

A complete revamped Media Library UI is available behind a feature flag. Set future.betaMediaLibrary: true in config/features and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs and the Notion Page

Feedback while it's behind the flag is very welcome. Enjoy!

Image details

πŸ”₯ Bug fix

  • make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
  • admin: out of sort memory when listing audit logs on mysql (#27410)
  • admin: send credentials on fetch client requests (#27413)
  • admin: keep api token permissions on localized content types at boot (#27420)
  • admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
  • admin: slow startup with many roles due to redundant permission … (#27438)
  • content-manager: draft status filter with i18n sibling locale published (#26835)
  • content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
  • content-manager: out of sort memory when listing history versions on mysql (#27394)
  • core: Access token rotation fails with asymmetric JWT algorithms (#27201)
  • core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
  • core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
  • database: relation reorder saves the wrong position (#27444)
  • i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
  • permissions: surface clear error for unsupported RBAC condition operators (#27355)
  • plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
  • upload: translate server error codes in the new media library (#27345)
  • upload: sizeLimit is not enforced when replacing a file (#27414)
  • upload: move replace media to the drawer footer, add tooltips (#27425)
  • upload: list queued files in the upload progress dialog (#27416)
  • upload: merge a second drop into the running upload batch (#27415)

βš™οΈ Chore

  • replace lodash forEach with native Object.entries/values (#27409)
  • add worktree bootstrap command (#27426)
  • deps: upgrade memfs to 4.68.1 in @strapi/upgrade (#27406)
  • deps: migrate first-party zod to 4.4.3 (#27428)

πŸ’… Enhancement

  • data-transfer: clarify partial transfer stage scope (#27322)
  • database: log internal migrations at info level (#27324)
  • database: add migration progress heartbeats (#27325)

🚨 Security

  • graphql: warn about unbounded operation limits (#27390)
  • upload: deny svg in generated project defaults (#27360)

⚠️ Changes to be aware of

New projects block SVG uploads by default

Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)

❀️ Thank You

  •  
  • ↗️
↗️

v5.52.1

βœ‡Strapi
Door: internal-releases[bot]

5.52.1 (2026-08-19)

πŸ”₯ Bug fix

  • admin: unrelated permission conditions no longer block page access (3ded36a7b0)
  • content-manager: deduplicate MCP tool names when an api has multiple content types (#27357)
  • content-manager: refraining from counting error draft relations … (#26900)
  • upload: show tooltip on truncated names in the media library (#27340)
  • users-permissions: unable to clear refresh token cookie on logout due to mismatched options (#25106)

βš™οΈ Chore

  • update develop with release 5.52.0 (#27343)
  • deps: bump fast-uri from 3.1.4 to 3.1.5 (#27242)

❀️ Thank You

  •  
  • ↗️
↗️

v5.52.0

βœ‡Strapi
Door: internal-releases[bot]

5.52.0 (2026-08-12)

πŸš€ New feature

  • record MCP actions in audit logs (#27151)
  • i18n: add locale codes for Corsican (#27099)
  • server: enhance Koa app configuration with proxy settings (#26409)

πŸ”₯ Bug fix

  • typescript pipeline issue (99a723d024)
  • admin: dedupe react-dnd in the admin bundle (#27217)
  • admin: address filter entries by position so duplicate filter chips behave (#27188)
  • content-manager: merge query populate paths to preserve nested populate (#27236)
  • content-type-builder: editing relations removes inverse field conditions (#27226)
  • content-type-builder: clear stale validation errors when the form data is replaced (#27222)
  • data-transfer: skip orphaned links and isolate FK failures on restore (#26852)
  • permissions: skip unregistered RBAC conditions during ability generation (#27282)
  • strapi: allowlist Vite optimizeDeps.exclude for plugin UI kits (#27264)
  • upload: refresh folder header count on upload & delete (CMS-1563) (#27231)
  • upload: guard cache-buster on signed URLs in new-ML AssetCropEditor (#27228)
  • upload: target current asset in drawer actions (#27259)
  • upload: keep infinite scroll loading when the sentinel stays visible (CMS-1562) (#27230)

βš™οΈ Chore

  • release v5.51.2 update develop (101643bcfb)
  • bump design system version (#27292)
  • cloud-cli: migrate unit tests from jest to vitest (#27218)
  • database: replace umzug with internal migration runner (#26824)
  • deps: bump ip-address from 10.2.0 to 10.4.0 (#27238)
  • deps: bump ws from 8.21.1 to 8.21.2 (#27239)
  • deps: bump hono from 4.12.27 to 4.13.0 (#27243)
  • deps: bump prettier from 3.3.3 to 3.6.2 (#27244)
  • deps: bump direct deps and yarn dedupe (#27291)
  • deps: bump nanoid from 3.3.16 to 3.3.18 (#27329)
  • permissions: migrate unit tests from jest to vitest (#27219)
  • sentry: migrate unit tests from jest to vitest (#27252)
  • tooling: add admin translation verification (#26960)
  • upload-aws-s3: migrate unit tests from jest to vitest (#27216)

πŸ’… Enhancement

  • utils: memoize private attributes in sanitizeOutput (#27140)
  • utils: stop using a thrown Error to test for boolean-like populate keys (#27234)
  • utils: memoize scope decisions and keep the relation visitor sync (#27145)

🚨 Security

  • deps: bump @modelcontextprotocol/sdk to 1.30.0 (#27301)
  • upload: bump sharp to 0.35.3 for libvips CVEs (#27255)

❀️ Thank You

  •  
  • ↗️
↗️

v5.51.2

βœ‡Strapi
Door: internal-releases[bot]

5.51.2 (2026-08-05)

πŸš€ New feature

  • content-manager: add optional component screenshots to DZ picker (#26863)

πŸ”₯ Bug fix

  • use radio roles for accessibility and improve aria attributes (#27139)
  • handle i18n conflict and local rights (6519f4d5db)
  • admin: interpolate min/max values in validation error messages (#27172)
  • admin: pin react-colorful to prevent optimizeDeps include/exclude conflict (#27203)
  • content-manager: relation creation discards parent changes (#27081)
  • content-manager: relation order changes after saving dynamic-zone components (#27135)
  • content-manager: keep document status accurate on mixed-locale batches (#27035)
  • core: use configured default pageSize when only page is provided (#27132)
  • database: escape LIKE wildcards in filters and use equality for $eqi/$nei (#26476)
  • i18n: use fractional temp_key when filling from locale (#26296)
  • upload: stream URL imports to disk instead of buffering in memory (#27176)
  • upload: keep cursor position while editing asset details fields (CMS-1536) (2c6edbfacb)
  • upload: apply asset permissions to media library actions (CMS-434) (e8099188e2)
  • upload: keep crop drag tracking on touch devices (CMS-1538) (7807ea83dc)
  • upload: keep asset drawer header visible on mobile (CMS-1539) (4edad7ca75)
  • upload: media library MVP fixes (7a4012c65a)

πŸ“š Documentation Changes

  • add contributor documentation for the MCP server (#27160)

βš™οΈ Chore

  • deps: bump @hono/node-server from 1.19.14 to 1.19.17 (#27166)
  • deps: bump postcss from 8.5.14 to 8.5.25 (#27195)
  • deps: bump brace-expansion from 1.1.16 to 1.1.18 (#27196)
  • deps: bump js-yaml from 3.15.0 to 3.15.1 (#27197)
  • deps: bump motion from 12.23.24 to 12.40.0 (#27133)
  • deps: bump tar from 7.5.21 to 7.5.22 (#27165)
  • deps: bump react-router-dom from 6.30.3 to 6.30.4 (#27134)
  • deps: bump undici from 6.27.0 to 6.28.0 (#27164)
  • deps: bump axios from 1.18.1 to 1.19.0 (#27198)
  • deps: align app-template react-router-dom with admin 6.30.4 (#27210)
  • jest: run unit/front tests via nx, drop root jest config and dep (#26701)
  • lint: add non-blocking oxlint setup (#26923)
  • users-permissions: move server code into server/src (#26105)

πŸ’… Enhancement

  • content-type-builder: support required on relation attributes (#27080)
  • core: look models up on the registries in getModel (#27143)
  • database: reduce per-column work when mapping rows to entities (#27144)

⚠️ Changes to be aware of

Filter operators: literal wildcards and true case-insensitive equality

$eqi / $nei now do real case-insensitive equality (= LOWER(?)), not LIKE, so values with %, _, or a trailing \ no longer act as wildcards or crash some databases. Substring operators ($contains, $startsWith, $endsWith, and case-insensitive variants) now treat %, _, and \ in the filter value as literal characters. If you relied on % / _ inside those filters as SQL wildcards, update filters to match the new literal semantics.
(#26476)

❀️ Thank You

  •  
  • ↗️
↗️

v5.51.1

βœ‡Strapi
Door: internal-releases[bot]

5.51.1 (2026-07-29)

πŸ”₯ Bug fix

  • respect field length constraints in AI localizations and isolate… (#26880)
  • wording and merging sort options (844c8d625d)
  • preserve sorting on view change (6ed616ab9a)
  • admin: scope audit logs user filter to log authors (#27047)
  • content-manager: homepage recent-documents dates serialize as empty objects (#27066)
  • core: enforce required media and relations via api.documents.strictRelations (#27028)
  • database: return [] for empty morphMany on read (#27090)
  • strapi: prevent duplicate public assets in Vite builds (#27089)

βš™οΈ Chore

  • admin: allow RFC 6265 control-char regex under develop eslint rules (e8338bb6ba)
  • ci: remove admin bundle-size workflow (#27070)
  • deps: bump brace-expansion from 1.1.14 to 1.1.16 (#27071)
  • deps: bump shell-quote from 1.8.4 to 1.10.0 (#27072)
  • deps: bump body-parser from 1.20.4 to 1.20.6 (#27094)
  • deps: bump dompurify from 3.4.11 to 3.4.12 (#27095)
  • deps: bump fast-uri from 3.1.2 to 3.1.4 (#27098)
  • deps: bump use-context-selector from 1.4.1 to 1.4.4 (#27061)
  • deps: bump cropperjs from 1.6.1 to 1.6.2 (#27060)
  • deps: upgrade handlebars, axios, tar, and related transitive deps (#27091)
  • deps: bump @radix-ui/react-toolbar from 1.0.4 to 1.1.11 (#27059)
  • email-nodemailer: migrate unit tests from jest to vitest (#27074)
  • email-sendmail: migrate unit tests from jest to vitest (#27075)
  • upload-local: migrate unit tests from jest to vitest (#27073)

⚠️ Changes to be aware of

Required media and relations: opt-in strictRelations

New config api.documents.strictRelations enforces required media and relations on publish (drafts can still be empty). On by default for new projects; existing apps are unchanged until you set it. To opt in, set documents.strictRelations: true in config/api.
(#27028)

Empty multiple media / morphMany now returns []

Populated empty morphMany relations (including type: 'media', multiple: true) serialize as [] instead of null, matching other to-many relations. This is unconditional and not gated by strictRelations. If clients, webhooks, or integrations check field === null for empty galleries / morphMany, treat [] as empty instead (e.g. !field?.length).
(#27090)

❀️ Thank You

  •  
  • ↗️
↗️

v5.51.0

βœ‡Strapi
Door: internal-releases[bot]

5.51.0 (2026-07-23)

πŸš€ New feature

  • data-transfer: add exclude/only content type CLI filters (#26915)
  • i18n: add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) (#26255)

πŸ”₯ Bug fix

  • preserve order when reordering a relation to the start of a list (#26112)
  • singleton modules for consistent runtime instances (#27064)
  • admin: admin session token respects configured admin-cookie-path (#25478, #26300)
  • admin: make plugin/setting "Select all" work in admin token permissions (#27027)
  • admin: revalidate SPA shell to avoid stale chunk imports (#27039)
  • admin: expire admin reset-password tokens (#27020)
  • admin: improve SSO session metadata and logout revocation (#26872)
  • admin: blank admin in develop from prism language prebundle (#27086)
  • admin: SSO remote logout infinite redirect (cookie path) (#27100)
  • content-manager: pre-bundle prism language plugins for all apps (#26978)
  • content-manager: respect disconnected draft relations in publish warning (#26871)
  • content-manager: validate items passed to plugin action APIs (#27008)
  • content-manager: skip blocks editor remount on equal value echoes (#27042)
  • content-manager: keep preview button mounted during document churn (#27043)
  • content-releases: normalise release id so rescheduling cancels the stale job (#27063
  • core: enforce default maxLength 255 for string fields (#26128)
  • core: preserve draft relation order in discard-drafts migration (#26851)
  • core: propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag (#26525)
  • create-strapi-app: npm ci fails on fresh npm scaffold (#27038)
  • create-strapi-app: missing @strapi/database dependency breaks pnpm builds (#27083)
  • database: apply MySQL dialect configure to resolved connection functions (#26646)
  • graphql: include private fields in mutation inputs (#26489)
  • types: update LoadedPlugin type to understand factories (#25298)
  • upload: report real upload progress in the media library (#27045)
  • users-permissions: use correct i18n ids for role notifications (#27044)
  • users-permissions: fix role notification translations (#26933)

βš™οΈ Chore

  • merge main into develop after 5.50.2 release (9d93244f7e)
  • deps: bump ws from 8.21.0 to 8.21.1 (#27030)
  • deps: bump tar from 7.5.18 to 7.5.20 (#27029)
  • deps: bump linkify-it from 5.0.0 to 5.0.2 (#26886)
  • email-mailgun: migrate unit tests from jest to vitest (#27069)
  • types: per-client database connection types (#26949)
  • users-permissions: replace grant/purest/jwk-to-pem with fetch and crypto (#26820)
  • utils: upgrade preferred-pm to v5 with dynamic import (#26822)

❀️ Thank You

  •  
  • ↗️
↗️

v5.50.2

βœ‡Strapi
Door: internal-releases[bot]

5.50.2 (2026-07-15)

πŸš€ New feature

  • admin: make admin auth cookie name configurable (#26931)
  • i18n: complete Korean (ko) translation (#26941)

πŸ”₯ Bug fix

  • admin: prevent deprecated CJS Vite Node API warning on startup (#26947)
  • admin: pre-commit fails when staging files ignored by ESLint (#26958)
  • admin: show plan label instead of edition in dashboard (#26891)
  • admin: restore runtime default for context helper (#26809)
  • ci: reduce false positives in issue template checker (#26955)
  • ci: use npm install in issue template checker workflow (#26974)
  • content-manager: clear stale Blocks editor selection on external value change (#26959)
  • core: backward compat - reject 'status' attribute when draftAndPublish is enabled (#26890)
  • core: validate license registry responses with zod (#26935)
  • core: preserve duplicate form relation edits when cloning (#26961)
  • data-transfer: bump ws to 8.21.0 to fix CVE-2026-48779 (#26898)
  • database: include status sort expression in SELECT when using DISTINCT (#26751)
  • database: lint script does not run type check (#26819)
  • email: only warn about sendmail provider in development (#26893)
  • openapi: add bearerAuth and bracket pagination query params (#26948)
  • strapi: auto-exclude pre-built plugin UI libs from Vite optimizeDeps (#26944)
  • strapi: fix develop blank admin from optimizeDeps auto-exclude (#27014)
  • upgrade: prompt to pin ranged @strapi/* dependencies before upgrading (#26929)
  • upload: load remote asset thumbnails with crossOrigin to prevent CORS preview failures (#26581, #26901)
  • utils: align remaining convert-query-params errors with ValidationError (#26908)

βš™οΈ Chore

  • ai-tooling: sync skills when cursor sets up a new worktree (#26954)
  • data-transfer: clarify --exclude files CLI messaging (#26914)
  • deps: patch/minor dependency bumps (#26823)
  • deps: bump @xhmikosr/decompress from 10.2.0 to 10.2.1 (#26928)
  • deps: bump sharp from 0.33.5 to 0.34.5 (#26993)
  • deps: bump @internationalized/date from 3.5.4 to 3.12.1 (#26994)
  • deps: bump design-system and icons to v2.2.3 (#27002)
  • eslint: enforce zero warnings in package lint scripts (#26922)
  • husky: run git hooks through yarn exec (#27006)
  • tooling: remove unused find-up after lint-staged 16 (#26792)
  • types: drop CommonJS tsconfig overrides, build JS via rollup (#26934)
  • typescript: scope tsconfig types per workspace (#26699)
  • typescript-utils: migrate to typescript (#26811)
  • typescript-utils: bump internal deps to 5.50.1 (#26946)

⚠️ Changes to be aware of

Admin auth cookie name

You can set admin.auth.cookie.name in admin config to rename the access-token cookie (default remains jwtToken). Useful when another app on a shared parent domain sets a jwtToken cookie and breaks admin login.

(#26931)

status attribute with Draft & Publish

In v5, status is reserved for draft/published filtering. If a content type has Draft & Publish enabled and a custom status field, Strapi now logs a startup warning instead of failing boot. The Content-Type Builder still blocks adding status or enabling D&P when status already exists.

(#26890)

Upgrade tool and ranged @strapi/* versions

@strapi/upgrade now warns and offers to pin ranged @strapi/* dependencies (e.g. ^5.50.0) before upgrading, so upgrades don't silently report "already up-to-date" when node_modules resolved ahead of package.json.

(#26929)

❀️ Thank You

  •  
  • ↗️
↗️

v5.50.1

βœ‡Strapi
Door: internal-releases[bot]

5.50.1 (2026-07-08)

πŸš€ New feature

  • i18n: complete Japanese (ja) translations (#26855)
  • i18n: update Polish translation (#26592)

πŸ”₯ Bug fix

  • give the ability to open a list item in a new tab (#26853)
  • admin: translate enumeration option labels in the content manager (#26837)
  • admin: seat limit billing links (#26728)
  • cloud: hide deploy menu in production using currentEnvironment (#26733)
  • content-manager: allow reading hidden content types for relation targets (#26844)
  • content-manager: preserve i18n locale on navigation and guard component schema race condition (#26167)
  • core: preserve self-referential relation order on child publish (#26838)
  • core: preserve published self-referential relation state (#26932)
  • database: prevent crash when reordering and removing a relation in the same save (#26210)
  • documentation: allow array populate parameter (#26358)
  • examples: enable strict TypeScript in dev sandboxes (#26780)
  • generators: detect plugin language from output path (#26750)
  • review-workflows: add server eslint config and declare server deps (#26800)
  • strapi: resolve admin Vite aliases from @strapi/admin closure (#26756)
  • typescript-utils: emit namespace keyword instead of deprecated module (#26195)
  • upload: accept single-file arrays on replacement (#26405)
  • utils: align polymorphic populate validation with conversion (#26848)
  • utils: return 400 instead of 500 for invalid sort order/params (#26907)

πŸ“š Documentation Changes

  • Highlight destructive operation in transfer engine (#25081)

βš™οΈ Chore

  • fix lint warnings (#26818)
  • deps: bump nodemailer from 8.0.9 to 9.0.1 (#26721)
  • deps: bump qs from 6.15.2 to 6.15.3 (#26846)
  • deps: bump tar from 7.5.16 to 7.5.17 (#26847)
  • deps: bump js-yaml from 3.14.2 to 3.15.0 (#26888)
  • deps: bump tar from 7.5.17 to 7.5.18 (#26887)
  • deps-dev: bump eslint-plugin-prettier in the eslint group (#26828)
  • deps-dev: bump @rollup/plugin-swc in the rollup group (#26906)
  • deps-dev: align @babel/* family to 7.29.7 (#26911)

πŸ’… Enhancement

  • ci: block community PRs targeting main (#26854)
  • content-manager: keep sidebar primary actions and search bar fixed… (#26867)

❀️ Thank You

  •  
  • ↗️
↗️

v5.50.0

βœ‡Strapi
Door: internal-releases[bot]

5.50.0 (2026-07-02)

πŸš€ New feature

  • admin: add active devices session management (#26628)
  • cli: add security defaults to create-strapi-app templates (#26737)
  • database: export lifecycle event type (#25637)
  • provider-email-sendgrid: add region option for EU data residency (#25907)
  • provider-upload-aws-s3: accept a credential provider function (#26796)
  • translations: comprehensive Japanese (ja) translation update for admin and 9 plugins (#26687)
  • ts: augment all context error response methods (#25424)

πŸ”₯ Bug fix

  • refresh token cookies missing Max-Age when sessions.cookie.maxAg… (#26747)
  • add test database healthchecks (#26511)
  • generate apis in named directories (#26354)
  • admin: retry lazy chunk loads and improve loading and error UX (#25954)
  • admin: open "Upgrade your admin panel" link in new tab (#26510)
  • admin: remove @ts-expect-error in useQueryParams hook (#25006)
  • admin: hide boolean clear action when field is disabled (#26294)
  • admin: restore default locale in permissions when adding i18n to ct (#26548)
  • admin: keep static fallback paths url-safe (#26518)
  • admin: stop storing IP addresses in session metadata (#26873)
  • ci: use allowlisted thollander action ref in experimental publish workflow (#26768)
  • content-api: validate populate for polymorphic structures (#25854)
  • content-manager: warn before publishing with draft relations (#26736)
  • content-manager: use ListViewTable relation-loaded translation key (#26798)
  • content-manager: serve live preview script from server endpoint (#26732)
  • content-manager: capitalize component category names in dynamic zone (#24426, #26337)
  • content-manager: add Japanese EditView shortcut hint translations (#26814)
  • content-manager: prevent dynamic zone crash when value is null (#26816)
  • content-manager: skip publish warning for M2M links to published entries (#26858)
  • content-type-builder: improve component category validation error message (#25455)
  • core: preserve M2M relation order on published version after reo… (#26791)
  • core: maxFileSize error not detected in body middleware (#25011)
  • core: resolve relations on non-localized entries with stale locale column (#26805)
  • create-strapi-app: scaffold pnpm 11 allowBuilds for Strapi Cloud (#26757)
  • create-strapi-app: enable strict TypeScript in app scaffolds (#26779)
  • create-strapi-app: limit odd Node major warning to versions before 26 (#26810)
  • data-transfer: restore localizations links that use document_id refs (#26870)
  • graphql: preserve M2M relation order with pagination (#26577, #26785)
  • test: tighten jest ignore patterns to match path segments (#26753)
  • translations: correct ja "characters" mistranslation in WYSIWYG controls (#26845)
  • types: tighten Core.Config typings with backward-compatible deprecations (#26787)
  • upload: disable asset editing and deletion on published entries (#26127)
  • users-permissions: accept documentId for the role relation on user create/update (#26715)
  • users-permissions: correct "occured" β†’ "occurred" typo in error notifications (#26508)
  • utils: prevent crash on null dynamic zone entry during traversal (#24303, #26842)

πŸ“š Documentation Changes

  • fix typos and grammar slips in content-manager docs (#26600)

βš™οΈ Chore

  • add ai-tooling sync script for skill symlinks (#26594)
  • rename ai-tooling yarn scripts to ai:* (#26767)
  • reduce Vercel noise on PRs (contributor-docs ignore step) (#26772)
  • cloud plugin updates (#26801)
  • update cli deploy copies (f0fa460525)
  • deps: hoist @types/node to root and align with 20, min supported engine (#26291)
  • deps: upgrade TypeScript to 5.9.3 (#26782)
  • deps: bump hono from 4.12.23 to 4.12.27 (#26761)
  • deps: bump design-system to v2.2.1 (#26788)
  • deps: bump axios from 1.18.0 to 1.18.1 (#26762)
  • deps: upgrade lint-staged to 16 and scope linting to staged files (#26765)
  • deps: remove unused @strapi/ts-zen dev dependency (#26759)
  • typescript: enable erasableSyntaxOnly and noUncheckedSideEffectImports (#26790)
  • workflows: make documentation flag name more obvious (#26649)

πŸ’… Enhancement

  • admin: add uz-Cyrl native name to languageNativeNames (#24920)
  • strapi: lazy-load TypeScript chain for non-build CLI commands (#26265)
  • utils: add env.required for strict scaffold secrets (#26830)

🚨 Security

  • users-permissions: default legacy JWT verify to HS256 (#26752)

❀️ Thank You

  •  
  • ↗️
↗️

v5.49.0

βœ‡Strapi
Door: internal-releases[bot]

5.49.0 (2026-06-24)

πŸš€ New feature

  • mcp: export defineTool/defineResource/definePrompt builders (#26603)

πŸ”₯ Bug fix

  • add support for initiallySelectedAssets (#26679)
  • homepage dashboard duplicates entries for users with multiple roles (#25860)
  • avoid buffering large uploads for MIME detection (#26678)
  • throw ValidationError when populate exceeds qs arrayLimit (#25632, #25916)
  • push anchor into view to prevent off-screen tooltips (#26303)
  • admin: support array of links in StrapiApp.addSettingsLink (#26433)
  • admin: admin users logged out mid-session by access-token expiry timer (#26680)
  • content-manager: use top-level Core type import in MCP types (#26681)
  • content-manager: save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter (#26621)
  • content-manager: reduce MCP relation output to identity-only shape (#26560)
  • content-manager: deduplicate MCP tool names when plugin has multiple content types (#26710)
  • core/core: mcp misleading lifecycle docs (#26698)
  • create-strapi-app: allow pnpm to build better-sqlite3 for SQLite scaffolds (#26675)
  • data-transfer: transfer admin menu and auth logos with configuration (#26425)
  • database: stop full-schema component_type IN on dynamic zone populate (#26734)
  • document-service: preserve published relations from non-dp sources (#26654)
  • strapi: default allowedHosts and pin Vite HMR to main server in dev (#26244)
  • types: add explicit return types to recursive functions (#26704)

πŸ“š Documentation Changes

  • fix spelling typos in content-manager relations guide (#26724)

βš™οΈ Chore

  • removing coderabbit status (#26703)
  • core: upgrade package-json to 10.0.1 + rollup interop 'auto' (#26673)
  • deps: bump markdown-it from 14.1.1 to 14.2.0 in the richtext-editor-security group across 1 directory (#26688)
  • deps: bump dompurify from 3.4.5 to 3.4.9 (#26684)
  • deps: bump nodemailer from 8.0.5 to 8.0.9 (#26689)
  • deps: bump tar from 7.5.11 to 7.5.16 (#26691)
  • deps: bump form-data from 4.0.4 to 4.0.6 (#26692)
  • deps: bump anthropics/claude-code-action from 1.0.123 to 1.0.132 (#26727)
  • deps: bump piscina from 4.9.2 to 4.9.3 (#26716)
  • deps: bump undici from 6.25.0 to 6.27.0 (#26714)
  • deps: bump dompurify from 3.4.9 to 3.4.11 (#26719)
  • deps-dev: bump @babel/core (#26667)

πŸ’… Enhancement

  • upload: add optional replace method to upload providers (#26582)

❀️ Thank You

⚠️ Changes to be aware of

Content Manager keyboard shortcuts

Save a draft with Cmd/Ctrl+Enter (or Cmd/Ctrl+S). Publish with Cmd/Ctrl+Shift+Enter. Since v5.31.3, plain Cmd/Ctrl+Enter published immediately β€” that shortcut now saves instead. (#26621)

  •  
  • ↗️
↗️

v5.48.1

βœ‡Strapi
Door: internal-releases[bot]

5.48.1 (2026-06-17)

πŸš€ New feature

  • linking to the Billing Portal (3df113f545)
  • pointing Upsell Banner to Strapi Billing (06b0c31f47)
  • add optional openapi spec route (#26239)
  • updating billing portal address (2d3fea21ff)
  • openapi: gate endpoint access with config (#26574)
  • upload: add paginated GET /api/upload/files/page endpoint (#26597)

πŸ”₯ Bug fix

  • upload returns unsigned URL on update media info (#25195)
  • widgets show error when role has no access to mainfield of ct (#26537)
  • correct IME Enter key handling in BlocksInput (#24997)
  • admin: return empty object for empty json body in fetch client (#26277)
  • admin: exclude disabled plugins from admin build (#26448)
  • admin: rate limit and serialize first admin registration (#26576)
  • admin: validate current user email updates (#26591)
  • admin: guard stale admin configuration (#26625)
  • build: build does not run install; add install-deps arg (#26483)
  • ci: run build:size as full command for compressed-size-action v3 (#26556)
  • ci: restore allowed paths-filter pin (#26575)
  • ci: avoid syncing CPR labels to CMS tickets (#26648)
  • content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
  • content-manager: raise z-index of code block language selector (#25010, #26324)
  • content-manager: dedupe bulk delete document ids (#26613)
  • content-manager: replace sanitize-html with dompurify in Wysiwyg preview (#26150)
  • core: validate numeric inputs before DB unique checks (#26101)
  • core/admin | content-manager: combine multi-role field-level permissions (#26055)
  • data-transfer: skip links referencing data that was never transferred (#26531)
  • data-transfer: buffer push assets before invoking uploadStream (#26086)
  • database: restore join-table relation sort order in components (#26553)
  • database: avoid double finalising completed transactions (#26122)
  • database: move document_id secondary indexes to schema sync (#26241)
  • strapi: stabilize admin redux deps during upgrade (#26249)
  • tsconfig: remove lodash from server compilerOptions.types (#26627)
  • upload: folder navigation bugs in Media Library (#26515)
  • upload: preserve animation frames in GIF and WebP images (#26126)
  • users-permissions: support documentId user relations (#26607)
  • utils: ignore empty sort when building orderBy (#26427)

πŸ“š Documentation Changes

  • add CLAUDE.md alias and link PR template from AGENTS.md (#26251)
  • fix typos across contributor docs (#26590)
  • fix broken relative cross-doc links (#26601)
  • deprecate Node 20 in documentation (#26623)
  • openapi: add contributor documentation (#26410)

βš™οΈ Chore

  • remove experimental-dev example app (#26552)
  • update .gitignore for AI tooling directories (#26526)
  • release v5.48.0 update develop (#26599)
  • adding check for valid template on issue creation (#26546)
  • adding translations for manage subscription (aa0b3da3eb)
  • getting tests to pass (d2c06c6ca2)
  • *: support Node 26 (#26232)
  • ai/skills: add writing-a-skill skill (#26428)
  • ai/skills: add commit conventions (#26431)
  • ci: drop Node 20 from test workflow matrices (6f1a21c528)
  • ci: drop Node 20 from test workflow matrices (#26609)
  • core/strapi: dynamically import browserslist-to-esbuild (#25507)
  • data-transfer: move types into src so they are type-checked (#26352)
  • deps: bump axios from 1.16.1 to 1.17.0 (#26539)
  • deps: bump the testing-library group across 1 directory with 2 updates (#26506)
  • deps: bump actions/setup-node from 4 to 6 (#26496)
  • deps: bump actions/stale from 10 to 10.2.0 (#26497)
  • deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
  • deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
  • deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
  • deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
  • deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
  • deps: bump follow-redirects from 1.15.6 to 1.16.0 (#26580)
  • deps: bump shell-quote from 1.8.1 to 1.8.4 (#26585)
  • deps: bump @vitejs/plugin-react-swc (#26567)
  • deps: bump the rollup group across 1 directory with 3 updates (#26505)
  • deps: bump nrwl/nx-set-shas from 4 to 5 (#26565)
  • deps: bump anthropics/claude-code-action from 1 to 1.0.123 (#26640)
  • deps: bump trunk-io/analytics-uploader from 1.15.0 to 2.0.9 (#26638)
  • deps: bump rollup from 4.60.1 to 4.60.4 in the rollup group across 1 directory (#26641)
  • deps: bump open from 8.4.0 to 8.4.2 (#26643)
  • deps: bump stream-json and @types/stream-json (#26645)
  • deps: bump koa-helmet from 7.0.2 to 7.1.0 (#26642)
  • deps: bump axios from 1.17.0 to 1.18.0 (#26647)
  • deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
  • deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
  • deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
  • deps-dev: bump @types/webpack-hot-middleware from 2.25.9 to 2.25.12 (#26568)
  • deps-dev: bump @types/invariant from 2.2.36 to 2.2.37 (#26644)
  • repo: skip change freeze ownership check when freeze disabled (#26474)

πŸ’… Enhancement

  • admin: hide deploy-now widget in production (#26660)
  • core/core: rounded thin borders for startup banner (#26273)
  • graphql: use discriminated unions instead of unsafe type casting (#25913)
  • upgrade: unhide and document upgrade to command (#26446)

🚨 Security

❀️ Thank You

  •  
  • ↗️
↗️

v5.48.0

βœ‡Strapi
Door: internal-releases[bot]

5.48.0 (2026-06-10)

πŸš€ New feature

  • add optional openapi spec route (#26239)
  • openapi: gate endpoint access with config (#26574)

πŸ”₯ Bug fix

  • upload returns unsigned URL on update media info (#25195)
  • widgets show error when role has no access to mainfield of ct (#26537)
  • admin: return empty object for empty json body in fetch client (#26277)
  • build: build does not run install; add install-deps arg (#26483)
  • ci: run build:size as full command for compressed-size-action v3 (#26556)
  • ci: restore allowed paths-filter pin (#26575)
  • content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
  • content-manager: raise z-index of code block language selector (#25010, #26324)
  • core: validate numeric inputs before DB unique checks (#26101)
  • database: restore join-table relation sort order in components (#26553)
  • database: avoid double finalising completed transactions (#26122)
  • upload: folder navigation bugs in Media Library (#26515)
  • upload: preserve animation frames in GIF and WebP images (#26126)
  • utils: ignore empty sort when building orderBy (#26427)

πŸ“š Documentation Changes

  • openapi: add contributor documentation (#26410)

βš™οΈ Chore

  • remove experimental-dev example app (#26552)
  • update .gitignore for AI tooling directories (#26526)
  • deps: bump axios from 1.16.1 to 1.17.0 (#26539)
  • deps: bump the testing-library group across 1 directory with 2 updates (#26506)
  • deps: bump actions/setup-node from 4 to 6 (#26496)
  • deps: bump actions/stale from 10 to 10.2.0 (#26497)
  • deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
  • deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
  • deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
  • deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
  • deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
  • deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
  • deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
  • deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
  • repo: skip change freeze ownership check when freeze disabled (#26474)

πŸ’… Enhancement

  • core/core: rounded thin borders for startup banner (#26273)
  • graphql: use discriminated unions instead of unsafe type casting (#25913)
  • upgrade: unhide and document upgrade to command (#26446)

🚨 Security

❀️ Thank You

  •  
  • ↗️
↗️

v4.26.2

βœ‡Strapi
Door: Bassel17

⚠️ Note: This is the final Strapi 4 release ⚠️

No further updates to Strapi 4 will be published, this release serves as the final version of Strapi 4 which is considered EOL (End-Of-Life) as of April 30th, 2026. All Strapi users should migrate to Strapi 5: https://docs.strapi.io/cms/migration/v4-to-v5/introduction-and-faq

Also please note, this does include Strapi Customers as well. Strapi Cloud will still continue to function with Strapi 4 but that may be subject change in the near future without warning.

What's Changed

Security

  • Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization. See GHSA-rjg2-95x7-8qmx / CVE-2026-27886.
  • Upgraded tar to v7 to address security warnings.
  • Applied v4 dependency security and maintenance updates.

Fixes

  • Enforced unique admin email validation when updating the authenticated user profile.

Compatibility

  • Added Node.js 22 support for Strapi v4.

Full Changelog: v4.26.1...v4.26.2

  •  
  • ↗️
↗️

v5.47.1

βœ‡Strapi
Door: internal-releases[bot]

5.47.1 (2026-06-03)

πŸ”₯ Bug fix

  • deleteMany respects filters combined with relation (#25420)
  • improve i18n plugin translations (#22714)
  • resolve ajv ReDoS vulnerability by forcing ajv@8.18.0 (#26141)
  • admin: use ISO 639-1 da for Danish admin locale (#26322)
  • content-manager: documentId(s) shown for relation when entry title set to numeric field (#25622)
  • content-manager: guard repeatable field .map() crash on relation… (#26421)
  • content-manager: fix frontend validation if not using "draft and publish" (#25300)
  • core: skip session secret check for API-only apps (#26390)
  • data-transfer: preserve core store when config stage is excluded (#26484)
  • deps: upgrade koa-session to v7.0.2 (#26140)
  • homepage: homepage count-documents slow on large D&P tables (#26370)
  • i18n: preserve non-localized field inheritance (#26367)
  • strapi: preserve tsbuildinfo across develop restarts (#26264)
  • upgrade: simplify registry URL resolution (#25027)

πŸ“š Documentation Changes

  • security: overhaul vulnerability reporting policy (#26393)

βš™οΈ Chore

  • admin: remove punycode dependency (#26189)
  • deps: bump axios from 1.16.0 to 1.16.1 (#26456)
  • deps: bump express-rate-limit from 8.2.1 to 8.5.2 (#26457)
  • deps: bump @hono/node-server from 1.19.9 to 1.19.14 (#26458)
  • deps: bump qs from 6.15.0 to 6.15.2 (#26417)
  • deps: bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4 (#26256)
  • deps: bump hono from 4.11.9 to 4.12.23 (#26455)
  • deps: bump @tootallnate/once from 2.0.0 to 2.0.1 (#26218)
  • docs: migrate docusaurus config to typescript (#26471)
  • mcp: clarify registration lifecycle and simplify error messages (#26517)
  • upload: remove aiMetadataJobsCleanup cron job (#26442)

πŸ’… Enhancement

  • core: lazy-load node-schedule and umzug at boot (#26267)
  • core: eliminate @strapi/typescript-utils from boot path (#26270)
  • core/core: lazy-load typescript-utils in Strapi and compile (#26266)
  • strapi: hash-cache peer-dep check; demote env-vars log to debug (#26269)
  • strapi: lazy-require worker-only deps in dev primary (#26268)

❀️ Thank You

  •  
  • ↗️
↗️

v5.47.0

βœ‡Strapi
Door: internal-releases[bot]

5.47.0 (2026-05-28)

πŸš€ New feature

  • BETA: MCP server (#26371)
  • publicationFilter param in REST and document service (#25793)
  • admin-tokens: remove adminTokens future flag (#26391)
  • admin: add documentation helper link in HeaderLayout (#26422)

πŸ”₯ Bug fix

  • Relation Search in Nested Components (#26023)
  • unable to access content manager page with required and private … (#24101)
  • admin: gate expiresIn deprecation on user auth options (#26298)
  • admin: redirect active tab to login on session expiry (#26165)
  • admin: avoid serving extensionless admin paths as static files (#26368)
  • content-manager: content history crash on deleted relations (#26245)
  • core: preserve createdBy/updatedBy on drafts created by discard-drafts migration (#26461)
  • core/core: codeBlockValidator uses language instead of syntax (#26392)
  • graphql: inherit publicationFilter into populated relations (#26400)

βš™οΈ Chore

  • dedupe yarn.lock file (#26376)
  • fix dependabot cooldown config for github-actions (#26438)
  • ci: improve dependabot security grouping and version update policy (#26408)
  • commitlint: disable body-max-line-length rule (#26406)
  • deps: bump simple-git from 3.32.3 to 3.36.0 (#26220)
  • deps: bump sanitize-html from 2.13.0 to 2.17.4 (#26342)
  • deps: bump ws from 8.17.1 to 8.20.1 in @strapi/data-transfer (#26379)
  • examples: remove sdk-plugin from todo-example plugin (#26341)
  • strapi: upgrade webpack ecosystem dependencies (#26385)

πŸ’… Enhancement

  • db: migration performance improvements (#25988)
  • provider-amazon-ses: replace node-ses with AWS SDK SESClient (#26054)
  • i18n: update and create Slovak translations (#25831)

❀️ Thank You

  •  
  • ↗️
↗️

v5.46.1

βœ‡Strapi
Door: internal-releases[bot]

5.46.1 (2026-05-20)

πŸ”₯ Bug fix

  • FK violation publishing self-relation parent & child in one release (#26147)
  • move session-manager jwt check from register to bootstrap (#25412)
  • admin: remove year 2041 limit on date/datetime pickers (#26209)
  • content-manager: fix getMainField context for component list/edit configure views (#25509, #26124)
  • database: respect nested sort in populate for join-table relations (#26361)
  • graphql: inherit publication state for i18n localizations (#22163)
  • migrations: guard inverseJoinColumn access in discard-drafts migration (#26331)
  • review-workflows: add assignee and review stage to list view filters (#26171)
  • review-workflows: message when single stage (#26229)
  • upgrade: use pnpm install when project prefers pnpm (#26246)
  • upgrade: align scoped @strapi packages in devDependencies (#26248)

βš™οΈ Chore

  • sonarcloud security review (#25949)
  • deps: bump ip-address from 10.1.0 to 10.2.0 (#26222)
  • deps: bump @protobufjs/utf8 from 1.1.0 to 1.1.1 (#26311)
  • deps: bump axios from 1.15.1 to 1.15.2 (#26177)
  • deps: bump fast-xml-builder from 1.1.4 to 1.2.0 (#26253)
  • deps: bump fast-uri from 3.0.1 to 3.1.2 (#26254)
  • eslint: migrate .eslintrc + .eslintignore to .eslintrc.cjs (#26216)

🚨 Security

  • deps: upgrade multiple dependencies (#26326)

❀️ Thank You

  •  
  • ↗️
↗️

v5.46.0

βœ‡Strapi
Door: internal-releases[bot]

5.46.0 (2026-05-13)

πŸš€ New feature

  • close button for the trial banner (3fd5f9fd56)
  • adding collapse button (901465b1e2)
  • updating design after Claude comments (d1cb08f76e)
  • getting that button to stick while the banner doesn't (f04fe97a75)
  • add preview support to images and videos (#25216)
  • content-manager: add possibility to customize blocks (#22063)
  • email: replace sendmail package with nodemailer in provider (#25893)

πŸ”₯ Bug fix

  • making button float better (c5396f1c18)
  • using isValid & adding translations (59498861f7)
  • auto-expand and scroll to newly added dynamic zone components (#26044)
  • keep draft link on x-to-one relations non-dp to dp (#26179)
  • long component names overflow in dynamic zone picker (#26010)
  • remove await from several telemetry calls to prevent blocking (#24743)
  • admin: resolve prism is not defined (#25660)
  • admin: handle 204 no-content response in fetch client (#25416)
  • content-manager: local-storage was not updated if filters were removed (#26240)
  • content-manager: skip draft/modified count queries for non-D&P content types (#26049)
  • core/admin: admin and content api tokens retro-compatibility (#26313)
  • core/core: validation uses injected strapi instance (#26211)
  • database: morph typeField wins over same-name fields in populate (#26120)
  • database: append primary key to ORDER BY for paginated selects (#26032)
  • db: deterministic schema hash by sorting tables before hashing (#26202)
  • graphql: isolate root query args per root field (#26178)
  • test: check button attribute differently (#26212)
  • utils: throw ValidationError for all invalid query params (not just sort) (#25894)

βš™οΈ Chore

  • adding translations for the banner (e696d94627)
  • turkish translations for cloud (#26223)
  • .github: bump CI runners to node 24 (#26231)
  • ai: ignore .agents/local-skills and .agents/local-state for local only harness (#26276)
  • deps: bump eslint-plugin-react (#26227)
  • deps: migrate msw 1.x β†’ 2.13.4 across admin test suites (#26065)
  • deps: upgrade typedoc to 0.28.19 and related plugins (#26082)
  • security: mark Strapi v4 as End of Life (#26162)
  • upload: add concurrentUploadSize config (#26053)

❀️ Thank You

  •  
  • ↗️
↗️

v5.45.0

βœ‡Strapi
Door: internal-releases[bot]

5.45.0 (2026-05-06)

πŸš€ New feature

  • extended ctb api for plugins (ad7cb5d5d7)
  • sort based on publish status (#25689)
  • admin: api token supports admin permissions and admin user ownership (#25657)
  • content-manager: add Zod 4 foundation utilities (#25574)

πŸ”₯ Bug fix

  • issue with plugin content type uid (f768670d38)
  • style issues (2f42e5fe44)
  • opt out of the ct backup strategy for plugin content types (5936814932)
  • build errors (520ecfc6d5)
  • enforce minimum length (f2b6c2bcd0)
  • prevent trailing ? in URL when params is empty object (#25724, #25900)
  • dynamically update rate limit prefix key based on route (#24818)
  • admin: clean up lazy component registration warnings (#25015)
  • admin: type addMenuLink with optional Component for menu-only links (#26198)
  • content-manager: prevent crash on detached DZ component (#26148)
  • content-type-builder: preserve plugin CT identity in AI chat transform (0be48848fa)
  • database: run cleanOrderColumns updates sequentially (#26134)
  • database: run cleanOrderColumns updates sequentially (#26134)
  • review-workflows: implement incremental loading in assignee dropdown (#25967)
  • upload: sharp concurrency and cache leads to OOM (#26046)

❀️ Thank You

  •  
  • ↗️
↗️

v5.44.0

βœ‡Strapi
Door: internal-releases[bot]

5.44.0 (2026-04-29)

πŸš€ New feature

  • deploy to cloud homepage widget (#25774)

πŸ”₯ Bug fix

  • add responseType to getFetchClient for non-JSON responses (#25974)
  • prevent browser defaults for Ctrl+I and other modifier shortcuts in Firefox (#26050)
  • contain absolute descendants in OverflowingItem (#26133)
  • content-manager: prevent duplicate React key in homepage recent-documents widget (#26084)
  • content-manager: optimize document layout hooks (#26005)
  • database: make 5.0.0-02-created-document-id migration idempotent (#26045)
  • document-service: support delete selection params (#25097)
  • document-service: preserve self-referential relations during publish and discard (#25890)
  • document-service: discard-draft 500 on self-referential manyToMany relations (#26152)
  • i18n: preserve non-localized media when creating a locale (#26031)
  • openapi: documentation plugin generates OpenAPI with incorrect ID parameter (#26067)
  • review-workflows: pass locale params to useDocument in StageSelect and AssigneeSelect (#26104)
  • types: align Service.Generic index signature with Controller.Generic (#25475)

πŸ“š Documentation Changes

  • add AGENTS.md universal agent guide (#26018)

βš™οΈ Chore

  • release v5.43.0 update develop (#26100)
  • upgrade contributor docs dependencies (#26073)
  • deps: bump multiple dependencies (#26103)
  • deps: bump @xmldom/xmldom from 0.8.12 to 0.8.13 (#26098)
  • deps: bump and dedupe pinned subdeps (#26139)
  • examples: migration performance benchmark harness + mariadb/sqlite + anti-pattern schemas (#26036)
  • scripts/release: fix experimental peer dependencies install (#26083)

πŸ’… Enhancement

  • add ESM syntax support for Vite .mts config file (#25238)
  • i18n: improve Russian translations of tours section in admin package (#25221)
  • translations: update czech translations (#25824)

❀️ Thank You

  •  
  • ↗️
↗️

v5.43.0

βœ‡Strapi
Door: internal-releases[bot]

5.43.0 (2026-04-22)

πŸš€ New feature

  • core/*: introduce strapi.ai namespace (#25886)
  • i18n: complete Dutch (nl) translations for admin panel (#25932)

πŸ”₯ Bug fix

  • date picker sends date-only format to avoid deprecation warning (1508d5d8f3)
  • bulk publish validation on required components in dz (#25687)
  • use admin basename for 401 redirect path (#25458)
  • auth providers generate unique username on conflict (#23853)
  • webpack public path was missing a slash at the end (#22654)
  • handle potential null userPermissions in Protect component (#24444)
  • admin: add cursor pointer and fix click behavior on sortable table headers (#25418)
  • admin: eliminate several browser race conditions (#26020)
  • content-manager: blocks editor errors when image has formats: null (#26015)
  • content-manager: use RBAC-aware populate in countDraftRelations (#25977)
  • content-manager: don't allow locale to overwrite list view settings (#25437)
  • content-manager: render ID column without number grouping (#25996)
  • content-manager: apply i18n translations to dynamic zone component names (#25417)
  • data-transfer: fix large transfer crashes; show transfer progress (#23479)
  • upload: content-api does not return signed urls (#26034)
  • upload-aws-s3: support root-level credentials and update AWS SDK (#25914)

βš™οΈ Chore

  • update main README content (#25618)
  • data-transfer: isIgnoredContentType helper for filtering (#26004)
  • deps: bump undici from 6.24.1 to 6.25.0 (#26022)
  • deps: bump follow-redirects from 1.15.11 to 1.16.0 (#26025)

πŸ’… Enhancement

  • strapi dev continue watching on build error (#25514)
  • add list & delete admin user cli commands (#23022)
  • data-transfer: improve progress UX (#25921)

🚨 Security

  • upgrade to axios 1.15.1 (#26072)

❀️ Thank You

  •  
  • ↗️
↗️

v5.42.1

βœ‡Strapi
Door: internal-releases[bot]

5.42.1 (2026-04-15)

πŸ”₯ Bug fix

  • typo in Russian translation for upload button (#25946)
  • fixed 9 typos, spelling errors, and duplicate words. (#25936)
  • skip form onChange when markdown updates come from setValue (#25955)
  • adjust typo in test (#25960)
  • update snapshot (9b2501ceeb)
  • increase test timeout (f50134dbae)
  • preserve relations in fill from another locale (#25703)
  • enable save button when re-ordering components or dynamic zones (#25959)
  • made changes to resolve Firefox timepicker issue (#25129, #25438)
  • admin: batch content manager permission checks and reuse session ability (#25911)
  • core: add firstPublishedAt field to draft (#25947)
  • document-service: preserve relations during publish (#25909)
  • tests: type errors cause build to fail which cause tests to fail (072ad0d801)
  • upload: cache busting for cross-origin images in crop (#25950)
  • upload-aws-s3: trust S3 response Location URL for compatible providers (#25939)

βš™οΈ Chore

  • fix typos in comments and docs (12dfbe97c9)
  • adding finnish translation to Strapi Admin (#25620)
  • fix typos in comments and docs (91407798c4)
  • update Polish language translations (#23762)
  • deps: bump lodash from 4.17.23 to 4.18.1 (#25919)
  • deps: bump lodash-es from 4.17.23 to 4.18.1 (#25906)
  • deps: bump nodemailer from 8.0.4 to 8.0.5 (#25963)
  • deps: bump axios from 1.13.5 to 1.15.0 (#25980)
  • deps: bump path-to-regexp from 8.4.1 to 8.4.2 (#25901)
  • examples: delete config.server.url to restore port override capability (#26011)

❀️ Thank You

  •  
  • ↗️
↗️

v5.42.0

βœ‡Strapi
Door: internal-releases[bot]

5.42.0 (2026-04-08)

πŸš€ New feature

  • removing A/B testing from the prompt Currently A/B testing opt-in isn't used, so removing it from the CLI (8d5b04ece4)
  • changing sonar variable (0d822ade04)
  • data-transfer: add directory export/import format (#25867)

πŸ”₯ Bug fix

  • change return to continue in deleteRelations when using foreign keys (#25857)
  • hide legacy options (da9cdfc640)
  • contains filter no longer returns empty data (#25810)
  • typos in documentation plugin README (4ff54bff36)
  • admin: p is not function error (#25663)
  • content-manager: pass component schemas when rebuilding list view headers (#25872)
  • content-manager: wrap single type displayName with formatMessage (#25880)
  • core: relation handling preserves order during unpublish/republish cycles (#25764)
  • create-strapi-app: generate .yarnrc.yml for Yarn projects (#25869)
  • documentation: use dist extensions path in production (#25863)

πŸ“š Documentation Changes

  • fix typos in documentation plugin README (8e11e41247)

βš™οΈ Chore

  • add .claude directory to gitignore (e85aa81cdf)
  • sonarqube variables like in their docs (40f9ecd6c7)
  • deps: bump minimatch from 10.2.4 to 10.2.5 (#25879)
  • deps: bump @xmldom/xmldom from 0.8.6 to 0.8.12 (#25877)
  • deps: bump path-to-regexp from 8.2.0 to 8.4.0 (#25850)
  • deps: bump undici from 6.24.0 to 6.24.1 (#25785)
  • deps: bump handlebars from 4.7.7 to 4.7.9 (#25841)
  • deps: bump yauzl from 3.2.0 to 3.2.1 (#25729)
  • deps: bump bn.js from 4.12.0 to 4.12.3 (#25691)
  • deps: bump js-yaml from 3.14.1 to 3.14.2 (#25680)
  • deps: bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#25681)
  • deps: bump path-to-regexp from 8.4.0 to 8.4.1 (#25888)
  • deps: bump simple-git from 3.21.0 to 3.32.3 (#25704)
  • deps: bump file-type from 21.0.0 to 21.3.2 (#25728)
  • deps: bump @octokit/plugin-paginate-rest from 9.2.1 to 9.2.2 (#25693)
  • deps: bump @octokit/request from 8.4.0 to 8.4.1 (#25694)
  • deps: bump picomatch from 2.3.1 to 2.3.2 (#25828)
  • deps: bump nodemailer from 8.0.1 to 8.0.4 (#25848)

❀️ Thank You

  •  
  • ↗️
↗️

v5.41.0

βœ‡Strapi
Door: internal-releases[bot]

5.41.0 (2026-04-01)

πŸ”₯ Bug fix

  • use strapi.fetch for remote uploads (#25661)
  • Content types with attributes named filters, sort, fields, or populate no longer cause 400 validation errors on populate queries and countDraftRelations (#21338, #25762)
  • check devDependencies when resolving required admin deps (#22130)
  • use max batch sizes per dialect (#25390)
  • content-type-builder: default draftAndPublish to true in AI CTB (#25781)
  • document-service: re-insert cascade-deleted bidirectional relations (#25725)
  • graphql: expose status and hasPublishedVersion on non–D&P root queries for nested relations (#25763)
  • homepage: render widgets progressively and batch permission checks (#25846)
  • upload: allow removal of file type filter in media library (#25399)
  • upload: row duplicate-key warning (#25670)
  • upload: allow upload of files with empty MIME type (#25844)

βš™οΈ Chore

  • deps: bump undici from 6.23.0 to 6.24.0 (#25731)
  • deps: bump effect from 3.19.19 to 3.21.0 (#25796)
  • scripts/check-package-versions: support Yarn catalog (#25625)

πŸ’… Enhancement

  • add customField parameter to extendFields (#22521)
  • content-manager: add documentid in listview and editview (#25759)

🚨 Security

  • package upgrades to remove deprecated versions of boolean, tar, and glob (#25776)

❀️ Thank You

  •  
  • ↗️
↗️

v5.40.0

βœ‡Strapi
Door: internal-releases[bot]

5.40.0 (2026-03-18)

πŸš€ New feature

  • add package manager dropdown before version in bug report template (#25679)

πŸ”₯ Bug fix

  • add maxwidth to documentactions menu (#25664)
  • formatErrorMessages array values formatting (#24196)
  • admin: alias singleton frontend deps in vite (#25682)
  • content-manager: reduce excessive rerendering in components and dynamic zones (#25631)
  • content-manager: skip non-draftAndPublish relations in countDraftRelations (#25453)
  • i18n: show locale key in disabled select when editing locale (#25124)

πŸ“š Documentation Changes

  • fix docs links in README (#25715)

βš™οΈ Chore

  • use https instead of git url in package.repository.url (#25698)
  • content-manager: optimize relations handling in EditView component (#25683)
  • core: parallelize and cache dynamic zone populate (#25685)

πŸ’… Enhancement

  • resolved filter editability on clicking filter tag (#24057)
  • core: remove beta on Document API, enforce deprecation on EntityService API (#25744)

❀️ Thank You

  •  
  • ↗️
↗️

v5.38.1

βœ‡Strapi
Door: internal-releases[bot]

5.38.1 (2026-03-11)

Superseded on March 11, 2026 by v5.39.0 due to versioning mistake.
Please use v5.39.0.

  •  
  • ↗️
↗️

v5.39.0

βœ‡Strapi
Door: internal-releases[bot]

5.39.0 (2026-03-11)

πŸš€ New feature

  • expand accordion by default when inserting a new component in a document (#24230)
  • content-manager: filter list view by publication status (#25510)

πŸ”₯ Bug fix

  • added shift+tab to blocks editors (#24122)
  • single type publish permission error (#24754)
  • es translations (#25655)
  • typo 'compatability' to 'compatibility' in error messages (#25535)
  • content-manager: export ContentManagerPlugin type for plugin dev… (#24149)
  • content-manager: reduce excessive rerendering in relation fields (#25623)
  • content-manager: reduce rerenders for conditional fields (#25617)
  • content-releases: publish in right order to preserve relations (#25551)
  • guided-tour: no overlay in dark mode (#25485)
  • openapi: correctly merge plugin router prefix with route paths (#25616)
  • types: fix document findOne params (#25613)
  • upload: add crossOrigin attribute to image preview (#24946)

βš™οΈ Chore

  • upgrade to glob 13 (#25610)
  • upgrade better-sqlite3 to 12.6.2 (#25611)
  • remove eslint-plugin-rxjs (#25612)
  • upgrade koa to 20.8.4 and minimatch to 10.2.4 (#25624)
  • eslintignore coverage (#25649)
  • stop adding issues to GitHub projects in issues_handleLabel workflow (#25677)
  • update package metadata (#25599)
  • *: register vitest dependency in Yarn catalog (#25400)
  • core/permissions: ensure engine properly merges conditions (#25569)
  • deps: bump js-yaml from 3.14.1 to 3.14.2 (#24858)
  • deps: bump qs from 6.14.2 to 6.15.0 (#25555)
  • deps: bump jws from 3.2.2 to 3.2.3 (#24981)
  • deps: bump elliptic from 6.5.7 to 6.6.1 (#24803)
  • deps: bump serialize-javascript from 6.0.1 to 6.0.2 (#24841)
  • deps: bump mdast-util-to-hast from 13.2.0 to 13.2.1 (#24950)
  • deps: bump jws from 3.2.2 to 3.2.3 (#25652)
  • deps: bump tar from 7.5.9 to 7.5.10 (#25642)
  • deps: bump serialize-javascript from 6.0.1 to 6.0.2 (#25653)

🚨 Security

  • upload: improve mimetype detection for uploads (#25177)

❀️ Thank You

  •  
  • ↗️
↗️

v5.38.0

βœ‡Strapi
Door: internal-releases[bot]

5.38.0 (2026-03-04)

πŸš€ New feature

  • content-manager: add relationOpenMode setting (modal/page/newTab) (#25433)
  • email-nodemailer: upgrade to Nodemailer v8 with advanced email features and Admin UI capabilities (#25392)
  • i18n: add missing french translations (#23093)

πŸ”₯ Bug fix

  • typo 'recieved' to 'received' across codebase (#25541)
  • markdown editor number list is created with wrong numbers (#24631)
  • add i18n for boolean cell values (#22314)
  • folder subtitles for folders without assets or subfolders (#22694)
  • vite and webpack config when linking ds locally (#25530)
  • types: add missing typing for proxy.koa config (#25575)

βš™οΈ Chore

  • bump design-system to v2.2.0 (#25584)
  • deps: bump rollup from 4.27.4 to 4.59.0 (#25566)
  • upload: add import from url (#25496)

❀️ Thank You

  •  
  • ↗️
↗️

v5.37.1

βœ‡Strapi
Door: internal-releases[bot]

5.37.1 (2026-02-26)

πŸ”₯ Bug fix

  • core: preserve component clone integrity in discard-drafts migration

❀️ Thank You

  •  
  • ↗️
❌