# Strapi: what changed from 4 to 5

- Product: Strapi (https://whatsnew.fyi/product/strapi)
- Vendor: Strapi
- Range: changelog entries numbered after v4.26.2 up to and including v5.52.3, stable releases only
- Entries below: 13 releases (newest first)
- Resolved: 4 is v4.26.2 and 5 is v5.52.3, the newest stable release of each major we track
- Carrying security changes: 4 · CVEs mentioned: 1 · Mentioning breaking changes: 0 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/strapi/compare/4...5

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (218 changes, grouped by kind)

### Added

#### v5.52.2 (2026-08-26)

- New opt-in beta Media Library UI available behind feature flag `future.betaMediaLibrary: true`

#### v5.52.0 (2026-08-12)

- Record MCP actions in audit logs
- Add locale codes for Corsican in i18n
- Enhance Koa app configuration with proxy settings

#### v5.51.2 (2026-08-05)

- Add optional component screenshots to DZ picker in content-manager

#### v5.51.0 (2026-07-23)

- Add exclude/only content type CLI filters to data-transfer
- Add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) to i18n

#### v5.50.2 (2026-07-15)

- Make admin auth cookie name configurable via admin.auth.cookie.name config
- Complete Korean (ko) translation for i18n

#### v5.50.1 (2026-07-08)

- Complete Japanese (ja) translations
- Update Polish translation

#### v5.50.0 (2026-07-02)

- Add active devices session management in admin
- Add security defaults to create-strapi-app templates
- Export lifecycle event type from database
- Add region option for EU data residency in SendGrid email provider
- Accept a credential provider function in AWS S3 upload provider
- Add comprehensive Japanese translation update for admin and 9 plugins
- Augment all context error response methods with TypeScript support

#### v5.49.0 (2026-06-24)

- Export defineTool/defineResource/definePrompt builders for MCP
- Add optional replace method to upload providers

#### v5.48.1 (2026-06-17)

- Add optional OpenAPI spec route (also in v5.48.0)
- Gate OpenAPI endpoint access with config (also in v5.48.0)
- Add paginated GET /api/upload/files/page endpoint
- Link to the Billing Portal
- Point Upsell Banner to Strapi Billing

### Changed

#### v5.52.0 (2026-08-12)

- Replace umzug with internal migration runner in database
- Memoize private attributes in sanitizeOutput
- Stop using a thrown Error to test for boolean-like populate keys
- Memoize scope decisions and keep the relation visitor sync

#### v5.51.2 (2026-08-05)

- Use radio roles for accessibility and improve aria attributes
- Support required on relation attributes in content-type-builder
- Look models up on the registries in getModel in core
- Reduce per-column work when mapping rows to entities in database

#### v5.51.1 (2026-07-29)

- Empty multiple media and morphMany relations now return [] instead of null

#### v5.50.1 (2026-07-08)

- Emit namespace keyword instead of deprecated module

#### v5.48.1 (2026-06-17)

- Update billing portal address

#### v5.48.0 (2026-06-10)

- Use ReadonlyArray for layout prop in content-manager
- Use discriminated unions instead of unsafe type casting in GraphQL
- Unhide and document upgrade to command
- Apply rounded thin borders for startup banner

### Fixed

#### v5.52.3 (2026-09-02)

- Preserve special characters in filter and search values in admin
- Fix relation picker losing locale in nested entries in content-manager
- Fix relation fields displaying document ids when main fields are empty
- Remove unused runtime import of @strapi/types in content-type-builder
- Guard release-action service call when cms-content-releases is disabled in review-workflows
- Sniff file bytes in admin when browser MIME is generic in upload
- Show each asset as soon as its upload completes in upload
- Apply various fixes and adjustments to new media library in upload
- Repair typecheck on develop after merge collision in upload
- Disable the folder tree chevron when a folder has no children in upload
- Keep the asset name when replacing its file in upload
- Use path.posix.normalize for route matching and path sanitization in users-permissions and core

#### v5.52.2 (2026-08-26)

- Make drag and drop more fluent in configuration view
- Fix out of sort memory when listing audit logs on MySQL
- Send credentials on fetch client requests in admin
- Keep API token permissions on localized content types at boot
- Honour redirectTo when the auth page redirects an authenticated user
- Fix slow startup with many roles due to redundant permission checks
- Fix draft status filter with i18n sibling locale published
- Reject MCP relation writes combining set with connect or disconnect
- Fix out of sort memory when listing history versions on MySQL
- Fix access token rotation failure with asymmetric JWT algorithms
- Serialize JSON columns before INSERT in discard-drafts migration
- Fix local plugins duplicating the admin module graph and exhausting build memory
- Fix relation reorder saving the wrong position
- Correct broken placeholders in pt-BR translations
- Surface clear error for unsupported RBAC condition operators
- Fix admin build failing to resolve @strapi/admin under isolated node_modules
- Translate server error codes in the new media library
- Enforce sizeLimit when replacing a file

#### v5.52.1 (2026-08-19)

- Unrelated permission conditions no longer block page access in admin
- Deduplicate MCP tool names when an API has multiple content types in content-manager
- Refrain from counting error draft relations in content-manager
- Show tooltip on truncated names in the media library upload
- Fix inability to clear refresh token cookie on logout due to mismatched options in users-permissions

#### v5.52.0 (2026-08-12)

- Fix typescript pipeline issue
- Dedupe react-dnd in the admin bundle
- Address filter entries by position so duplicate filter chips behave correctly
- Merge query populate paths to preserve nested populate
- Prevent editing relations from removing inverse field conditions
- Clear stale validation errors when the form data is replaced
- Skip orphaned links and isolate FK failures on restore in data-transfer
- Skip unregistered RBAC conditions during ability generation in permissions
- Allowlist Vite optimizeDeps.exclude for plugin UI kits
- Refresh folder header count on upload and delete in upload
- Guard cache-buster on signed URLs in new-ML AssetCropEditor
- Target current asset in drawer actions in upload
- Keep infinite scroll loading when the sentinel stays visible in upload

#### v5.51.2 (2026-08-05)

- Handle i18n conflict and local rights
- Interpolate min/max values in validation error messages in admin
- Pin react-colorful to prevent optimizeDeps include/exclude conflict in admin
- Prevent relation creation from discarding parent changes in content-manager
- Prevent relation order changes after saving dynamic-zone components in content-manager
- Keep document status accurate on mixed-locale batches in content-manager
- Use configured default pageSize when only page is provided in core
- Escape LIKE wildcards in filters and use equality for $eqi/$nei in database
- Use fractional __temp_key__ when filling from locale in i18n
- Stream URL imports to disk instead of buffering in memory in upload
- Keep cursor position while editing asset details fields in upload
- Apply asset permissions to media library actions in upload
- Keep crop drag tracking on touch devices in upload
- Keep asset drawer header visible on mobile in upload
- Apply media library MVP fixes in upload

#### v5.51.1 (2026-07-29)

- Respect field length constraints in AI localizations and isolate
- Fix wording and merging sort options
- Preserve sorting on view change
- Scope audit logs user filter to log authors in admin
- Fix homepage recent-documents dates serialize as empty objects in content-manager
- Enforce required media and relations via api.documents.strictRelations in core
- Return [] for empty morphMany on read in database
- Prevent duplicate public assets in Vite builds

#### v5.51.0 (2026-07-23)

- Preserve order when reordering a relation to the start of a list
- Use singleton modules for consistent runtime instances
- Make admin session token respect configured admin-cookie-path
- Make plugin/setting Select all work in admin token permissions
- Revalidate SPA shell to avoid stale chunk imports
- Expire admin reset-password tokens
- Improve SSO session metadata and logout revocation
- Fix blank admin in develop from prism language prebundle
- Fix SSO remote logout infinite redirect caused by cookie path
- Pre-bundle prism language plugins for all apps in content-manager
- Respect disconnected draft relations in publish warning
- Validate items passed to plugin action APIs
- Skip blocks editor remount on equal value echoes
- Keep preview button mounted during document churn
- Normalise release id so rescheduling cancels the stale job in content-releases
- Enforce default maxLength 255 for string fields
- Preserve draft relation order in discard-drafts migration
- Propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag

#### v5.50.2 (2026-07-15)

- Prevent deprecated CJS Vite Node API warning on startup
- Fix pre-commit failing when staging files ignored by ESLint
- Show plan label instead of edition in dashboard
- Restore runtime default for context helper
- Clear stale Blocks editor selection on external value change
- Reject 'status' attribute when draftAndPublish is enabled for backward compatibility
- Validate license registry responses with zod
- Preserve duplicate form relation edits when cloning
- Include status sort expression in SELECT when using DISTINCT
- Only warn about sendmail provider in development
- Add bearerAuth and bracket pagination query params to OpenAPI
- Auto-exclude pre-built plugin UI libs from Vite optimizeDeps
- Fix develop blank admin from optimizeDeps auto-exclude
- Prompt to pin ranged @strapi/* dependencies before upgrading
- Load remote asset thumbnails with crossOrigin to prevent CORS preview failures

#### v5.50.1 (2026-07-08)

- Give the ability to open a list item in a new tab
- Translate enumeration option labels in the content manager
- Seat limit billing links
- Hide deploy menu in production using currentEnvironment
- Allow reading hidden content types for relation targets
- Preserve i18n locale on navigation and guard component schema race condition
- Preserve self-referential relation order on child publish
- Preserve published self-referential relation state
- Prevent crash when reordering and removing a relation in the same save
- Allow array populate parameter
- Enable strict TypeScript in dev sandboxes
- Detect plugin language from output path
- Add server eslint config and declare server deps
- Resolve admin Vite aliases from @strapi/admin closure
- Accept single-file arrays on replacement
- Align polymorphic populate validation with conversion
- Return 400 instead of 500 for invalid sort order/params

#### v5.50.0 (2026-07-02)

- Fix refresh token cookies missing Max-Age when sessions.cookie.maxAge is set
- Add test database healthchecks
- Generate APIs in named directories
- Retry lazy chunk loads and improve loading and error UX in admin
- Open upgrade admin panel link in new tab
- Hide boolean clear action when field is disabled in admin
- Restore default locale in permissions when adding i18n to content type
- Stop storing IP addresses in session metadata in admin
- Validate populate for polymorphic structures in content API
- Warn before publishing with draft relations in content manager
- Serve live preview script from server endpoint in content manager
- Prevent dynamic zone crash when value is null in content manager
- Preserve M2M relation order on published version after reorganization

#### v5.49.0 (2026-06-24)

- Add support for initiallySelectedAssets
- Fix homepage dashboard duplicates entries for users with multiple roles
- Avoid buffering large uploads for MIME detection
- Throw ValidationError when populate exceeds qs arrayLimit
- Push anchor into view to prevent off-screen tooltips
- Support array of links in StrapiApp.addSettingsLink
- Fix admin users logged out mid-session by access-token expiry timer
- Use top-level Core type import in MCP types
- Save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter
- Reduce MCP relation output to identity-only shape
- Deduplicate MCP tool names when plugin has multiple content types
- Fix MCP misleading lifecycle docs
- Allow pnpm to build better-sqlite3 for SQLite scaffolds
- Transfer admin menu and auth logos with configuration
- Stop full-schema component_type IN on dynamic zone populate
- Preserve published relations from non-dp sources
- Default allowedHosts and pin Vite HMR to main server in dev
- Add explicit return types to recursive functions

#### v5.48.1 (2026-06-17)

- Upload returns unsigned URL on update media info (also in v5.48.0)
- Widgets show error when role has no access to mainfield of content type
- Correct IME Enter key handling in BlocksInput
- Return empty object for empty json body in fetch client (also in v5.48.0)
- Exclude disabled plugins from admin build
- Rate limit and serialize first admin registration
- Validate current user email updates
- Guard stale admin configuration
- Build does not run install; add install-deps arg (also in v5.48.0)
- Raise z-index of code block language selector (also in v5.48.0)
- Dedupe bulk delete document ids
- Replace sanitize-html with dompurify in Wysiwyg preview
- Validate numeric inputs before DB unique checks (also in v5.48.0)
- Combine multi-role field-level permissions

#### v5.48.0 (2026-06-10)

- Widgets show error when role has no access to main field of content type
- Restore join-table relation sort order in components
- Avoid double finalising completed transactions
- Folder navigation bugs in Media Library
- Preserve animation frames in GIF and WebP images
- Ignore empty sort when building orderBy

### Removed

#### v5.52.3 (2026-09-02)

- Remove unused nodemon dependencies

### Security

#### v5.52.2 (2026-08-26)

- Deny SVG uploads by default in generated project defaults

#### v5.52.0 (2026-08-12)

- Bump @modelcontextprotocol/sdk to 1.30.0
- Bump sharp to 0.35.3 for libvips CVEs in upload

#### v5.50.2 (2026-07-15)

- Bump ws to 8.21.0 to fix CVE-2026-48779

#### v5.48.0 (2026-06-10)

- Patch uuid and qs DoS advisories

## Release notes

### v5.52.3

- Date: 2026-09-02
- Version: v5.52.3
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.52.3
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.52.3

- **fixed** — Preserve special characters in filter and search values in admin
- **fixed** — Fix relation picker losing locale in nested entries in content-manager
- **fixed** — Fix relation fields displaying document ids when main fields are empty
- **fixed** — Remove unused runtime import of @strapi/types in content-type-builder
- **fixed** — Guard release-action service call when cms-content-releases is disabled in review-workflows
- **fixed** — Sniff file bytes in admin when browser MIME is generic in upload
- **fixed** — Show each asset as soon as its upload completes in upload
- **fixed** — Apply various fixes and adjustments to new media library in upload
- **fixed** — Repair typecheck on develop after merge collision in upload
- **fixed** — Disable the folder tree chevron when a folder has no children in upload
- **fixed** — Keep the asset name when replacing its file in upload
- **fixed** — Use path.posix.normalize for route matching and path sanitization in users-permissions and core
- **removed** — Remove unused nodemon dependencies

##### 5.52.3 (2026-09-02)

###### 🔥 Bug fix

- **admin:** preserve special characters in filter and search values ([#27440](https://github.com/strapi/strapi/pull/27440))
- **content-manager:** relation picker loses locale in nested entries ([#27487](https://github.com/strapi/strapi/pull/27487))
- **content-manager:** relation fields display document ids when main fields are empty ([#27488](https://github.com/strapi/strapi/pull/27488))
- **content-type-builder:** remove unused runtime import of @strapi/types ([#27452](https://github.com/strapi/strapi/pull/27452))
- **review-workflows:** guard release-action service call when cms-content-releases is disabled ([#27312](https://github.com/strapi/strapi/pull/27312))
- **upload:** sniff file bytes in admin when browser MIME is generic ([#27363](https://github.com/strapi/strapi/pull/27363))
- **upload:** show each asset as soon as its upload completes ([#27456](https://github.com/strapi/strapi/pull/27456))
- **upload:** various fixes and adjustments of new media library ([#27477](https://github.com/strapi/strapi/pull/27477))
- **upload:** repair the typecheck on develop after two merges collided ([#27497](https://github.com/strapi/strapi/pull/27497))
- **upload:** disable the folder tree chevron when a folder has no children ([#27495](https://github.com/strapi/strapi/pull/27495))
- **upload:** keep the asset name when replacing its file ([#27501](https://github.com/strapi/strapi/pull/27501))
- **users-permissions,core:** use path.posix.normalize for route matching and path sanitization ([#27158](https://github.com/strapi/strapi/pull/27158))

###### ⚙️ Chore

- **strapi:** remove unused nodemon dependencies ([#27479](https://github.com/strapi/strapi/pull/27479))

###### ❤️ Thank You

- Adrien L @Adzouz
- Andrei L @unrevised6419
- Bassel Kanso
- Ben Irvin
- Kushal Rathod @KushalXCoder
- Lovepreet Singh @singhlovepreet9
- Nico André
- Valentin @valfur03

### v5.52.2

- Date: 2026-08-26
- Version: v5.52.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.52.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.52.2

- **added** — New opt-in beta Media Library UI available behind feature flag `future.betaMediaLibrary: true`
- **fixed** — Make drag and drop more fluent in configuration view
- **fixed** — Fix out of sort memory when listing audit logs on MySQL
- **fixed** — Send credentials on fetch client requests in admin
- **fixed** — Keep API token permissions on localized content types at boot
- **fixed** — Honour redirectTo when the auth page redirects an authenticated user
- **fixed** — Fix slow startup with many roles due to redundant permission checks
- **fixed** — Fix draft status filter with i18n sibling locale published
- **fixed** — Reject MCP relation writes combining set with connect or disconnect
- **fixed** — Fix out of sort memory when listing history versions on MySQL
- **fixed** — Fix access token rotation failure with asymmetric JWT algorithms
- **fixed** — Serialize JSON columns before INSERT in discard-drafts migration
- **fixed** — Fix local plugins duplicating the admin module graph and exhausting build memory
- **fixed** — Fix relation reorder saving the wrong position
- **fixed** — Correct broken placeholders in pt-BR translations
- **fixed** — Surface clear error for unsupported RBAC condition operators
- **fixed** — Fix admin build failing to resolve @strapi/admin under isolated node_modules
- **fixed** — Translate server error codes in the new media library
- **fixed** — Enforce sizeLimit when replacing a file
- **security** — Deny SVG uploads by default in generated project defaults

##### 5.52.2 (2026-08-26)

###### ✨ New Media Library (opt-in beta)

A complete revamped Media Library UI is available behind a feature flag. Set `future.betaMediaLibrary: true` in `config/features` and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in [docs](https://docs.strapi.io/cms/features/media-library) and the [Notion Page](https://strapi.notion.site/Media-Library-Beta-Release-3c78f3598074810dbad6f2addfa25b6f)

Feedback while it's behind the flag is very welcome. Enjoy!

<img width="1440" height="976" alt="Image details" src="https://github.com/user-attachments/assets/49a67b0d-fde3-4af5-8e87-f27f0fd24c04" />


###### 🔥 Bug fix

- make drag and drop more fluently in configuation view fix#23161 ([#26320](https://github.com/strapi/strapi/pull/26320), [#23161](https://github.com/strapi/strapi/issues/23161))
- **admin:** out of sort memory when listing audit logs on mysql ([#27410](https://github.com/strapi/strapi/pull/27410))
- **admin:** send credentials on fetch client requests ([#27413](https://github.com/strapi/strapi/pull/27413))
- **admin:** keep api token permissions on localized content types at boot ([#27420](https://github.com/strapi/strapi/pull/27420))
- **admin:** honour redirectTo when the auth page redirects an authenticated user ([#27213](https://github.com/strapi/strapi/pull/27213))
- **admin:** slow startup with many roles due to redundant permission … ([#27438](https://github.com/strapi/strapi/pull/27438))
- **content-manager:** draft status filter with i18n sibling locale published ([#26835](https://github.com/strapi/strapi/pull/26835))
- **content-manager:** reject MCP relation writes combining set with connect or disconnect ([#27423](https://github.com/strapi/strapi/pull/27423))
- **content-manager:** out of sort memory when listing history versions on mysql ([#27394](https://github.com/strapi/strapi/pull/27394))
- **core:** Access token rotation fails with asymmetric JWT algorithms ([#27201](https://github.com/strapi/strapi/pull/27201))
- **core:** serialize JSON columns before INSERT in discard-drafts migration ([#25927](https://github.com/strapi/strapi/pull/25927))
- **core/strapi:** local plugins duplicate the admin module graph and exhaust build memory ([#27311](https://github.com/strapi/strapi/pull/27311))
- **database:** relation reorder saves the wrong position ([#27444](https://github.com/strapi/strapi/pull/27444))
- **i18n:** correct broken placeholders in pt-BR translations ([#27257](https://github.com/strapi/strapi/pull/27257), [#27383](https://github.com/strapi/strapi/pull/27383))
- **permissions:** surface clear error for unsupported RBAC condition operators ([#27355](https://github.com/strapi/strapi/pull/27355))
- **plugins:** admin build fails to resolve @strapi/admin under isolated node_modules ([#27337](https://github.com/strapi/strapi/pull/27337))
- **upload:** translate server error codes in the new media library ([#27345](https://github.com/strapi/strapi/pull/27345))
- **upload:** sizeLimit is not enforced when replacing a file ([#27414](https://github.com/strapi/strapi/pull/27414))
- **upload:** move replace media to the drawer footer, add tooltips ([#27425](https://github.com/strapi/strapi/pull/27425))
- **upload:** list queued files in the upload progress dialog ([#27416](https://github.com/strapi/strapi/pull/27416))
- **upload:** merge a second drop into the running upload batch ([#27415](https://github.com/strapi/strapi/pull/27415))

###### ⚙️ Chore

- replace lodash forEach with native Object.entries/values ([#27409](https://github.com/strapi/strapi/pull/27409))
- add worktree bootstrap command ([#27426](https://github.com/strapi/strapi/pull/27426))
- **deps:** upgrade memfs to 4.68.1 in @strapi/upgrade ([#27406](https://github.com/strapi/strapi/pull/27406))
- **deps:** migrate first-party zod to 4.4.3 ([#27428](https://github.com/strapi/strapi/pull/27428))

###### 💅 Enhancement

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.52.2]_

### v5.52.1

- Date: 2026-08-19
- Version: v5.52.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.52.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.52.1

- **fixed** — Unrelated permission conditions no longer block page access in admin
- **fixed** — Deduplicate MCP tool names when an API has multiple content types in content-manager
- **fixed** — Refrain from counting error draft relations in content-manager
- **fixed** — Show tooltip on truncated names in the media library upload
- **fixed** — Fix inability to clear refresh token cookie on logout due to mismatched options in users-permissions

##### 5.52.1 (2026-08-19)

###### 🔥 Bug fix

- **admin:** unrelated permission conditions no longer block page access ([3ded36a7b0](https://github.com/strapi/strapi/commit/3ded36a7b0))
- **content-manager:** deduplicate MCP tool names when an api has multiple content types ([#27357](https://github.com/strapi/strapi/pull/27357))
- **content-manager:** refraining from counting error draft relations … ([#26900](https://github.com/strapi/strapi/pull/26900))
- **upload:** show tooltip on truncated names in the media library ([#27340](https://github.com/strapi/strapi/pull/27340))
- **users-permissions:** unable to clear refresh token cookie on logout due to mismatched options ([#25106](https://github.com/strapi/strapi/pull/25106))

###### ⚙️ Chore

- update develop with release 5.52.0 ([#27343](https://github.com/strapi/strapi/pull/27343))
- **deps:** bump fast-uri from 3.1.4 to 3.1.5 ([#27242](https://github.com/strapi/strapi/pull/27242))

###### ❤️ Thank You

- akash-dabhi-qed @akash-dabhi-qed
- Giulio Montagner @giu1io
- kgndnc @kgndnc
- Lazizbek Ergashev @lazerg
- Nico André
- Valentin Furmanek

### v5.52.0

- Date: 2026-08-12
- Version: v5.52.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.52.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.52.0

- **added** — Record MCP actions in audit logs
- **added** — Add locale codes for Corsican in i18n
- **added** — Enhance Koa app configuration with proxy settings
- **fixed** — Fix typescript pipeline issue
- **fixed** — Dedupe react-dnd in the admin bundle
- **fixed** — Address filter entries by position so duplicate filter chips behave correctly
- **fixed** — Merge query populate paths to preserve nested populate
- **fixed** — Prevent editing relations from removing inverse field conditions
- **fixed** — Clear stale validation errors when the form data is replaced
- **fixed** — Skip orphaned links and isolate FK failures on restore in data-transfer
- **fixed** — Skip unregistered RBAC conditions during ability generation in permissions
- **fixed** — Allowlist Vite optimizeDeps.exclude for plugin UI kits
- **fixed** — Refresh folder header count on upload and delete in upload
- **fixed** — Guard cache-buster on signed URLs in new-ML AssetCropEditor
- **fixed** — Target current asset in drawer actions in upload
- **fixed** — Keep infinite scroll loading when the sentinel stays visible in upload
- **changed** — Replace umzug with internal migration runner in database
- **changed** — Memoize private attributes in sanitizeOutput
- **changed** — Stop using a thrown Error to test for boolean-like populate keys
- **changed** — Memoize scope decisions and keep the relation visitor sync
- **security** — Bump @modelcontextprotocol/sdk to 1.30.0
- **security** — Bump sharp to 0.35.3 for libvips CVEs in upload

##### 5.52.0 (2026-08-12)

###### 🚀 New feature

- record MCP actions in audit logs ([#27151](https://github.com/strapi/strapi/pull/27151))
- **i18n:** add locale codes for Corsican ([#27099](https://github.com/strapi/strapi/pull/27099))
- **server:** enhance Koa app configuration with proxy settings ([#26409](https://github.com/strapi/strapi/pull/26409))

###### 🔥 Bug fix

- typescript pipeline issue ([99a723d024](https://github.com/strapi/strapi/commit/99a723d024))
- **admin:** dedupe react-dnd in the admin bundle ([#27217](https://github.com/strapi/strapi/pull/27217))
- **admin:** address filter entries by position so duplicate filter chips behave ([#27188](https://github.com/strapi/strapi/pull/27188))
- **content-manager:** merge query populate paths to preserve nested populate ([#27236](https://github.com/strapi/strapi/pull/27236))
- **content-type-builder:** editing relations removes inverse field conditions ([#27226](https://github.com/strapi/strapi/pull/27226))
- **content-type-builder:** clear stale validation errors when the form data is replaced ([#27222](https://github.com/strapi/strapi/pull/27222))
- **data-transfer:** skip orphaned links and isolate FK failures on restore ([#26852](https://github.com/strapi/strapi/pull/26852))
- **permissions:** skip unregistered RBAC conditions during ability generation ([#27282](https://github.com/strapi/strapi/pull/27282))
- **strapi:** allowlist Vite optimizeDeps.exclude for plugin UI kits ([#27264](https://github.com/strapi/strapi/pull/27264))
- **upload:** refresh folder header count on upload & delete (CMS-1563) ([#27231](https://github.com/strapi/strapi/pull/27231))
- **upload:** guard cache-buster on signed URLs in new-ML AssetCropEditor ([#27228](https://github.com/strapi/strapi/pull/27228))
- **upload:** target current asset in drawer actions ([#27259](https://github.com/strapi/strapi/pull/27259))
- **upload:** keep infinite scroll loading when the sentinel stays visible (CMS-1562) ([#27230](https://github.com/strapi/strapi/pull/27230))

###### ⚙️ Chore

- release v5.51.2 update develop ([101643bcfb](https://github.com/strapi/strapi/commit/101643bcfb))
- bump design system version ([#27292](https://github.com/strapi/strapi/pull/27292))
- **cloud-cli:** migrate unit tests from jest to vitest ([#27218](https://github.com/strapi/strapi/pull/27218))
- **database:** replace umzug with internal migration runner ([#26824](https://github.com/strapi/strapi/pull/26824))
- **deps:** bump ip-address from 10.2.0 to 10.4.0 ([#27238](https://github.com/strapi/strapi/pull/27238))
- **deps:** bump ws from 8.21.1 to 8.21.2 ([#27239](https://github.com/strapi/strapi/pull/27239))
- **deps:** bump hono from 4.12.27 to 4.13.0 ([#27243](https://github.com/strapi/strapi/pull/27243))
- **deps:** bump prettier from 3.3.3 to 3.6.2 ([#27244](https://github.com/strapi/strapi/pull/27244))
- **deps:** bump direct deps and yarn dedupe ([#27291](https://github.com/strapi/strapi/pull/27291))
- **deps:** bump nanoid from 3.3.16 to 3.3.18 ([#27329](https://github.com/strapi/strapi/pull/27329))
- **permissions:** migrate unit tests from jest to vitest ([#27219](https://github.com/strapi/strapi/pull/27219))
- **sentry:** migrate unit tests from jest to vitest ([#27252](https://github.com/strapi/strapi/pull/27252))
- **tooling:** add admin translation verification ([#26960](https://github.com/strapi/strapi/pull/26960))
- **upload-aws-s3:** migrate unit tests from jest to vitest ([#27216](https://github.com/strapi/strapi/pull/27216))

###### 💅 Enhancement

- **utils:** memoize private attributes in sanitizeOutput ([#27140](https://github.com/strapi/strapi/pull/27140))
- **utils:** stop using a thrown Error to test for boolean-like populate keys ([#27234](https://github.com/strapi/strapi/pull/27234))
- **utils:** memoize scope decisions and keep the relation visitor sync ([#27145](https://github.com/strapi/strapi/pull/27145))

###### 🚨 Security

- **deps:** bump @modelcontextprotocol/sdk to 1.30.0 ([#2730

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.52.0]_

### v5.51.2

- Date: 2026-08-05
- Version: v5.51.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.2

- **added** — Add optional component screenshots to DZ picker in content-manager
- **changed** — Use radio roles for accessibility and improve aria attributes
- **fixed** — Handle i18n conflict and local rights
- **fixed** — Interpolate min/max values in validation error messages in admin
- **fixed** — Pin react-colorful to prevent optimizeDeps include/exclude conflict in admin
- **fixed** — Prevent relation creation from discarding parent changes in content-manager
- **fixed** — Prevent relation order changes after saving dynamic-zone components in content-manager
- **fixed** — Keep document status accurate on mixed-locale batches in content-manager
- **fixed** — Use configured default pageSize when only page is provided in core
- **fixed** — Escape LIKE wildcards in filters and use equality for $eqi/$nei in database
- **fixed** — Use fractional __temp_key__ when filling from locale in i18n
- **fixed** — Stream URL imports to disk instead of buffering in memory in upload
- **fixed** — Keep cursor position while editing asset details fields in upload
- **fixed** — Apply asset permissions to media library actions in upload
- **fixed** — Keep crop drag tracking on touch devices in upload
- **fixed** — Keep asset drawer header visible on mobile in upload
- **fixed** — Apply media library MVP fixes in upload
- **changed** — Support required on relation attributes in content-type-builder
- **changed** — Look models up on the registries in getModel in core
- **changed** — Reduce per-column work when mapping rows to entities in database

##### 5.51.2 (2026-08-05)

###### 🚀 New feature

- **content-manager:** add optional component screenshots to DZ picker ([#26863](https://github.com/strapi/strapi/pull/26863))

###### 🔥 Bug fix

- use radio roles for accessibility and improve aria attributes ([#27139](https://github.com/strapi/strapi/pull/27139))
- handle i18n conflict and local rights ([6519f4d5db](https://github.com/strapi/strapi/commit/6519f4d5db))
- **admin:** interpolate min/max values in validation error messages ([#27172](https://github.com/strapi/strapi/pull/27172))
- **admin:** pin react-colorful to prevent optimizeDeps include/exclude conflict ([#27203](https://github.com/strapi/strapi/pull/27203))
- **content-manager:** relation creation discards parent changes ([#27081](https://github.com/strapi/strapi/pull/27081))
- **content-manager:** relation order changes after saving dynamic-zone components ([#27135](https://github.com/strapi/strapi/pull/27135))
- **content-manager:** keep document status accurate on mixed-locale batches ([#27035](https://github.com/strapi/strapi/pull/27035))
- **core:** use configured default pageSize when only page is provided ([#27132](https://github.com/strapi/strapi/pull/27132))
- **database:** escape LIKE wildcards in filters and use equality for $eqi/$nei ([#26476](https://github.com/strapi/strapi/pull/26476))
- **i18n:** use fractional __temp_key__ when filling from locale ([#26296](https://github.com/strapi/strapi/pull/26296))
- **upload:** stream URL imports to disk instead of buffering in memory ([#27176](https://github.com/strapi/strapi/pull/27176))
- **upload:** keep cursor position while editing asset details fields (CMS-1536) ([2c6edbfacb](https://github.com/strapi/strapi/commit/2c6edbfacb))
- **upload:** apply asset permissions to media library actions (CMS-434) ([e8099188e2](https://github.com/strapi/strapi/commit/e8099188e2))
- **upload:** keep crop drag tracking on touch devices (CMS-1538) ([7807ea83dc](https://github.com/strapi/strapi/commit/7807ea83dc))
- **upload:** keep asset drawer header visible on mobile (CMS-1539) ([4edad7ca75](https://github.com/strapi/strapi/commit/4edad7ca75))
- **upload:** media library MVP fixes ([7a4012c65a](https://github.com/strapi/strapi/commit/7a4012c65a))

###### 📚 Documentation Changes

- add contributor documentation for the MCP server ([#27160](https://github.com/strapi/strapi/pull/27160))

###### ⚙️ Chore

- **deps:** bump @hono/node-server from 1.19.14 to 1.19.17 ([#27166](https://github.com/strapi/strapi/pull/27166))
- **deps:** bump postcss from 8.5.14 to 8.5.25 ([#27195](https://github.com/strapi/strapi/pull/27195))
- **deps:** bump brace-expansion from 1.1.16 to 1.1.18 ([#27196](https://github.com/strapi/strapi/pull/27196))
- **deps:** bump js-yaml from 3.15.0 to 3.15.1 ([#27197](https://github.com/strapi/strapi/pull/27197))
- **deps:** bump motion from 12.23.24 to 12.40.0 ([#27133](https://github.com/strapi/strapi/pull/27133))
- **deps:** bump tar from 7.5.21 to 7.5.22 ([#27165](https://github.com/strapi/strapi/pull/27165))
- **deps:** bump react-router-dom from 6.30.3 to 6.30.4 ([#27134](https://github.com/strapi/strapi/pull/27134))
- **deps:** bump undici from 6.27.0 to 6.28.0 ([#27164](https://github.com/strapi/strapi/pull/27164))
- **deps:** bump axios from 1.18.1 to 1.19.0 ([#27198](https://github.com/strapi/strapi/pull/27198))
- **deps:** align app-template react-router-dom with admin 6.30.4 ([#27210](https://github.com/strapi/strapi/pull/27210))
- **jest:** run unit/front tests via nx, drop root jest config and dep ([#26701](https://github.com/strapi/strapi/pull/26701))
- **lint:** add non-blocking oxlint setup ([#26923](https://github.com/strapi/strapi/pull/26923))
- **users-permissions:** move server code into server/src ([#26105](https://github.com/strapi/strapi/pull/26105))

###### 💅 Enhancement

- **content-type-builder:** support required on relation attributes ([#27080](https://github.com/strapi/st

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.51.2]_

### v5.51.1

- Date: 2026-07-29
- Version: v5.51.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.1

- **fixed** — Respect field length constraints in AI localizations and isolate
- **fixed** — Fix wording and merging sort options
- **fixed** — Preserve sorting on view change
- **fixed** — Scope audit logs user filter to log authors in admin
- **fixed** — Fix homepage recent-documents dates serialize as empty objects in content-manager
- **fixed** — Enforce required media and relations via api.documents.strictRelations in core
- **fixed** — Return [] for empty morphMany on read in database
- **fixed** — Prevent duplicate public assets in Vite builds
- **changed** — Empty multiple media and morphMany relations now return [] instead of null

##### 5.51.1 (2026-07-29)

###### 🔥 Bug fix

- respect field length constraints in AI localizations and isolate… ([#26880](https://github.com/strapi/strapi/pull/26880))
- wording and merging sort options ([844c8d625d](https://github.com/strapi/strapi/commit/844c8d625d))
- preserve sorting on view change ([6ed616ab9a](https://github.com/strapi/strapi/commit/6ed616ab9a))
- **admin:** scope audit logs user filter to log authors ([#27047](https://github.com/strapi/strapi/pull/27047))
- **content-manager:** homepage recent-documents dates serialize as empty objects ([#27066](https://github.com/strapi/strapi/pull/27066))
- **core:** enforce required media and relations via api.documents.strictRelations ([#27028](https://github.com/strapi/strapi/pull/27028))
- **database:** return [] for empty morphMany on read ([#27090](https://github.com/strapi/strapi/pull/27090))
- **strapi:** prevent duplicate public assets in Vite builds ([#27089](https://github.com/strapi/strapi/pull/27089))

###### ⚙️ Chore

- **admin:** allow RFC 6265 control-char regex under develop eslint rules ([e8338bb6ba](https://github.com/strapi/strapi/commit/e8338bb6ba))
- **ci:** remove admin bundle-size workflow ([#27070](https://github.com/strapi/strapi/pull/27070))
- **deps:** bump brace-expansion from 1.1.14 to 1.1.16 ([#27071](https://github.com/strapi/strapi/pull/27071))
- **deps:** bump shell-quote from 1.8.4 to 1.10.0 ([#27072](https://github.com/strapi/strapi/pull/27072))
- **deps:** bump body-parser from 1.20.4 to 1.20.6 ([#27094](https://github.com/strapi/strapi/pull/27094))
- **deps:** bump dompurify from 3.4.11 to 3.4.12 ([#27095](https://github.com/strapi/strapi/pull/27095))
- **deps:** bump fast-uri from 3.1.2 to 3.1.4 ([#27098](https://github.com/strapi/strapi/pull/27098))
- **deps:** bump use-context-selector from 1.4.1 to 1.4.4 ([#27061](https://github.com/strapi/strapi/pull/27061))
- **deps:** bump cropperjs from 1.6.1 to 1.6.2 ([#27060](https://github.com/strapi/strapi/pull/27060))
- **deps:** upgrade handlebars, axios, tar, and related transitive deps ([#27091](https://github.com/strapi/strapi/pull/27091))
- **deps:** bump @radix-ui/react-toolbar from 1.0.4 to 1.1.11 ([#27059](https://github.com/strapi/strapi/pull/27059))
- **email-nodemailer:** migrate unit tests from jest to vitest ([#27074](https://github.com/strapi/strapi/pull/27074))
- **email-sendmail:** migrate unit tests from jest to vitest ([#27075](https://github.com/strapi/strapi/pull/27075))
- **upload-local:** migrate unit tests from jest to vitest ([#27073](https://github.com/strapi/strapi/pull/27073))


###### ⚠️ Changes to be aware of

###### Required media and relations: opt-in `strictRelations`

New config `api.documents.strictRelations` enforces required media and relations on publish (drafts can still be empty). On by default for new projects; existing apps are unchanged until you set it. To opt in, set `documents.strictRelations: true` in `config/api`.
([#27028](https://github.com/strapi/strapi/pull/27028))

###### Empty multiple media / morphMany now returns `[]`

Populated empty `morphMany` relations (including `type: 'media', multiple: true`) serialize as `[]` instead of `null`, matching other to-many relations. This is unconditional and not gated by `strictRelations`. If clients, webhooks, or integrations check `field === null` for empty galleries / morphMany, treat `[]` as empty instead (e.g. `!field?.length`).
([#27090](https://github.com/strapi/strapi/pull/27090))

###### ❤️ Thank You

- Adrien L @Adzouz
- Adrien Lepoutre @Adzouz
- akash-dabhi-qed @akash-dabhi-qed
- Ben Irvin
- Giulio Montagner @giu1io
- Gonzalo Andres Garcia @gonbaum
- Mehdi Rezaei @mehdiraized
- Nico André

### v5.51.0

- Date: 2026-07-23
- Version: v5.51.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.0

- **added** — Add exclude/only content type CLI filters to data-transfer
- **added** — Add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) to i18n
- **fixed** — Preserve order when reordering a relation to the start of a list
- **fixed** — Use singleton modules for consistent runtime instances
- **fixed** — Make admin session token respect configured admin-cookie-path
- **fixed** — Make plugin/setting Select all work in admin token permissions
- **fixed** — Revalidate SPA shell to avoid stale chunk imports
- **fixed** — Expire admin reset-password tokens
- **fixed** — Improve SSO session metadata and logout revocation
- **fixed** — Fix blank admin in develop from prism language prebundle
- **fixed** — Fix SSO remote logout infinite redirect caused by cookie path
- **fixed** — Pre-bundle prism language plugins for all apps in content-manager
- **fixed** — Respect disconnected draft relations in publish warning
- **fixed** — Validate items passed to plugin action APIs
- **fixed** — Skip blocks editor remount on equal value echoes
- **fixed** — Keep preview button mounted during document churn
- **fixed** — Normalise release id so rescheduling cancels the stale job in content-releases
- **fixed** — Enforce default maxLength 255 for string fields
- **fixed** — Preserve draft relation order in discard-drafts migration
- **fixed** — Propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag

##### 5.51.0 (2026-07-23)

###### 🚀 New feature

- **data-transfer:** add exclude/only content type CLI filters ([#26915](https://github.com/strapi/strapi/pull/26915))
- **i18n:** add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) ([#26255](https://github.com/strapi/strapi/pull/26255))

###### 🔥 Bug fix

- preserve order when reordering a relation to the start of a list ([#26112](https://github.com/strapi/strapi/pull/26112))
- singleton modules for consistent runtime instances ([#27064](https://github.com/strapi/strapi/pull/27064))
- **admin:** admin session token respects configured admin-cookie-path ([#25478](https://github.com/strapi/strapi/pull/25478), [#26300](https://github.com/strapi/strapi/pull/26300))
- **admin:** make plugin/setting "Select all" work in admin token permissions ([#27027](https://github.com/strapi/strapi/pull/27027))
- **admin:** revalidate SPA shell to avoid stale chunk imports ([#27039](https://github.com/strapi/strapi/pull/27039))
- **admin:** expire admin reset-password tokens ([#27020](https://github.com/strapi/strapi/pull/27020))
- **admin:** improve SSO session metadata and logout revocation ([#26872](https://github.com/strapi/strapi/pull/26872))
- **admin:** blank admin in develop from prism language prebundle ([#27086](https://github.com/strapi/strapi/pull/27086))
- **admin:** SSO remote logout infinite redirect (cookie path) ([#27100](https://github.com/strapi/strapi/pull/27100))
- **content-manager:** pre-bundle prism language plugins for all apps ([#26978](https://github.com/strapi/strapi/pull/26978))
- **content-manager:** respect disconnected draft relations in publish warning ([#26871](https://github.com/strapi/strapi/pull/26871))
- **content-manager:** validate items passed to plugin action APIs ([#27008](https://github.com/strapi/strapi/pull/27008))
- **content-manager:** skip blocks editor remount on equal value echoes ([#27042](https://github.com/strapi/strapi/pull/27042))
- **content-manager:** keep preview button mounted during document churn ([#27043](https://github.com/strapi/strapi/pull/27043))
- **content-releases:** normalise release id so rescheduling cancels the stale job ([#27063](
[#](https://github.com/strapi/strapi/pull/27063))
- **core:** enforce default maxLength 255 for string fields ([#26128](https://github.com/strapi/strapi/pull/26128))
- **core:** preserve draft relation order in discard-drafts migration ([#26851](https://github.com/strapi/strapi/pull/26851))
- **core:** propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag ([#26525](https://github.com/strapi/strapi/pull/26525))
- **create-strapi-app:** npm ci fails on fresh npm scaffold ([#27038](https://github.com/strapi/strapi/pull/27038))
- **create-strapi-app:** missing @strapi/database dependency breaks pnpm builds ([#27083](https://github.com/strapi/strapi/pull/27083))
- **database:** apply MySQL dialect configure to resolved connection functions ([#26646](https://github.com/strapi/strapi/pull/26646))
- **graphql:** include private fields in mutation inputs ([#26489](https://github.com/strapi/strapi/pull/26489))
- **types:** update LoadedPlugin type to understand factories ([#25298](https://github.com/strapi/strapi/pull/25298))
- **upload:** report real upload progress in the media library ([#27045](https://github.com/strapi/strapi/pull/27045))
- **users-permissions:** use correct i18n ids for role notifications ([#27044](https://github.com/strapi/strapi/pull/27044))
- **users-permissions:** fix role notification translations ([#26933](https://github.com/strapi/strapi/pull/26933))

###### ⚙️ Chore

- merge main into develop after 5.50.2 release ([9d93244f7e](https://github.com/strapi/strapi/commit/9d93244f7e))
- **deps:** bump ws from 8.21.0 to 8.21.1 ([#27030](https://github.com/strapi/strapi/pull/27030))
- **deps:** bump tar from 7.5.18 to 7.5.20 ([#27029](https://github.com/strapi/strapi/pull/27029))
- **deps:**

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.51.0]_

### v5.50.2

- Date: 2026-07-15
- Version: v5.50.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.2

- **added** — Make admin auth cookie name configurable via admin.auth.cookie.name config
- **added** — Complete Korean (ko) translation for i18n
- **fixed** — Prevent deprecated CJS Vite Node API warning on startup
- **fixed** — Fix pre-commit failing when staging files ignored by ESLint
- **fixed** — Show plan label instead of edition in dashboard
- **fixed** — Restore runtime default for context helper
- **fixed** — Clear stale Blocks editor selection on external value change
- **fixed** — Reject 'status' attribute when draftAndPublish is enabled for backward compatibility
- **fixed** — Validate license registry responses with zod
- **fixed** — Preserve duplicate form relation edits when cloning
- **security** — Bump ws to 8.21.0 to fix CVE-2026-48779
- **fixed** — Include status sort expression in SELECT when using DISTINCT
- **fixed** — Only warn about sendmail provider in development
- **fixed** — Add bearerAuth and bracket pagination query params to OpenAPI
- **fixed** — Auto-exclude pre-built plugin UI libs from Vite optimizeDeps
- **fixed** — Fix develop blank admin from optimizeDeps auto-exclude
- **fixed** — Prompt to pin ranged @strapi/* dependencies before upgrading
- **fixed** — Load remote asset thumbnails with crossOrigin to prevent CORS preview failures

##### 5.50.2 (2026-07-15)

###### 🚀 New feature

- **admin:** make admin auth cookie name configurable ([#26931](https://github.com/strapi/strapi/pull/26931))
- **i18n:** complete Korean (ko) translation ([#26941](https://github.com/strapi/strapi/pull/26941))

###### 🔥 Bug fix

- **admin:** prevent deprecated CJS Vite Node API warning on startup ([#26947](https://github.com/strapi/strapi/pull/26947))
- **admin:** pre-commit fails when staging files ignored by ESLint ([#26958](https://github.com/strapi/strapi/pull/26958))
- **admin:** show plan label instead of edition in dashboard ([#26891](https://github.com/strapi/strapi/pull/26891))
- **admin:** restore runtime default for context helper ([#26809](https://github.com/strapi/strapi/pull/26809))
- **ci:** reduce false positives in issue template checker ([#26955](https://github.com/strapi/strapi/pull/26955))
- **ci:** use npm install in issue template checker workflow ([#26974](https://github.com/strapi/strapi/pull/26974))
- **content-manager:** clear stale Blocks editor selection on external value change ([#26959](https://github.com/strapi/strapi/pull/26959))
- **core:** backward compat - reject 'status' attribute when draftAndPublish is enabled ([#26890](https://github.com/strapi/strapi/pull/26890))
- **core:** validate license registry responses with zod ([#26935](https://github.com/strapi/strapi/pull/26935))
- **core:** preserve duplicate form relation edits when cloning ([#26961](https://github.com/strapi/strapi/pull/26961))
- **data-transfer:** bump ws to 8.21.0 to fix CVE-2026-48779 ([#26898](https://github.com/strapi/strapi/pull/26898))
- **database:** include status sort expression in SELECT when using DISTINCT ([#26751](https://github.com/strapi/strapi/pull/26751))
- **database:** lint script does not run type check ([#26819](https://github.com/strapi/strapi/pull/26819))
- **email:** only warn about sendmail provider in development ([#26893](https://github.com/strapi/strapi/pull/26893))
- **openapi:** add bearerAuth and bracket pagination query params ([#26948](https://github.com/strapi/strapi/pull/26948))
- **strapi:** auto-exclude pre-built plugin UI libs from Vite optimizeDeps ([#26944](https://github.com/strapi/strapi/pull/26944))
- **strapi:** fix develop blank admin from optimizeDeps auto-exclude ([#27014](https://github.com/strapi/strapi/pull/27014))
- **upgrade:** prompt to pin ranged @strapi/* dependencies before upgrading ([#26929](https://github.com/strapi/strapi/pull/26929))
- **upload:** load remote asset thumbnails with crossOrigin to prevent CORS preview failures ([#26581](https://github.com/strapi/strapi/pull/26581), [#26901](https://github.com/strapi/strapi/pull/26901))
- **utils:** align remaining convert-query-params errors with ValidationError ([#26908](https://github.com/strapi/strapi/pull/26908))

###### ⚙️ Chore

- **ai-tooling:** sync skills when cursor sets up a new worktree ([#26954](https://github.com/strapi/strapi/pull/26954))
- **data-transfer:** clarify --exclude files CLI messaging ([#26914](https://github.com/strapi/strapi/pull/26914))
- **deps:** patch/minor dependency bumps ([#26823](https://github.com/strapi/strapi/pull/26823))
- **deps:** bump @xhmikosr/decompress from 10.2.0 to 10.2.1 ([#26928](https://github.com/strapi/strapi/pull/26928))
- **deps:** bump sharp from 0.33.5 to 0.34.5 ([#26993](https://github.com/strapi/strapi/pull/26993))
- **deps:** bump @internationalized/date from 3.5.4 to 3.12.1 ([#26994](https://github.com/strapi/strapi/pull/26994))
- **deps:** bump design-system and icons to v2.2.3 ([#27002](https://github.com/strapi/strapi/pull/27002))
- **eslint:** enforce zero warnings in package lint scripts ([#26922](https://github.com/strapi/strapi/pull/26922))
- **husky:** run git hooks through yarn exec ([#27006](https://github.com/strapi/strapi/pull/27006))
- **tooling:** remove unused find-up after lint-staged 16 ([#26792](https://github.com/strapi/strapi/pull/26792))
- *

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.2]_

### v5.50.1

- Date: 2026-07-08
- Version: v5.50.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.1

- **added** — Complete Japanese (ja) translations
- **added** — Update Polish translation
- **fixed** — Give the ability to open a list item in a new tab
- **fixed** — Translate enumeration option labels in the content manager
- **fixed** — Seat limit billing links
- **fixed** — Hide deploy menu in production using currentEnvironment
- **fixed** — Allow reading hidden content types for relation targets
- **fixed** — Preserve i18n locale on navigation and guard component schema race condition
- **fixed** — Preserve self-referential relation order on child publish
- **fixed** — Preserve published self-referential relation state
- **fixed** — Prevent crash when reordering and removing a relation in the same save
- **fixed** — Allow array populate parameter
- **fixed** — Enable strict TypeScript in dev sandboxes
- **fixed** — Detect plugin language from output path
- **fixed** — Add server eslint config and declare server deps
- **fixed** — Resolve admin Vite aliases from @strapi/admin closure
- **changed** — Emit namespace keyword instead of deprecated module
- **fixed** — Accept single-file arrays on replacement
- **fixed** — Align polymorphic populate validation with conversion
- **fixed** — Return 400 instead of 500 for invalid sort order/params

##### 5.50.1 (2026-07-08)

###### 🚀 New feature

- **i18n:** complete Japanese (ja) translations ([#26855](https://github.com/strapi/strapi/pull/26855))
- **i18n:** update Polish translation ([#26592](https://github.com/strapi/strapi/pull/26592))

###### 🔥 Bug fix

- give the ability to open a list item in a new tab ([#26853](https://github.com/strapi/strapi/pull/26853))
- **admin:** translate enumeration option labels in the content manager ([#26837](https://github.com/strapi/strapi/pull/26837))
- **admin:** seat limit billing links ([#26728](https://github.com/strapi/strapi/pull/26728))
- **cloud:** hide deploy menu in production using currentEnvironment ([#26733](https://github.com/strapi/strapi/pull/26733))
- **content-manager:** allow reading hidden content types for relation targets ([#26844](https://github.com/strapi/strapi/pull/26844))
- **content-manager:** preserve i18n locale on navigation and guard component schema race condition ([#26167](https://github.com/strapi/strapi/pull/26167))
- **core:** preserve self-referential relation order on child publish ([#26838](https://github.com/strapi/strapi/pull/26838))
- **core:** preserve published self-referential relation state ([#26932](https://github.com/strapi/strapi/pull/26932))
- **database:** prevent crash when reordering and removing a relation in the same save ([#26210](https://github.com/strapi/strapi/pull/26210))
- **documentation:** allow array populate parameter ([#26358](https://github.com/strapi/strapi/pull/26358))
- **examples:** enable strict TypeScript in dev sandboxes ([#26780](https://github.com/strapi/strapi/pull/26780))
- **generators:** detect plugin language from output path ([#26750](https://github.com/strapi/strapi/pull/26750))
- **review-workflows:** add server eslint config and declare server deps ([#26800](https://github.com/strapi/strapi/pull/26800))
- **strapi:** resolve admin Vite aliases from @strapi/admin closure ([#26756](https://github.com/strapi/strapi/pull/26756))
- **typescript-utils:** emit namespace keyword instead of deprecated module ([#26195](https://github.com/strapi/strapi/pull/26195))
- **upload:** accept single-file arrays on replacement ([#26405](https://github.com/strapi/strapi/pull/26405))
- **utils:** align polymorphic populate validation with conversion ([#26848](https://github.com/strapi/strapi/pull/26848))
- **utils:** return 400 instead of 500 for invalid sort order/params ([#26907](https://github.com/strapi/strapi/pull/26907))

###### 📚 Documentation Changes

- Highlight destructive operation in transfer engine ([#25081](https://github.com/strapi/strapi/pull/25081))

###### ⚙️ Chore

- fix lint warnings ([#26818](https://github.com/strapi/strapi/pull/26818))
- **deps:** bump nodemailer from 8.0.9 to 9.0.1 ([#26721](https://github.com/strapi/strapi/pull/26721))
- **deps:** bump qs from 6.15.2 to 6.15.3 ([#26846](https://github.com/strapi/strapi/pull/26846))
- **deps:** bump tar from 7.5.16 to 7.5.17 ([#26847](https://github.com/strapi/strapi/pull/26847))
- **deps:** bump js-yaml from 3.14.2 to 3.15.0 ([#26888](https://github.com/strapi/strapi/pull/26888))
- **deps:** bump tar from 7.5.17 to 7.5.18 ([#26887](https://github.com/strapi/strapi/pull/26887))
- **deps-dev:** bump eslint-plugin-prettier in the eslint group ([#26828](https://github.com/strapi/strapi/pull/26828))
- **deps-dev:** bump @rollup/plugin-swc in the rollup group ([#26906](https://github.com/strapi/strapi/pull/26906))
- **deps-dev:** align @babel/* family to 7.29.7 ([#26911](https://github.com/strapi/strapi/pull/26911))

###### 💅 Enhancement

- **ci:** block community PRs targeting main ([#26854](https://github.com/strapi/strapi/pull/26854))
- **content-manager:** keep sidebar primary actions and search bar fixed… ([#26867](https://github.com/strapi/strapi/pull/26867))

###### ❤️ Thank You

- Adrien L @Adzouz
- Alexandre Noblet @AlexNbl27
- Andrei L @unrevised6419
- Aryan Katiyar @Kelpy2004
- Bassel Kanso
- Ben Irvin
- jasleenkaur-qed42
- Maksim Zhu

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.1]_

### v5.50.0

- Date: 2026-07-02
- Version: v5.50.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.0

- **added** — Add active devices session management in admin
- **added** — Add security defaults to create-strapi-app templates
- **added** — Export lifecycle event type from database
- **added** — Add region option for EU data residency in SendGrid email provider
- **added** — Accept a credential provider function in AWS S3 upload provider
- **added** — Add comprehensive Japanese translation update for admin and 9 plugins
- **added** — Augment all context error response methods with TypeScript support
- **fixed** — Fix refresh token cookies missing Max-Age when sessions.cookie.maxAge is set
- **fixed** — Add test database healthchecks
- **fixed** — Generate APIs in named directories
- **fixed** — Retry lazy chunk loads and improve loading and error UX in admin
- **fixed** — Open upgrade admin panel link in new tab
- **fixed** — Hide boolean clear action when field is disabled in admin
- **fixed** — Restore default locale in permissions when adding i18n to content type
- **fixed** — Stop storing IP addresses in session metadata in admin
- **fixed** — Validate populate for polymorphic structures in content API
- **fixed** — Warn before publishing with draft relations in content manager
- **fixed** — Serve live preview script from server endpoint in content manager
- **fixed** — Prevent dynamic zone crash when value is null in content manager
- **fixed** — Preserve M2M relation order on published version after reorganization

##### 5.50.0 (2026-07-02)

###### 🚀 New feature

- **admin:** add active devices session management ([#26628](https://github.com/strapi/strapi/pull/26628))
- **cli:** add security defaults to create-strapi-app templates ([#26737](https://github.com/strapi/strapi/pull/26737))
- **database:** export lifecycle event type ([#25637](https://github.com/strapi/strapi/pull/25637))
- **provider-email-sendgrid:** add region option for EU data residency ([#25907](https://github.com/strapi/strapi/pull/25907))
- **provider-upload-aws-s3:** accept a credential provider function ([#26796](https://github.com/strapi/strapi/pull/26796))
- **translations:** comprehensive Japanese (ja) translation update for admin and 9 plugins ([#26687](https://github.com/strapi/strapi/pull/26687))
- **ts:** augment all context error response methods ([#25424](https://github.com/strapi/strapi/pull/25424))

###### 🔥 Bug fix

- refresh token cookies missing Max-Age when sessions.cookie.maxAg… ([#26747](https://github.com/strapi/strapi/pull/26747))
- add test database healthchecks ([#26511](https://github.com/strapi/strapi/pull/26511))
- generate apis in named directories ([#26354](https://github.com/strapi/strapi/pull/26354))
- **admin:** retry lazy chunk loads and improve loading and error UX ([#25954](https://github.com/strapi/strapi/pull/25954))
- **admin:** open "Upgrade your admin panel" link in new tab ([#26510](https://github.com/strapi/strapi/pull/26510))
- **admin:** remove @ts-expect-error in useQueryParams hook ([#25006](https://github.com/strapi/strapi/pull/25006))
- **admin:** hide boolean clear action when field is disabled ([#26294](https://github.com/strapi/strapi/pull/26294))
- **admin:** restore default locale in permissions when adding i18n to ct ([#26548](https://github.com/strapi/strapi/pull/26548))
- **admin:** keep static fallback paths url-safe ([#26518](https://github.com/strapi/strapi/pull/26518))
- **admin:** stop storing IP addresses in session metadata ([#26873](https://github.com/strapi/strapi/pull/26873))
- **ci:** use allowlisted thollander action ref in experimental publish workflow ([#26768](https://github.com/strapi/strapi/pull/26768))
- **content-api:** validate populate for polymorphic structures ([#25854](https://github.com/strapi/strapi/pull/25854))
- **content-manager:** warn before publishing with draft relations ([#26736](https://github.com/strapi/strapi/pull/26736))
- **content-manager:** use ListViewTable relation-loaded translation key ([#26798](https://github.com/strapi/strapi/pull/26798))
- **content-manager:** serve live preview script from server endpoint ([#26732](https://github.com/strapi/strapi/pull/26732))
- **content-manager:** capitalize component category names in dynamic zone ([#24426](https://github.com/strapi/strapi/pull/24426), [#26337](https://github.com/strapi/strapi/pull/26337))
- **content-manager:** add Japanese EditView shortcut hint translations ([#26814](https://github.com/strapi/strapi/pull/26814))
- **content-manager:** prevent dynamic zone crash when value is null ([#26816](https://github.com/strapi/strapi/pull/26816))
- **content-manager:** skip publish warning for M2M links to published entries ([#26858](https://github.com/strapi/strapi/pull/26858))
- **content-type-builder:** improve component category validation error message ([#25455](https://github.com/strapi/strapi/pull/25455))
- **core:** preserve M2M relation order on published version after reo… ([#26791](https://github.com/strapi/strapi/pull/26791))
- **core:** maxFileSize error not detected in body middleware ([#25011](https://github.com/strapi/strapi/pull/25011))
- **core:** resolve relations on non-localized entries with stale locale column ([#26805](https://github.com/strapi/strapi/pull/26805))
- **create-strapi-app:** scaffold pnpm 11 allowBuilds for Strapi Cloud ([#26757](https://github.com/strapi/strapi/pull/26757))
- **create-strapi-app:** enable strict TypeScript in app scaffolds ([#26779](https://github.com/strapi/strapi/

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.0]_

### v5.49.0

- Date: 2026-06-24
- Version: v5.49.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.49.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.49.0

- **added** — Export defineTool/defineResource/definePrompt builders for MCP
- **added** — Add optional replace method to upload providers
- **fixed** — Add support for initiallySelectedAssets
- **fixed** — Fix homepage dashboard duplicates entries for users with multiple roles
- **fixed** — Avoid buffering large uploads for MIME detection
- **fixed** — Throw ValidationError when populate exceeds qs arrayLimit
- **fixed** — Push anchor into view to prevent off-screen tooltips
- **fixed** — Support array of links in StrapiApp.addSettingsLink
- **fixed** — Fix admin users logged out mid-session by access-token expiry timer
- **fixed** — Use top-level Core type import in MCP types
- **fixed** — Save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter
- **fixed** — Reduce MCP relation output to identity-only shape
- **fixed** — Deduplicate MCP tool names when plugin has multiple content types
- **fixed** — Fix MCP misleading lifecycle docs
- **fixed** — Allow pnpm to build better-sqlite3 for SQLite scaffolds
- **fixed** — Transfer admin menu and auth logos with configuration
- **fixed** — Stop full-schema component_type IN on dynamic zone populate
- **fixed** — Preserve published relations from non-dp sources
- **fixed** — Default allowedHosts and pin Vite HMR to main server in dev
- **fixed** — Add explicit return types to recursive functions

##### 5.49.0 (2026-06-24)

###### 🚀 New feature

- **mcp:** export defineTool/defineResource/definePrompt builders ([#26603](https://github.com/strapi/strapi/pull/26603))

###### 🔥 Bug fix

- add support for initiallySelectedAssets ([#26679](https://github.com/strapi/strapi/pull/26679))
- homepage dashboard duplicates entries for users with multiple roles ([#25860](https://github.com/strapi/strapi/pull/25860))
- avoid buffering large uploads for MIME detection ([#26678](https://github.com/strapi/strapi/pull/26678))
- throw ValidationError when populate exceeds qs arrayLimit ([#25632](https://github.com/strapi/strapi/pull/25632), [#25916](https://github.com/strapi/strapi/pull/25916))
- push anchor into view to prevent off-screen tooltips ([#26303](https://github.com/strapi/strapi/pull/26303))
- **admin:** support array of links in StrapiApp.addSettingsLink ([#26433](https://github.com/strapi/strapi/pull/26433))
- **admin:** admin users logged out mid-session by access-token expiry timer ([#26680](https://github.com/strapi/strapi/pull/26680))
- **content-manager:** use top-level Core type import in MCP types ([#26681](https://github.com/strapi/strapi/pull/26681))
- **content-manager:** save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter ([#26621](https://github.com/strapi/strapi/pull/26621))
- **content-manager:** reduce MCP relation output to identity-only shape ([#26560](https://github.com/strapi/strapi/pull/26560))
- **content-manager:** deduplicate MCP tool names when plugin has multiple content types ([#26710](https://github.com/strapi/strapi/pull/26710))
- **core/core:** mcp misleading lifecycle docs ([#26698](https://github.com/strapi/strapi/pull/26698))
- **create-strapi-app:** allow pnpm to build better-sqlite3 for SQLite scaffolds ([#26675](https://github.com/strapi/strapi/pull/26675))
- **data-transfer:** transfer admin menu and auth logos with configuration ([#26425](https://github.com/strapi/strapi/pull/26425))
- **database:** stop full-schema component_type IN on dynamic zone populate ([#26734](https://github.com/strapi/strapi/pull/26734))
- **document-service:** preserve published relations from non-dp sources ([#26654](https://github.com/strapi/strapi/pull/26654))
- **strapi:** default allowedHosts and pin Vite HMR to main server in dev ([#26244](https://github.com/strapi/strapi/pull/26244))
- **types:** add explicit return types to recursive functions ([#26704](https://github.com/strapi/strapi/pull/26704))

###### 📚 Documentation Changes

- fix spelling typos in content-manager relations guide ([#26724](https://github.com/strapi/strapi/pull/26724))

###### ⚙️ Chore

- removing coderabbit status ([#26703](https://github.com/strapi/strapi/pull/26703))
- **core:** upgrade package-json to 10.0.1 + rollup interop 'auto' ([#26673](https://github.com/strapi/strapi/pull/26673))
- **deps:** bump markdown-it from 14.1.1 to 14.2.0 in the richtext-editor-security group across 1 directory ([#26688](https://github.com/strapi/strapi/pull/26688))
- **deps:** bump dompurify from 3.4.5 to 3.4.9 ([#26684](https://github.com/strapi/strapi/pull/26684))
- **deps:** bump nodemailer from 8.0.5 to 8.0.9 ([#26689](https://github.com/strapi/strapi/pull/26689))
- **deps:** bump tar from 7.5.11 to 7.5.16 ([#26691](https://github.com/strapi/strapi/pull/26691))
- **deps:** bump form-data from 4.0.4 to 4.0.6 ([#26692](https://github.com/strapi/strapi/pull/26692))
- **deps:** bump anthropics/claude-code-action from 1.0.123 to 1.0.132 ([#26727](https://github.com/strapi/strapi/pull/26727))
- **deps:** bump piscina from 4.9.2 to 4.9.3 ([#26716](https://github.com/strapi/strapi/pull/26716))
- **deps:** bump undici from 6.25.0 to 6.27.0 ([#26714](https://github.com/strapi/strapi/pull/26714))
- **deps:** bump dompurify from 3.4.9 to 3.4.11 ([#26719](https://github.com/strapi/strapi/pull/26719))
- **deps-dev:** bump @babel/core ([#26667](https://github.com/strapi/strapi/pull/26667))

####

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.49.0]_

### v5.48.1

- Date: 2026-06-17
- Version: v5.48.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.48.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.48.1

- **added** — Add optional OpenAPI spec route
- **added** — Gate OpenAPI endpoint access with config
- **added** — Add paginated GET /api/upload/files/page endpoint
- **added** — Link to the Billing Portal
- **added** — Point Upsell Banner to Strapi Billing
- **changed** — Update billing portal address
- **fixed** — Upload returns unsigned URL on update media info
- **fixed** — Widgets show error when role has no access to mainfield of content type
- **fixed** — Correct IME Enter key handling in BlocksInput
- **fixed** — Return empty object for empty json body in fetch client
- **fixed** — Exclude disabled plugins from admin build
- **fixed** — Rate limit and serialize first admin registration
- **fixed** — Validate current user email updates
- **fixed** — Guard stale admin configuration
- **fixed** — Build does not run install; add install-deps arg
- **fixed** — Raise z-index of code block language selector
- **fixed** — Dedupe bulk delete document ids
- **fixed** — Replace sanitize-html with dompurify in Wysiwyg preview
- **fixed** — Validate numeric inputs before DB unique checks
- **fixed** — Combine multi-role field-level permissions

##### 5.48.1 (2026-06-17)

###### 🚀 New feature

- linking to the Billing Portal ([3df113f545](https://github.com/strapi/strapi/commit/3df113f545))
- pointing Upsell Banner to Strapi Billing ([06b0c31f47](https://github.com/strapi/strapi/commit/06b0c31f47))
- add optional openapi spec route ([#26239](https://github.com/strapi/strapi/pull/26239))
- updating billing portal address ([2d3fea21ff](https://github.com/strapi/strapi/commit/2d3fea21ff))
- **openapi:** gate endpoint access with config ([#26574](https://github.com/strapi/strapi/pull/26574))
- **upload:** add paginated GET /api/upload/files/page endpoint ([#26597](https://github.com/strapi/strapi/pull/26597))

###### 🔥 Bug fix

- upload returns unsigned URL on update media info ([#25195](https://github.com/strapi/strapi/pull/25195))
- widgets show error when role has no access to mainfield of ct ([#26537](https://github.com/strapi/strapi/pull/26537))
- correct IME Enter key handling in BlocksInput ([#24997](https://github.com/strapi/strapi/pull/24997))
- **admin:** return empty object for empty json body in fetch client ([#26277](https://github.com/strapi/strapi/pull/26277))
- **admin:** exclude disabled plugins from admin build ([#26448](https://github.com/strapi/strapi/pull/26448))
- **admin:** rate limit and serialize first admin registration ([#26576](https://github.com/strapi/strapi/pull/26576))
- **admin:** validate current user email updates ([#26591](https://github.com/strapi/strapi/pull/26591))
- **admin:** guard stale admin configuration ([#26625](https://github.com/strapi/strapi/pull/26625))
- **build:** build does not run install; add install-deps arg ([#26483](https://github.com/strapi/strapi/pull/26483))
- **ci:** run build:size as full command for compressed-size-action v3 ([#26556](https://github.com/strapi/strapi/pull/26556))
- **ci:** restore allowed paths-filter pin ([#26575](https://github.com/strapi/strapi/pull/26575))
- **ci:** avoid syncing CPR labels to CMS tickets ([#26648](https://github.com/strapi/strapi/pull/26648))
- **content-manager:** use ReadonlyArray for layout prop and fix Repeatable test fixture ([#26522](https://github.com/strapi/strapi/pull/26522))
- **content-manager:** raise z-index of code block language selector ([#25010](https://github.com/strapi/strapi/pull/25010), [#26324](https://github.com/strapi/strapi/pull/26324))
- **content-manager:** dedupe bulk delete document ids ([#26613](https://github.com/strapi/strapi/pull/26613))
- **content-manager:** replace sanitize-html with dompurify in Wysiwyg preview ([#26150](https://github.com/strapi/strapi/pull/26150))
- **core:** validate numeric inputs before DB unique checks ([#26101](https://github.com/strapi/strapi/pull/26101))
- **core/admin | content-manager:** combine multi-role field-level permissions ([#26055](https://github.com/strapi/strapi/pull/26055))
- **data-transfer:** skip links referencing data that was never transferred ([#26531](https://github.com/strapi/strapi/pull/26531))
- **data-transfer:** buffer push assets before invoking uploadStream ([#26086](https://github.com/strapi/strapi/pull/26086))
- **database:** restore join-table relation sort order in components ([#26553](https://github.com/strapi/strapi/pull/26553))
- **database:** avoid double finalising completed transactions ([#26122](https://github.com/strapi/strapi/pull/26122))
- **database:** move document_id secondary indexes to schema sync ([#26241](https://github.com/strapi/strapi/pull/26241))
- **strapi:** stabilize admin redux deps during upgrade ([#26249](https://github.com/strapi/strapi/pull/26249))
- **tsconfig:** remove lodash from server compilerOptions.types ([#26627](https://github.com/strapi/strapi/pull/26627))
- **upload:** folder navigation bugs in Media Library ([#26515](https://github.com/strapi/strapi/pull/26515))
- **upload:** preserve animation frames in GIF and WebP images ([#26126](https://github.com/strapi/strapi/pull/26126))
- **users-permissions:** support documentId user relations

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.48.1]_

### v5.48.0

- Date: 2026-06-10
- Version: v5.48.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.48.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.48.0

- **added** — Add optional OpenAPI spec route
- **added** — Gate OpenAPI endpoint access with config
- **fixed** — Upload returns unsigned URL on update media info
- **fixed** — Widgets show error when role has no access to main field of content type
- **fixed** — Return empty object for empty JSON body in fetch client
- **fixed** — Build does not run install; add install-deps arg
- **fixed** — Raise z-index of code block language selector
- **fixed** — Validate numeric inputs before DB unique checks
- **fixed** — Restore join-table relation sort order in components
- **fixed** — Avoid double finalising completed transactions
- **fixed** — Folder navigation bugs in Media Library
- **fixed** — Preserve animation frames in GIF and WebP images
- **fixed** — Ignore empty sort when building orderBy
- **changed** — Use ReadonlyArray for layout prop in content-manager
- **changed** — Use discriminated unions instead of unsafe type casting in GraphQL
- **changed** — Unhide and document upgrade to command
- **changed** — Apply rounded thin borders for startup banner
- **security** — Patch uuid and qs DoS advisories

##### 5.48.0 (2026-06-10)

###### 🚀 New feature

- add optional openapi spec route ([#26239](https://github.com/strapi/strapi/pull/26239))
- **openapi:** gate endpoint access with config ([#26574](https://github.com/strapi/strapi/pull/26574))

###### 🔥 Bug fix

- upload returns unsigned URL on update media info ([#25195](https://github.com/strapi/strapi/pull/25195))
- widgets show error when role has no access to mainfield of ct ([#26537](https://github.com/strapi/strapi/pull/26537))
- **admin:** return empty object for empty json body in fetch client ([#26277](https://github.com/strapi/strapi/pull/26277))
- **build:** build does not run install; add install-deps arg ([#26483](https://github.com/strapi/strapi/pull/26483))
- **ci:** run build:size as full command for compressed-size-action v3 ([#26556](https://github.com/strapi/strapi/pull/26556))
- **ci:** restore allowed paths-filter pin ([#26575](https://github.com/strapi/strapi/pull/26575))
- **content-manager:** use ReadonlyArray for layout prop and fix Repeatable test fixture ([#26522](https://github.com/strapi/strapi/pull/26522))
- **content-manager:** raise z-index of code block language selector ([#25010](https://github.com/strapi/strapi/pull/25010), [#26324](https://github.com/strapi/strapi/pull/26324))
- **core:** validate numeric inputs before DB unique checks ([#26101](https://github.com/strapi/strapi/pull/26101))
- **database:** restore join-table relation sort order in components ([#26553](https://github.com/strapi/strapi/pull/26553))
- **database:** avoid double finalising completed transactions ([#26122](https://github.com/strapi/strapi/pull/26122))
- **upload:** folder navigation bugs in Media Library ([#26515](https://github.com/strapi/strapi/pull/26515))
- **upload:** preserve animation frames in GIF and WebP images ([#26126](https://github.com/strapi/strapi/pull/26126))
- **utils:** ignore empty sort when building orderBy ([#26427](https://github.com/strapi/strapi/pull/26427))

###### 📚 Documentation Changes

- **openapi:** add contributor documentation ([#26410](https://github.com/strapi/strapi/pull/26410))

###### ⚙️ Chore

- remove experimental-dev example app ([#26552](https://github.com/strapi/strapi/pull/26552))
- update .gitignore for AI tooling directories ([#26526](https://github.com/strapi/strapi/pull/26526))
- **deps:** bump axios from 1.16.1 to 1.17.0 ([#26539](https://github.com/strapi/strapi/pull/26539))
- **deps:** bump the testing-library group across 1 directory with 2 updates ([#26506](https://github.com/strapi/strapi/pull/26506))
- **deps:** bump actions/setup-node from 4 to 6 ([#26496](https://github.com/strapi/strapi/pull/26496))
- **deps:** bump actions/stale from 10 to 10.2.0 ([#26497](https://github.com/strapi/strapi/pull/26497))
- **deps:** bump preactjs/compressed-size-action from 2 to 3 ([#26498](https://github.com/strapi/strapi/pull/26498))
- **deps:** resolve vulnerable transitive deps via lockfile dedupe and resolutions ([#26540](https://github.com/strapi/strapi/pull/26540))
- **deps:** bump cheerio from 1.0.0 to 1.2.0 ([#26569](https://github.com/strapi/strapi/pull/26569))
- **deps:** bump dorny/paths-filter from 3.0.3 to 4.0.1 ([#26566](https://github.com/strapi/strapi/pull/26566))
- **deps:** bump actions/download-artifact from 4.3.0 to 8.0.1 ([#26564](https://github.com/strapi/strapi/pull/26564))
- **deps-dev:** bump the eslint group across 1 directory with 10 updates ([#26500](https://github.com/strapi/strapi/pull/26500))
- **deps-dev:** bump @types/delegates from 1.0.0 to 1.0.3 ([#26570](https://github.com/strapi/strapi/pull/26570))
- **deps-dev:** bump the nx group across 1 directory with 2 updates ([#26502](https://github.com/strapi/strapi/pull/26502))
- **repo:** skip change freeze ownership check when freeze disabled ([#26474](https://github.com/strapi/strapi/pull/26474))

###### 💅 Enhancement

- **core/core:** rounded thin borders for startup banner ([#26273](https://github.com/strapi/strapi/pull/26273))
- **grap

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.48.0]_