v5.48.0
Added 2
- Add optional OpenAPI spec route
- Gate OpenAPI endpoint access with config
Changed 4
- Use ReadonlyArray for layout prop in content-manager
- Use discriminated unions instead of unsafe type casting in GraphQL
- Unhide and document upgrade to command
- Apply rounded thin borders for startup banner
Fixed 11
- Upload returns unsigned URL on update media info
- Widgets show error when role has no access to main field of content type
- Return empty object for empty JSON body in fetch client
- Build does not run install; add install-deps arg
- Raise z-index of code block language selector
- Validate numeric inputs before DB unique checks
- Restore join-table relation sort order in components
- Avoid double finalising completed transactions
- Folder navigation bugs in Media Library
- Preserve animation frames in GIF and WebP images
- Ignore empty sort when building orderBy
Security 1
- Patch uuid and qs DoS advisories
5.48.0 (2026-06-10)
🚀 New feature
🔥 Bug fix
- upload returns unsigned URL on update media info (#25195)
- widgets show error when role has no access to mainfield of ct (#26537)
- admin: return empty object for empty json body in fetch client (#26277)
- build: build does not run install; add install-deps arg (#26483)
- ci: run build:size as full command for compressed-size-action v3 (#26556)
- ci: restore allowed paths-filter pin (#26575)
- content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
- content-manager: raise z-index of code block language selector (#25010, #26324)
- core: validate numeric inputs before DB unique checks (#26101)
- database: restore join-table relation sort order in components (#26553)
- database: avoid double finalising completed transactions (#26122)
- upload: folder navigation bugs in Media Library (#26515)
- upload: preserve animation frames in GIF and WebP images (#26126)
- utils: ignore empty sort when building orderBy (#26427)
📚 Documentation Changes
- openapi: add contributor documentation (#26410)
⚙️ Chore
- remove experimental-dev example app (#26552)
- update .gitignore for AI tooling directories (#26526)
- deps: bump axios from 1.16.1 to 1.17.0 (#26539)
- deps: bump the testing-library group across 1 directory with 2 updates (#26506)
- deps: bump actions/setup-node from 4 to 6 (#26496)
- deps: bump actions/stale from 10 to 10.2.0 (#26497)
- deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
- deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
- deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
- deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
- deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
- deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
- deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
- deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
- repo: skip change freeze ownership check when freeze disabled (#26474)
💅 Enhancement
- core/core: rounded thin borders for startup banner (#26273)
- graphql: use discriminated unions instead of unsafe type casting (#25913)
- upgrade: unhide and document upgrade to command (#26446)
🚨 Security
- deps: patch uuid (GHSA-w5hq-g745-h8pq) and qs DoS advisories (9aef801f35)
- deps: scope uuid/qs resolutions to affected descriptors (38b6831652)
❤️ Thank You
- Andrei L @unrevised6419
- Andrei Varapayeu @thisavoropaev
- Arav Menon @Arav-Menon
- Aurélien GEORGET
- Ben Irvin
- Dante Calderon @dantehemerson
- Jamie Howard @jhoward1994
- Maksim Zhukau @MaksZhukov
- mathildeleg @mathildeleg
- Nico André