# Strapi changelog

> The leading open-source headless CMS.

- Vendor: Strapi
- Category: Developer Tools
- Official site: https://strapi.io
- Tracked by: What's New (https://whatsnew.fyi/product/strapi)
- Harvested from: GitHub (strapi/strapi)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v5.51.2

- Date: 2026-08-05
- Version: v5.51.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.2

- **added** — Add optional component screenshots to DZ picker in content-manager
- **changed** — Use radio roles for accessibility and improve aria attributes
- **fixed** — Handle i18n conflict and local rights
- **fixed** — Interpolate min/max values in validation error messages in admin
- **fixed** — Pin react-colorful to prevent optimizeDeps include/exclude conflict in admin
- **fixed** — Relation creation discards parent changes in content-manager
- **fixed** — Relation order changes after saving dynamic-zone components in content-manager
- **fixed** — Keep document status accurate on mixed-locale batches in content-manager
- **fixed** — Use configured default pageSize when only page is provided in core
- **fixed** — Escape LIKE wildcards in filters and use equality for $eqi/$nei in database
- **fixed** — Use fractional __temp_key__ when filling from locale in i18n
- **fixed** — Stream URL imports to disk instead of buffering in memory in upload
- **fixed** — Keep cursor position while editing asset details fields in upload
- **fixed** — Apply asset permissions to media library actions in upload
- **fixed** — Keep crop drag tracking on touch devices in upload
- **fixed** — Keep asset drawer header visible on mobile in upload
- **fixed** — Media library MVP fixes in upload
- **changed** — Support required on relation attributes in content-type-builder
- **changed** — Look models up on the registries in getModel in core
- **changed** — Reduce per-column work when mapping rows to entities in database

##### 5.51.2 (2026-08-05)

###### 🚀 New feature

- **content-manager:** add optional component screenshots to DZ picker ([#26863](https://github.com/strapi/strapi/pull/26863))

###### 🔥 Bug fix

- use radio roles for accessibility and improve aria attributes ([#27139](https://github.com/strapi/strapi/pull/27139))
- handle i18n conflict and local rights ([6519f4d5db](https://github.com/strapi/strapi/commit/6519f4d5db))
- **admin:** interpolate min/max values in validation error messages ([#27172](https://github.com/strapi/strapi/pull/27172))
- **admin:** pin react-colorful to prevent optimizeDeps include/exclude conflict ([#27203](https://github.com/strapi/strapi/pull/27203))
- **content-manager:** relation creation discards parent changes ([#27081](https://github.com/strapi/strapi/pull/27081))
- **content-manager:** relation order changes after saving dynamic-zone components ([#27135](https://github.com/strapi/strapi/pull/27135))
- **content-manager:** keep document status accurate on mixed-locale batches ([#27035](https://github.com/strapi/strapi/pull/27035))
- **core:** use configured default pageSize when only page is provided ([#27132](https://github.com/strapi/strapi/pull/27132))
- **database:** escape LIKE wildcards in filters and use equality for $eqi/$nei ([#26476](https://github.com/strapi/strapi/pull/26476))
- **i18n:** use fractional __temp_key__ when filling from locale ([#26296](https://github.com/strapi/strapi/pull/26296))
- **upload:** stream URL imports to disk instead of buffering in memory ([#27176](https://github.com/strapi/strapi/pull/27176))
- **upload:** keep cursor position while editing asset details fields (CMS-1536) ([2c6edbfacb](https://github.com/strapi/strapi/commit/2c6edbfacb))
- **upload:** apply asset permissions to media library actions (CMS-434) ([e8099188e2](https://github.com/strapi/strapi/commit/e8099188e2))
- **upload:** keep crop drag tracking on touch devices (CMS-1538) ([7807ea83dc](https://github.com/strapi/strapi/commit/7807ea83dc))
- **upload:** keep asset drawer header visible on mobile (CMS-1539) ([4edad7ca75](https://github.com/strapi/strapi/commit/4edad7ca75))
- **upload:** media library MVP fixes ([7a4012c65a](https://github.com/strapi/strapi/commit/7a4012c65a))

###### 📚 Documentation Changes

- add contributor documentation for the MCP server ([#27160](https://github.com/strapi/strapi/pull/27160))

###### ⚙️ Chore

- **deps:** bump @hono/node-server from 1.19.14 to 1.19.17 ([#27166](https://github.com/strapi/strapi/pull/27166))
- **deps:** bump postcss from 8.5.14 to 8.5.25 ([#27195](https://github.com/strapi/strapi/pull/27195))
- **deps:** bump brace-expansion from 1.1.16 to 1.1.18 ([#27196](https://github.com/strapi/strapi/pull/27196))
- **deps:** bump js-yaml from 3.15.0 to 3.15.1 ([#27197](https://github.com/strapi/strapi/pull/27197))
- **deps:** bump motion from 12.23.24 to 12.40.0 ([#27133](https://github.com/strapi/strapi/pull/27133))
- **deps:** bump tar from 7.5.21 to 7.5.22 ([#27165](https://github.com/strapi/strapi/pull/27165))
- **deps:** bump react-router-dom from 6.30.3 to 6.30.4 ([#27134](https://github.com/strapi/strapi/pull/27134))
- **deps:** bump undici from 6.27.0 to 6.28.0 ([#27164](https://github.com/strapi/strapi/pull/27164))
- **deps:** bump axios from 1.18.1 to 1.19.0 ([#27198](https://github.com/strapi/strapi/pull/27198))
- **deps:** align app-template react-router-dom with admin 6.30.4 ([#27210](https://github.com/strapi/strapi/pull/27210))
- **jest:** run unit/front tests via nx, drop root jest config and dep ([#26701](https://github.com/strapi/strapi/pull/26701))
- **lint:** add non-blocking oxlint setup ([#26923](https://github.com/strapi/strapi/pull/26923))
- **users-permissions:** move server code into server/src ([#26105](https://github.com/strapi/strapi/pull/26105))

###### 💅 Enhancement

- **content-type-builder:** support required on relation attributes ([#27080](https://github.com/strapi/strapi/pull/27080))
- **core:** look models up on

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.51.2]_

### v5.51.1

- Date: 2026-07-29
- Version: v5.51.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.1

- **fixed** — respect field length constraints in AI localizations and isolate
- **fixed** — wording and merging sort options
- **fixed** — preserve sorting on view change
- **fixed** — scope audit logs user filter to log authors
- **fixed** — homepage recent-documents dates serialize as empty objects
- **fixed** — enforce required media and relations via api.documents.strictRelations
- **fixed** — return [] for empty morphMany on read
- **fixed** — prevent duplicate public assets in Vite builds

##### 5.51.1 (2026-07-29)

###### 🔥 Bug fix

- respect field length constraints in AI localizations and isolate… ([#26880](https://github.com/strapi/strapi/pull/26880))
- wording and merging sort options ([844c8d625d](https://github.com/strapi/strapi/commit/844c8d625d))
- preserve sorting on view change ([6ed616ab9a](https://github.com/strapi/strapi/commit/6ed616ab9a))
- **admin:** scope audit logs user filter to log authors ([#27047](https://github.com/strapi/strapi/pull/27047))
- **content-manager:** homepage recent-documents dates serialize as empty objects ([#27066](https://github.com/strapi/strapi/pull/27066))
- **core:** enforce required media and relations via api.documents.strictRelations ([#27028](https://github.com/strapi/strapi/pull/27028))
- **database:** return [] for empty morphMany on read ([#27090](https://github.com/strapi/strapi/pull/27090))
- **strapi:** prevent duplicate public assets in Vite builds ([#27089](https://github.com/strapi/strapi/pull/27089))

###### ⚙️ Chore

- **admin:** allow RFC 6265 control-char regex under develop eslint rules ([e8338bb6ba](https://github.com/strapi/strapi/commit/e8338bb6ba))
- **ci:** remove admin bundle-size workflow ([#27070](https://github.com/strapi/strapi/pull/27070))
- **deps:** bump brace-expansion from 1.1.14 to 1.1.16 ([#27071](https://github.com/strapi/strapi/pull/27071))
- **deps:** bump shell-quote from 1.8.4 to 1.10.0 ([#27072](https://github.com/strapi/strapi/pull/27072))
- **deps:** bump body-parser from 1.20.4 to 1.20.6 ([#27094](https://github.com/strapi/strapi/pull/27094))
- **deps:** bump dompurify from 3.4.11 to 3.4.12 ([#27095](https://github.com/strapi/strapi/pull/27095))
- **deps:** bump fast-uri from 3.1.2 to 3.1.4 ([#27098](https://github.com/strapi/strapi/pull/27098))
- **deps:** bump use-context-selector from 1.4.1 to 1.4.4 ([#27061](https://github.com/strapi/strapi/pull/27061))
- **deps:** bump cropperjs from 1.6.1 to 1.6.2 ([#27060](https://github.com/strapi/strapi/pull/27060))
- **deps:** upgrade handlebars, axios, tar, and related transitive deps ([#27091](https://github.com/strapi/strapi/pull/27091))
- **deps:** bump @radix-ui/react-toolbar from 1.0.4 to 1.1.11 ([#27059](https://github.com/strapi/strapi/pull/27059))
- **email-nodemailer:** migrate unit tests from jest to vitest ([#27074](https://github.com/strapi/strapi/pull/27074))
- **email-sendmail:** migrate unit tests from jest to vitest ([#27075](https://github.com/strapi/strapi/pull/27075))
- **upload-local:** migrate unit tests from jest to vitest ([#27073](https://github.com/strapi/strapi/pull/27073))

###### ❤️ Thank You

- Adrien L @Adzouz
- Adrien Lepoutre @Adzouz
- akash-dabhi-qed @akash-dabhi-qed
- Ben Irvin
- Giulio Montagner @giu1io
- Gonzalo Andres Garcia @gonbaum
- Mehdi Rezaei @mehdiraized
- Nico André

### v5.51.0

- Date: 2026-07-23
- Version: v5.51.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.51.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.51.0

- **added** — Add exclude/only content type CLI filters to data-transfer
- **added** — Add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) to i18n
- **fixed** — Preserve order when reordering a relation to the start of a list
- **fixed** — Use singleton modules for consistent runtime instances
- **fixed** — Make admin session token respect configured admin-cookie-path
- **fixed** — Make plugin/setting Select all work in admin token permissions
- **fixed** — Revalidate SPA shell to avoid stale chunk imports
- **fixed** — Expire admin reset-password tokens
- **fixed** — Improve SSO session metadata and logout revocation
- **fixed** — Fix blank admin in develop from prism language prebundle
- **fixed** — Fix SSO remote logout infinite redirect caused by cookie path
- **fixed** — Pre-bundle prism language plugins for all apps in content-manager
- **fixed** — Respect disconnected draft relations in publish warning
- **fixed** — Validate items passed to plugin action APIs
- **fixed** — Skip blocks editor remount on equal value echoes
- **fixed** — Keep preview button mounted during document churn
- **fixed** — Normalise release id so rescheduling cancels the stale job in content-releases
- **fixed** — Enforce default maxLength 255 for string fields
- **fixed** — Preserve draft relation order in discard-drafts migration
- **fixed** — Propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag

##### 5.51.0 (2026-07-23)

###### 🚀 New feature

- **data-transfer:** add exclude/only content type CLI filters ([#26915](https://github.com/strapi/strapi/pull/26915))
- **i18n:** add locale codes for Abkhazian and Circassian (Adyghe and Kabardian) ([#26255](https://github.com/strapi/strapi/pull/26255))

###### 🔥 Bug fix

- preserve order when reordering a relation to the start of a list ([#26112](https://github.com/strapi/strapi/pull/26112))
- singleton modules for consistent runtime instances ([#27064](https://github.com/strapi/strapi/pull/27064))
- **admin:** admin session token respects configured admin-cookie-path ([#25478](https://github.com/strapi/strapi/pull/25478), [#26300](https://github.com/strapi/strapi/pull/26300))
- **admin:** make plugin/setting "Select all" work in admin token permissions ([#27027](https://github.com/strapi/strapi/pull/27027))
- **admin:** revalidate SPA shell to avoid stale chunk imports ([#27039](https://github.com/strapi/strapi/pull/27039))
- **admin:** expire admin reset-password tokens ([#27020](https://github.com/strapi/strapi/pull/27020))
- **admin:** improve SSO session metadata and logout revocation ([#26872](https://github.com/strapi/strapi/pull/26872))
- **admin:** blank admin in develop from prism language prebundle ([#27086](https://github.com/strapi/strapi/pull/27086))
- **admin:** SSO remote logout infinite redirect (cookie path) ([#27100](https://github.com/strapi/strapi/pull/27100))
- **content-manager:** pre-bundle prism language plugins for all apps ([#26978](https://github.com/strapi/strapi/pull/26978))
- **content-manager:** respect disconnected draft relations in publish warning ([#26871](https://github.com/strapi/strapi/pull/26871))
- **content-manager:** validate items passed to plugin action APIs ([#27008](https://github.com/strapi/strapi/pull/27008))
- **content-manager:** skip blocks editor remount on equal value echoes ([#27042](https://github.com/strapi/strapi/pull/27042))
- **content-manager:** keep preview button mounted during document churn ([#27043](https://github.com/strapi/strapi/pull/27043))
- **content-releases:** normalise release id so rescheduling cancels the stale job ([#27063](
[#](https://github.com/strapi/strapi/pull/27063))
- **core:** enforce default maxLength 255 for string fields ([#26128](https://github.com/strapi/strapi/pull/26128))
- **core:** preserve draft relation order in discard-drafts migration ([#26851](https://github.com/strapi/strapi/pull/26851))
- **core:** propagate server updatedAt in addFirstPublishedAtToDraft to avoid false modified flag ([#26525](https://github.com/strapi/strapi/pull/26525))
- **create-strapi-app:** npm ci fails on fresh npm scaffold ([#27038](https://github.com/strapi/strapi/pull/27038))
- **create-strapi-app:** missing @strapi/database dependency breaks pnpm builds ([#27083](https://github.com/strapi/strapi/pull/27083))
- **database:** apply MySQL dialect configure to resolved connection functions ([#26646](https://github.com/strapi/strapi/pull/26646))
- **graphql:** include private fields in mutation inputs ([#26489](https://github.com/strapi/strapi/pull/26489))
- **types:** update LoadedPlugin type to understand factories ([#25298](https://github.com/strapi/strapi/pull/25298))
- **upload:** report real upload progress in the media library ([#27045](https://github.com/strapi/strapi/pull/27045))
- **users-permissions:** use correct i18n ids for role notifications ([#27044](https://github.com/strapi/strapi/pull/27044))
- **users-permissions:** fix role notification translations ([#26933](https://github.com/strapi/strapi/pull/26933))

###### ⚙️ Chore

- merge main into develop after 5.50.2 release ([9d93244f7e](https://github.com/strapi/strapi/commit/9d93244f7e))
- **deps:** bump ws from 8.21.0 to 8.21.1 ([#27030](https://github.com/strapi/strapi/pull/27030))
- **deps:** bump tar from 7.5.18 to 7.5.20 ([#27029](https://github.com/strapi/strapi/pull/27029))
- **deps:**

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.51.0]_

### v5.50.2

- Date: 2026-07-15
- Version: v5.50.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.2

- **added** — Make admin auth cookie name configurable via admin.auth.cookie.name config
- **added** — Complete Korean (ko) translation for i18n
- **fixed** — Prevent deprecated CJS Vite Node API warning on startup
- **fixed** — Fix pre-commit failing when staging files ignored by ESLint
- **fixed** — Show plan label instead of edition in dashboard
- **fixed** — Restore runtime default for context helper
- **fixed** — Clear stale Blocks editor selection on external value change
- **fixed** — Reject 'status' attribute when draftAndPublish is enabled for backward compatibility
- **fixed** — Validate license registry responses with zod
- **fixed** — Preserve duplicate form relation edits when cloning
- **security** — Bump ws to 8.21.0 to fix CVE-2026-48779
- **fixed** — Include status sort expression in SELECT when using DISTINCT
- **fixed** — Only warn about sendmail provider in development
- **fixed** — Add bearerAuth and bracket pagination query params to OpenAPI
- **fixed** — Auto-exclude pre-built plugin UI libs from Vite optimizeDeps
- **fixed** — Fix develop blank admin from optimizeDeps auto-exclude
- **fixed** — Prompt to pin ranged @strapi/* dependencies before upgrading
- **fixed** — Load remote asset thumbnails with crossOrigin to prevent CORS preview failures

##### 5.50.2 (2026-07-15)

###### 🚀 New feature

- **admin:** make admin auth cookie name configurable ([#26931](https://github.com/strapi/strapi/pull/26931))
- **i18n:** complete Korean (ko) translation ([#26941](https://github.com/strapi/strapi/pull/26941))

###### 🔥 Bug fix

- **admin:** prevent deprecated CJS Vite Node API warning on startup ([#26947](https://github.com/strapi/strapi/pull/26947))
- **admin:** pre-commit fails when staging files ignored by ESLint ([#26958](https://github.com/strapi/strapi/pull/26958))
- **admin:** show plan label instead of edition in dashboard ([#26891](https://github.com/strapi/strapi/pull/26891))
- **admin:** restore runtime default for context helper ([#26809](https://github.com/strapi/strapi/pull/26809))
- **ci:** reduce false positives in issue template checker ([#26955](https://github.com/strapi/strapi/pull/26955))
- **ci:** use npm install in issue template checker workflow ([#26974](https://github.com/strapi/strapi/pull/26974))
- **content-manager:** clear stale Blocks editor selection on external value change ([#26959](https://github.com/strapi/strapi/pull/26959))
- **core:** backward compat - reject 'status' attribute when draftAndPublish is enabled ([#26890](https://github.com/strapi/strapi/pull/26890))
- **core:** validate license registry responses with zod ([#26935](https://github.com/strapi/strapi/pull/26935))
- **core:** preserve duplicate form relation edits when cloning ([#26961](https://github.com/strapi/strapi/pull/26961))
- **data-transfer:** bump ws to 8.21.0 to fix CVE-2026-48779 ([#26898](https://github.com/strapi/strapi/pull/26898))
- **database:** include status sort expression in SELECT when using DISTINCT ([#26751](https://github.com/strapi/strapi/pull/26751))
- **database:** lint script does not run type check ([#26819](https://github.com/strapi/strapi/pull/26819))
- **email:** only warn about sendmail provider in development ([#26893](https://github.com/strapi/strapi/pull/26893))
- **openapi:** add bearerAuth and bracket pagination query params ([#26948](https://github.com/strapi/strapi/pull/26948))
- **strapi:** auto-exclude pre-built plugin UI libs from Vite optimizeDeps ([#26944](https://github.com/strapi/strapi/pull/26944))
- **strapi:** fix develop blank admin from optimizeDeps auto-exclude ([#27014](https://github.com/strapi/strapi/pull/27014))
- **upgrade:** prompt to pin ranged @strapi/* dependencies before upgrading ([#26929](https://github.com/strapi/strapi/pull/26929))
- **upload:** load remote asset thumbnails with crossOrigin to prevent CORS preview failures ([#26581](https://github.com/strapi/strapi/pull/26581), [#26901](https://github.com/strapi/strapi/pull/26901))
- **utils:** align remaining convert-query-params errors with ValidationError ([#26908](https://github.com/strapi/strapi/pull/26908))

###### ⚙️ Chore

- **ai-tooling:** sync skills when cursor sets up a new worktree ([#26954](https://github.com/strapi/strapi/pull/26954))
- **data-transfer:** clarify --exclude files CLI messaging ([#26914](https://github.com/strapi/strapi/pull/26914))
- **deps:** patch/minor dependency bumps ([#26823](https://github.com/strapi/strapi/pull/26823))
- **deps:** bump @xhmikosr/decompress from 10.2.0 to 10.2.1 ([#26928](https://github.com/strapi/strapi/pull/26928))
- **deps:** bump sharp from 0.33.5 to 0.34.5 ([#26993](https://github.com/strapi/strapi/pull/26993))
- **deps:** bump @internationalized/date from 3.5.4 to 3.12.1 ([#26994](https://github.com/strapi/strapi/pull/26994))
- **deps:** bump design-system and icons to v2.2.3 ([#27002](https://github.com/strapi/strapi/pull/27002))
- **eslint:** enforce zero warnings in package lint scripts ([#26922](https://github.com/strapi/strapi/pull/26922))
- **husky:** run git hooks through yarn exec ([#27006](https://github.com/strapi/strapi/pull/27006))
- **tooling:** remove unused find-up after lint-staged 16 ([#26792](https://github.com/strapi/strapi/pull/26792))
- *

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.2]_

### v5.50.1

- Date: 2026-07-08
- Version: v5.50.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.1

- **added** — Complete Japanese (ja) translations
- **added** — Update Polish translation
- **fixed** — Give the ability to open a list item in a new tab
- **fixed** — Translate enumeration option labels in the content manager
- **fixed** — Seat limit billing links
- **fixed** — Hide deploy menu in production using currentEnvironment
- **fixed** — Allow reading hidden content types for relation targets
- **fixed** — Preserve i18n locale on navigation and guard component schema race condition
- **fixed** — Preserve self-referential relation order on child publish
- **fixed** — Preserve published self-referential relation state
- **fixed** — Prevent crash when reordering and removing a relation in the same save
- **fixed** — Allow array populate parameter
- **fixed** — Enable strict TypeScript in dev sandboxes
- **fixed** — Detect plugin language from output path
- **fixed** — Add server eslint config and declare server deps
- **fixed** — Resolve admin Vite aliases from @strapi/admin closure
- **changed** — Emit namespace keyword instead of deprecated module
- **fixed** — Accept single-file arrays on replacement
- **fixed** — Align polymorphic populate validation with conversion
- **fixed** — Return 400 instead of 500 for invalid sort order/params

##### 5.50.1 (2026-07-08)

###### 🚀 New feature

- **i18n:** complete Japanese (ja) translations ([#26855](https://github.com/strapi/strapi/pull/26855))
- **i18n:** update Polish translation ([#26592](https://github.com/strapi/strapi/pull/26592))

###### 🔥 Bug fix

- give the ability to open a list item in a new tab ([#26853](https://github.com/strapi/strapi/pull/26853))
- **admin:** translate enumeration option labels in the content manager ([#26837](https://github.com/strapi/strapi/pull/26837))
- **admin:** seat limit billing links ([#26728](https://github.com/strapi/strapi/pull/26728))
- **cloud:** hide deploy menu in production using currentEnvironment ([#26733](https://github.com/strapi/strapi/pull/26733))
- **content-manager:** allow reading hidden content types for relation targets ([#26844](https://github.com/strapi/strapi/pull/26844))
- **content-manager:** preserve i18n locale on navigation and guard component schema race condition ([#26167](https://github.com/strapi/strapi/pull/26167))
- **core:** preserve self-referential relation order on child publish ([#26838](https://github.com/strapi/strapi/pull/26838))
- **core:** preserve published self-referential relation state ([#26932](https://github.com/strapi/strapi/pull/26932))
- **database:** prevent crash when reordering and removing a relation in the same save ([#26210](https://github.com/strapi/strapi/pull/26210))
- **documentation:** allow array populate parameter ([#26358](https://github.com/strapi/strapi/pull/26358))
- **examples:** enable strict TypeScript in dev sandboxes ([#26780](https://github.com/strapi/strapi/pull/26780))
- **generators:** detect plugin language from output path ([#26750](https://github.com/strapi/strapi/pull/26750))
- **review-workflows:** add server eslint config and declare server deps ([#26800](https://github.com/strapi/strapi/pull/26800))
- **strapi:** resolve admin Vite aliases from @strapi/admin closure ([#26756](https://github.com/strapi/strapi/pull/26756))
- **typescript-utils:** emit namespace keyword instead of deprecated module ([#26195](https://github.com/strapi/strapi/pull/26195))
- **upload:** accept single-file arrays on replacement ([#26405](https://github.com/strapi/strapi/pull/26405))
- **utils:** align polymorphic populate validation with conversion ([#26848](https://github.com/strapi/strapi/pull/26848))
- **utils:** return 400 instead of 500 for invalid sort order/params ([#26907](https://github.com/strapi/strapi/pull/26907))

###### 📚 Documentation Changes

- Highlight destructive operation in transfer engine ([#25081](https://github.com/strapi/strapi/pull/25081))

###### ⚙️ Chore

- fix lint warnings ([#26818](https://github.com/strapi/strapi/pull/26818))
- **deps:** bump nodemailer from 8.0.9 to 9.0.1 ([#26721](https://github.com/strapi/strapi/pull/26721))
- **deps:** bump qs from 6.15.2 to 6.15.3 ([#26846](https://github.com/strapi/strapi/pull/26846))
- **deps:** bump tar from 7.5.16 to 7.5.17 ([#26847](https://github.com/strapi/strapi/pull/26847))
- **deps:** bump js-yaml from 3.14.2 to 3.15.0 ([#26888](https://github.com/strapi/strapi/pull/26888))
- **deps:** bump tar from 7.5.17 to 7.5.18 ([#26887](https://github.com/strapi/strapi/pull/26887))
- **deps-dev:** bump eslint-plugin-prettier in the eslint group ([#26828](https://github.com/strapi/strapi/pull/26828))
- **deps-dev:** bump @rollup/plugin-swc in the rollup group ([#26906](https://github.com/strapi/strapi/pull/26906))
- **deps-dev:** align @babel/* family to 7.29.7 ([#26911](https://github.com/strapi/strapi/pull/26911))

###### 💅 Enhancement

- **ci:** block community PRs targeting main ([#26854](https://github.com/strapi/strapi/pull/26854))
- **content-manager:** keep sidebar primary actions and search bar fixed… ([#26867](https://github.com/strapi/strapi/pull/26867))

###### ❤️ Thank You

- Adrien L @Adzouz
- Alexandre Noblet @AlexNbl27
- Andrei L @unrevised6419
- Aryan Katiyar @Kelpy2004
- Bassel Kanso
- Ben Irvin
- jasleenkaur-qed42
- Maksim Zhu

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.1]_

### v5.50.0

- Date: 2026-07-02
- Version: v5.50.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.50.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.50.0

- **added** — Add active devices session management in admin
- **added** — Add security defaults to create-strapi-app templates
- **added** — Export lifecycle event type from database
- **added** — Add region option for EU data residency in SendGrid email provider
- **added** — Accept a credential provider function in AWS S3 upload provider
- **added** — Add comprehensive Japanese translation update for admin and 9 plugins
- **added** — Augment all context error response methods with TypeScript support
- **fixed** — Fix refresh token cookies missing Max-Age when sessions.cookie.maxAge is set
- **fixed** — Add test database healthchecks
- **fixed** — Generate APIs in named directories
- **fixed** — Retry lazy chunk loads and improve loading and error UX in admin
- **fixed** — Open upgrade admin panel link in new tab
- **fixed** — Hide boolean clear action when field is disabled in admin
- **fixed** — Restore default locale in permissions when adding i18n to content type
- **fixed** — Stop storing IP addresses in session metadata in admin
- **fixed** — Validate populate for polymorphic structures in content API
- **fixed** — Warn before publishing with draft relations in content manager
- **fixed** — Serve live preview script from server endpoint in content manager
- **fixed** — Prevent dynamic zone crash when value is null in content manager
- **fixed** — Preserve M2M relation order on published version after reorganization

##### 5.50.0 (2026-07-02)

###### 🚀 New feature

- **admin:** add active devices session management ([#26628](https://github.com/strapi/strapi/pull/26628))
- **cli:** add security defaults to create-strapi-app templates ([#26737](https://github.com/strapi/strapi/pull/26737))
- **database:** export lifecycle event type ([#25637](https://github.com/strapi/strapi/pull/25637))
- **provider-email-sendgrid:** add region option for EU data residency ([#25907](https://github.com/strapi/strapi/pull/25907))
- **provider-upload-aws-s3:** accept a credential provider function ([#26796](https://github.com/strapi/strapi/pull/26796))
- **translations:** comprehensive Japanese (ja) translation update for admin and 9 plugins ([#26687](https://github.com/strapi/strapi/pull/26687))
- **ts:** augment all context error response methods ([#25424](https://github.com/strapi/strapi/pull/25424))

###### 🔥 Bug fix

- refresh token cookies missing Max-Age when sessions.cookie.maxAg… ([#26747](https://github.com/strapi/strapi/pull/26747))
- add test database healthchecks ([#26511](https://github.com/strapi/strapi/pull/26511))
- generate apis in named directories ([#26354](https://github.com/strapi/strapi/pull/26354))
- **admin:** retry lazy chunk loads and improve loading and error UX ([#25954](https://github.com/strapi/strapi/pull/25954))
- **admin:** open "Upgrade your admin panel" link in new tab ([#26510](https://github.com/strapi/strapi/pull/26510))
- **admin:** remove @ts-expect-error in useQueryParams hook ([#25006](https://github.com/strapi/strapi/pull/25006))
- **admin:** hide boolean clear action when field is disabled ([#26294](https://github.com/strapi/strapi/pull/26294))
- **admin:** restore default locale in permissions when adding i18n to ct ([#26548](https://github.com/strapi/strapi/pull/26548))
- **admin:** keep static fallback paths url-safe ([#26518](https://github.com/strapi/strapi/pull/26518))
- **admin:** stop storing IP addresses in session metadata ([#26873](https://github.com/strapi/strapi/pull/26873))
- **ci:** use allowlisted thollander action ref in experimental publish workflow ([#26768](https://github.com/strapi/strapi/pull/26768))
- **content-api:** validate populate for polymorphic structures ([#25854](https://github.com/strapi/strapi/pull/25854))
- **content-manager:** warn before publishing with draft relations ([#26736](https://github.com/strapi/strapi/pull/26736))
- **content-manager:** use ListViewTable relation-loaded translation key ([#26798](https://github.com/strapi/strapi/pull/26798))
- **content-manager:** serve live preview script from server endpoint ([#26732](https://github.com/strapi/strapi/pull/26732))
- **content-manager:** capitalize component category names in dynamic zone ([#24426](https://github.com/strapi/strapi/pull/24426), [#26337](https://github.com/strapi/strapi/pull/26337))
- **content-manager:** add Japanese EditView shortcut hint translations ([#26814](https://github.com/strapi/strapi/pull/26814))
- **content-manager:** prevent dynamic zone crash when value is null ([#26816](https://github.com/strapi/strapi/pull/26816))
- **content-manager:** skip publish warning for M2M links to published entries ([#26858](https://github.com/strapi/strapi/pull/26858))
- **content-type-builder:** improve component category validation error message ([#25455](https://github.com/strapi/strapi/pull/25455))
- **core:** preserve M2M relation order on published version after reo… ([#26791](https://github.com/strapi/strapi/pull/26791))
- **core:** maxFileSize error not detected in body middleware ([#25011](https://github.com/strapi/strapi/pull/25011))
- **core:** resolve relations on non-localized entries with stale locale column ([#26805](https://github.com/strapi/strapi/pull/26805))
- **create-strapi-app:** scaffold pnpm 11 allowBuilds for Strapi Cloud ([#26757](https://github.com/strapi/strapi/pull/26757))
- **create-strapi-app:** enable strict TypeScript in app scaffolds ([#26779](https://github.com/strapi/strapi/

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.50.0]_

### v5.49.0

- Date: 2026-06-24
- Version: v5.49.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.49.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.49.0

- **added** — Export defineTool/defineResource/definePrompt builders for MCP
- **added** — Add optional replace method to upload providers
- **fixed** — Add support for initiallySelectedAssets
- **fixed** — Fix homepage dashboard duplicates entries for users with multiple roles
- **fixed** — Avoid buffering large uploads for MIME detection
- **fixed** — Throw ValidationError when populate exceeds qs arrayLimit
- **fixed** — Push anchor into view to prevent off-screen tooltips
- **fixed** — Support array of links in StrapiApp.addSettingsLink
- **fixed** — Fix admin users logged out mid-session by access-token expiry timer
- **fixed** — Use top-level Core type import in MCP types
- **fixed** — Save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter
- **fixed** — Reduce MCP relation output to identity-only shape
- **fixed** — Deduplicate MCP tool names when plugin has multiple content types
- **fixed** — Fix MCP misleading lifecycle docs
- **fixed** — Allow pnpm to build better-sqlite3 for SQLite scaffolds
- **fixed** — Transfer admin menu and auth logos with configuration
- **fixed** — Stop full-schema component_type IN on dynamic zone populate
- **fixed** — Preserve published relations from non-dp sources
- **fixed** — Default allowedHosts and pin Vite HMR to main server in dev
- **fixed** — Add explicit return types to recursive functions

##### 5.49.0 (2026-06-24)

###### 🚀 New feature

- **mcp:** export defineTool/defineResource/definePrompt builders ([#26603](https://github.com/strapi/strapi/pull/26603))

###### 🔥 Bug fix

- add support for initiallySelectedAssets ([#26679](https://github.com/strapi/strapi/pull/26679))
- homepage dashboard duplicates entries for users with multiple roles ([#25860](https://github.com/strapi/strapi/pull/25860))
- avoid buffering large uploads for MIME detection ([#26678](https://github.com/strapi/strapi/pull/26678))
- throw ValidationError when populate exceeds qs arrayLimit ([#25632](https://github.com/strapi/strapi/pull/25632), [#25916](https://github.com/strapi/strapi/pull/25916))
- push anchor into view to prevent off-screen tooltips ([#26303](https://github.com/strapi/strapi/pull/26303))
- **admin:** support array of links in StrapiApp.addSettingsLink ([#26433](https://github.com/strapi/strapi/pull/26433))
- **admin:** admin users logged out mid-session by access-token expiry timer ([#26680](https://github.com/strapi/strapi/pull/26680))
- **content-manager:** use top-level Core type import in MCP types ([#26681](https://github.com/strapi/strapi/pull/26681))
- **content-manager:** save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter ([#26621](https://github.com/strapi/strapi/pull/26621))
- **content-manager:** reduce MCP relation output to identity-only shape ([#26560](https://github.com/strapi/strapi/pull/26560))
- **content-manager:** deduplicate MCP tool names when plugin has multiple content types ([#26710](https://github.com/strapi/strapi/pull/26710))
- **core/core:** mcp misleading lifecycle docs ([#26698](https://github.com/strapi/strapi/pull/26698))
- **create-strapi-app:** allow pnpm to build better-sqlite3 for SQLite scaffolds ([#26675](https://github.com/strapi/strapi/pull/26675))
- **data-transfer:** transfer admin menu and auth logos with configuration ([#26425](https://github.com/strapi/strapi/pull/26425))
- **database:** stop full-schema component_type IN on dynamic zone populate ([#26734](https://github.com/strapi/strapi/pull/26734))
- **document-service:** preserve published relations from non-dp sources ([#26654](https://github.com/strapi/strapi/pull/26654))
- **strapi:** default allowedHosts and pin Vite HMR to main server in dev ([#26244](https://github.com/strapi/strapi/pull/26244))
- **types:** add explicit return types to recursive functions ([#26704](https://github.com/strapi/strapi/pull/26704))

###### 📚 Documentation Changes

- fix spelling typos in content-manager relations guide ([#26724](https://github.com/strapi/strapi/pull/26724))

###### ⚙️ Chore

- removing coderabbit status ([#26703](https://github.com/strapi/strapi/pull/26703))
- **core:** upgrade package-json to 10.0.1 + rollup interop 'auto' ([#26673](https://github.com/strapi/strapi/pull/26673))
- **deps:** bump markdown-it from 14.1.1 to 14.2.0 in the richtext-editor-security group across 1 directory ([#26688](https://github.com/strapi/strapi/pull/26688))
- **deps:** bump dompurify from 3.4.5 to 3.4.9 ([#26684](https://github.com/strapi/strapi/pull/26684))
- **deps:** bump nodemailer from 8.0.5 to 8.0.9 ([#26689](https://github.com/strapi/strapi/pull/26689))
- **deps:** bump tar from 7.5.11 to 7.5.16 ([#26691](https://github.com/strapi/strapi/pull/26691))
- **deps:** bump form-data from 4.0.4 to 4.0.6 ([#26692](https://github.com/strapi/strapi/pull/26692))
- **deps:** bump anthropics/claude-code-action from 1.0.123 to 1.0.132 ([#26727](https://github.com/strapi/strapi/pull/26727))
- **deps:** bump piscina from 4.9.2 to 4.9.3 ([#26716](https://github.com/strapi/strapi/pull/26716))
- **deps:** bump undici from 6.25.0 to 6.27.0 ([#26714](https://github.com/strapi/strapi/pull/26714))
- **deps:** bump dompurify from 3.4.9 to 3.4.11 ([#26719](https://github.com/strapi/strapi/pull/26719))
- **deps-dev:** bump @babel/core ([#26667](https://github.com/strapi/strapi/pull/26667))

####

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.49.0]_

### v5.48.1

- Date: 2026-06-17
- Version: v5.48.1
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.48.1
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.48.1

- **added** — Add optional OpenAPI spec route
- **added** — Gate OpenAPI endpoint access with config
- **added** — Add paginated GET /api/upload/files/page endpoint
- **added** — Link to the Billing Portal
- **added** — Point Upsell Banner to Strapi Billing
- **changed** — Update billing portal address
- **fixed** — Upload returns unsigned URL on update media info
- **fixed** — Widgets show error when role has no access to mainfield of content type
- **fixed** — Correct IME Enter key handling in BlocksInput
- **fixed** — Return empty object for empty json body in fetch client
- **fixed** — Exclude disabled plugins from admin build
- **fixed** — Rate limit and serialize first admin registration
- **fixed** — Validate current user email updates
- **fixed** — Guard stale admin configuration
- **fixed** — Build does not run install; add install-deps arg
- **fixed** — Raise z-index of code block language selector
- **fixed** — Dedupe bulk delete document ids
- **fixed** — Replace sanitize-html with dompurify in Wysiwyg preview
- **fixed** — Validate numeric inputs before DB unique checks
- **fixed** — Combine multi-role field-level permissions

##### 5.48.1 (2026-06-17)

###### 🚀 New feature

- linking to the Billing Portal ([3df113f545](https://github.com/strapi/strapi/commit/3df113f545))
- pointing Upsell Banner to Strapi Billing ([06b0c31f47](https://github.com/strapi/strapi/commit/06b0c31f47))
- add optional openapi spec route ([#26239](https://github.com/strapi/strapi/pull/26239))
- updating billing portal address ([2d3fea21ff](https://github.com/strapi/strapi/commit/2d3fea21ff))
- **openapi:** gate endpoint access with config ([#26574](https://github.com/strapi/strapi/pull/26574))
- **upload:** add paginated GET /api/upload/files/page endpoint ([#26597](https://github.com/strapi/strapi/pull/26597))

###### 🔥 Bug fix

- upload returns unsigned URL on update media info ([#25195](https://github.com/strapi/strapi/pull/25195))
- widgets show error when role has no access to mainfield of ct ([#26537](https://github.com/strapi/strapi/pull/26537))
- correct IME Enter key handling in BlocksInput ([#24997](https://github.com/strapi/strapi/pull/24997))
- **admin:** return empty object for empty json body in fetch client ([#26277](https://github.com/strapi/strapi/pull/26277))
- **admin:** exclude disabled plugins from admin build ([#26448](https://github.com/strapi/strapi/pull/26448))
- **admin:** rate limit and serialize first admin registration ([#26576](https://github.com/strapi/strapi/pull/26576))
- **admin:** validate current user email updates ([#26591](https://github.com/strapi/strapi/pull/26591))
- **admin:** guard stale admin configuration ([#26625](https://github.com/strapi/strapi/pull/26625))
- **build:** build does not run install; add install-deps arg ([#26483](https://github.com/strapi/strapi/pull/26483))
- **ci:** run build:size as full command for compressed-size-action v3 ([#26556](https://github.com/strapi/strapi/pull/26556))
- **ci:** restore allowed paths-filter pin ([#26575](https://github.com/strapi/strapi/pull/26575))
- **ci:** avoid syncing CPR labels to CMS tickets ([#26648](https://github.com/strapi/strapi/pull/26648))
- **content-manager:** use ReadonlyArray for layout prop and fix Repeatable test fixture ([#26522](https://github.com/strapi/strapi/pull/26522))
- **content-manager:** raise z-index of code block language selector ([#25010](https://github.com/strapi/strapi/pull/25010), [#26324](https://github.com/strapi/strapi/pull/26324))
- **content-manager:** dedupe bulk delete document ids ([#26613](https://github.com/strapi/strapi/pull/26613))
- **content-manager:** replace sanitize-html with dompurify in Wysiwyg preview ([#26150](https://github.com/strapi/strapi/pull/26150))
- **core:** validate numeric inputs before DB unique checks ([#26101](https://github.com/strapi/strapi/pull/26101))
- **core/admin | content-manager:** combine multi-role field-level permissions ([#26055](https://github.com/strapi/strapi/pull/26055))
- **data-transfer:** skip links referencing data that was never transferred ([#26531](https://github.com/strapi/strapi/pull/26531))
- **data-transfer:** buffer push assets before invoking uploadStream ([#26086](https://github.com/strapi/strapi/pull/26086))
- **database:** restore join-table relation sort order in components ([#26553](https://github.com/strapi/strapi/pull/26553))
- **database:** avoid double finalising completed transactions ([#26122](https://github.com/strapi/strapi/pull/26122))
- **database:** move document_id secondary indexes to schema sync ([#26241](https://github.com/strapi/strapi/pull/26241))
- **strapi:** stabilize admin redux deps during upgrade ([#26249](https://github.com/strapi/strapi/pull/26249))
- **tsconfig:** remove lodash from server compilerOptions.types ([#26627](https://github.com/strapi/strapi/pull/26627))
- **upload:** folder navigation bugs in Media Library ([#26515](https://github.com/strapi/strapi/pull/26515))
- **upload:** preserve animation frames in GIF and WebP images ([#26126](https://github.com/strapi/strapi/pull/26126))
- **users-permissions:** support documentId user relations

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.48.1]_

### v5.48.0

- Date: 2026-06-10
- Version: v5.48.0
- Original notes: https://github.com/strapi/strapi/releases/tag/v5.48.0
- Permalink: https://whatsnew.fyi/product/strapi/releases/v5.48.0

- **added** — Add optional OpenAPI spec route
- **added** — Gate OpenAPI endpoint access with config
- **fixed** — Upload returns unsigned URL on update media info
- **fixed** — Widgets show error when role has no access to main field of content type
- **fixed** — Return empty object for empty JSON body in fetch client
- **fixed** — Build does not run install; add install-deps arg
- **fixed** — Raise z-index of code block language selector
- **fixed** — Validate numeric inputs before DB unique checks
- **fixed** — Restore join-table relation sort order in components
- **fixed** — Avoid double finalising completed transactions
- **fixed** — Folder navigation bugs in Media Library
- **fixed** — Preserve animation frames in GIF and WebP images
- **fixed** — Ignore empty sort when building orderBy
- **changed** — Use ReadonlyArray for layout prop in content-manager
- **changed** — Use discriminated unions instead of unsafe type casting in GraphQL
- **changed** — Unhide and document upgrade to command
- **changed** — Apply rounded thin borders for startup banner
- **security** — Patch uuid and qs DoS advisories

##### 5.48.0 (2026-06-10)

###### 🚀 New feature

- add optional openapi spec route ([#26239](https://github.com/strapi/strapi/pull/26239))
- **openapi:** gate endpoint access with config ([#26574](https://github.com/strapi/strapi/pull/26574))

###### 🔥 Bug fix

- upload returns unsigned URL on update media info ([#25195](https://github.com/strapi/strapi/pull/25195))
- widgets show error when role has no access to mainfield of ct ([#26537](https://github.com/strapi/strapi/pull/26537))
- **admin:** return empty object for empty json body in fetch client ([#26277](https://github.com/strapi/strapi/pull/26277))
- **build:** build does not run install; add install-deps arg ([#26483](https://github.com/strapi/strapi/pull/26483))
- **ci:** run build:size as full command for compressed-size-action v3 ([#26556](https://github.com/strapi/strapi/pull/26556))
- **ci:** restore allowed paths-filter pin ([#26575](https://github.com/strapi/strapi/pull/26575))
- **content-manager:** use ReadonlyArray for layout prop and fix Repeatable test fixture ([#26522](https://github.com/strapi/strapi/pull/26522))
- **content-manager:** raise z-index of code block language selector ([#25010](https://github.com/strapi/strapi/pull/25010), [#26324](https://github.com/strapi/strapi/pull/26324))
- **core:** validate numeric inputs before DB unique checks ([#26101](https://github.com/strapi/strapi/pull/26101))
- **database:** restore join-table relation sort order in components ([#26553](https://github.com/strapi/strapi/pull/26553))
- **database:** avoid double finalising completed transactions ([#26122](https://github.com/strapi/strapi/pull/26122))
- **upload:** folder navigation bugs in Media Library ([#26515](https://github.com/strapi/strapi/pull/26515))
- **upload:** preserve animation frames in GIF and WebP images ([#26126](https://github.com/strapi/strapi/pull/26126))
- **utils:** ignore empty sort when building orderBy ([#26427](https://github.com/strapi/strapi/pull/26427))

###### 📚 Documentation Changes

- **openapi:** add contributor documentation ([#26410](https://github.com/strapi/strapi/pull/26410))

###### ⚙️ Chore

- remove experimental-dev example app ([#26552](https://github.com/strapi/strapi/pull/26552))
- update .gitignore for AI tooling directories ([#26526](https://github.com/strapi/strapi/pull/26526))
- **deps:** bump axios from 1.16.1 to 1.17.0 ([#26539](https://github.com/strapi/strapi/pull/26539))
- **deps:** bump the testing-library group across 1 directory with 2 updates ([#26506](https://github.com/strapi/strapi/pull/26506))
- **deps:** bump actions/setup-node from 4 to 6 ([#26496](https://github.com/strapi/strapi/pull/26496))
- **deps:** bump actions/stale from 10 to 10.2.0 ([#26497](https://github.com/strapi/strapi/pull/26497))
- **deps:** bump preactjs/compressed-size-action from 2 to 3 ([#26498](https://github.com/strapi/strapi/pull/26498))
- **deps:** resolve vulnerable transitive deps via lockfile dedupe and resolutions ([#26540](https://github.com/strapi/strapi/pull/26540))
- **deps:** bump cheerio from 1.0.0 to 1.2.0 ([#26569](https://github.com/strapi/strapi/pull/26569))
- **deps:** bump dorny/paths-filter from 3.0.3 to 4.0.1 ([#26566](https://github.com/strapi/strapi/pull/26566))
- **deps:** bump actions/download-artifact from 4.3.0 to 8.0.1 ([#26564](https://github.com/strapi/strapi/pull/26564))
- **deps-dev:** bump the eslint group across 1 directory with 10 updates ([#26500](https://github.com/strapi/strapi/pull/26500))
- **deps-dev:** bump @types/delegates from 1.0.0 to 1.0.3 ([#26570](https://github.com/strapi/strapi/pull/26570))
- **deps-dev:** bump the nx group across 1 directory with 2 updates ([#26502](https://github.com/strapi/strapi/pull/26502))
- **repo:** skip change freeze ownership check when freeze disabled ([#26474](https://github.com/strapi/strapi/pull/26474))

###### 💅 Enhancement

- **core/core:** rounded thin borders for startup banner ([#26273](https://github.com/strapi/strapi/pull/26273))
- **grap

_[Truncated at 4000 characters — full notes: https://github.com/strapi/strapi/releases/tag/v5.48.0]_

### v4.26.2

- Date: 2026-06-09
- Version: v4.26.2
- Original notes: https://github.com/strapi/strapi/releases/tag/v4.26.2
- Permalink: https://whatsnew.fyi/product/strapi/releases/v4.26.2

- **security** — Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization
- **security** — Upgraded tar to v7 to address security warnings
- **security** — Applied v4 dependency security and maintenance updates
- **fixed** — Enforced unique admin email validation when updating the authenticated user profile
- **added** — Added Node.js 22 support for Strapi v4

##### :warning: Note: This is the final Strapi 4 release :warning: 

No further updates to Strapi 4 will be published, this release serves as the final version of Strapi 4 which is considered EOL (End-Of-Life) as of April 30th, 2026. All Strapi users should migrate to Strapi 5: https://docs.strapi.io/cms/migration/v4-to-v5/introduction-and-faq

Also please note, this does include Strapi Customers as well. Strapi Cloud will still continue to function with Strapi 4 but that may be subject change in the near future without warning.

##### What's Changed

###### Security
* Fixed a critical vulnerability where relational filtering could expose sensitive data through insufficient query sanitization. See [GHSA-rjg2-95x7-8qmx](https://github.com/strapi/strapi/security/advisories/GHSA-rjg2-95x7-8qmx) / CVE-2026-27886.
* Upgraded `tar` to v7 to address security warnings.
* Applied v4 dependency security and maintenance updates.

###### Fixes
* Enforced unique admin email validation when updating the authenticated user profile.

###### Compatibility
* Added Node.js 22 support for Strapi v4.

**Full Changelog**: https://github.com/strapi/strapi/compare/v4.26.1...v4.26.2