npm @strapi/strapi 5.48.1
v5.48.1
on Node.js NPM

11 hours ago

5.48.1 (2026-06-17)

🚀 New feature

  • linking to the Billing Portal (3df113f545)
  • pointing Upsell Banner to Strapi Billing (06b0c31f47)
  • add optional openapi spec route (#26239)
  • updating billing portal address (2d3fea21ff)
  • openapi: gate endpoint access with config (#26574)
  • upload: add paginated GET /api/upload/files/page endpoint (#26597)

🔥 Bug fix

  • upload returns unsigned URL on update media info (#25195)
  • widgets show error when role has no access to mainfield of ct (#26537)
  • correct IME Enter key handling in BlocksInput (#24997)
  • admin: return empty object for empty json body in fetch client (#26277)
  • admin: exclude disabled plugins from admin build (#26448)
  • admin: rate limit and serialize first admin registration (#26576)
  • admin: validate current user email updates (#26591)
  • admin: guard stale admin configuration (#26625)
  • build: build does not run install; add install-deps arg (#26483)
  • ci: run build:size as full command for compressed-size-action v3 (#26556)
  • ci: restore allowed paths-filter pin (#26575)
  • ci: avoid syncing CPR labels to CMS tickets (#26648)
  • content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
  • content-manager: raise z-index of code block language selector (#25010, #26324)
  • content-manager: dedupe bulk delete document ids (#26613)
  • content-manager: replace sanitize-html with dompurify in Wysiwyg preview (#26150)
  • core: validate numeric inputs before DB unique checks (#26101)
  • core/admin | content-manager: combine multi-role field-level permissions (#26055)
  • data-transfer: skip links referencing data that was never transferred (#26531)
  • data-transfer: buffer push assets before invoking uploadStream (#26086)
  • database: restore join-table relation sort order in components (#26553)
  • database: avoid double finalising completed transactions (#26122)
  • database: move document_id secondary indexes to schema sync (#26241)
  • strapi: stabilize admin redux deps during upgrade (#26249)
  • tsconfig: remove lodash from server compilerOptions.types (#26627)
  • upload: folder navigation bugs in Media Library (#26515)
  • upload: preserve animation frames in GIF and WebP images (#26126)
  • users-permissions: support documentId user relations (#26607)
  • utils: ignore empty sort when building orderBy (#26427)

📚 Documentation Changes

  • add CLAUDE.md alias and link PR template from AGENTS.md (#26251)
  • fix typos across contributor docs (#26590)
  • fix broken relative cross-doc links (#26601)
  • deprecate Node 20 in documentation (#26623)
  • openapi: add contributor documentation (#26410)

⚙️ Chore

  • remove experimental-dev example app (#26552)
  • update .gitignore for AI tooling directories (#26526)
  • release v5.48.0 update develop (#26599)
  • adding check for valid template on issue creation (#26546)
  • adding translations for manage subscription (aa0b3da3eb)
  • getting tests to pass (d2c06c6ca2)
  • *: support Node 26 (#26232)
  • ai/skills: add writing-a-skill skill (#26428)
  • ai/skills: add commit conventions (#26431)
  • ci: drop Node 20 from test workflow matrices (6f1a21c528)
  • ci: drop Node 20 from test workflow matrices (#26609)
  • core/strapi: dynamically import browserslist-to-esbuild (#25507)
  • data-transfer: move types into src so they are type-checked (#26352)
  • deps: bump axios from 1.16.1 to 1.17.0 (#26539)
  • deps: bump the testing-library group across 1 directory with 2 updates (#26506)
  • deps: bump actions/setup-node from 4 to 6 (#26496)
  • deps: bump actions/stale from 10 to 10.2.0 (#26497)
  • deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
  • deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
  • deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
  • deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
  • deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
  • deps: bump follow-redirects from 1.15.6 to 1.16.0 (#26580)
  • deps: bump shell-quote from 1.8.1 to 1.8.4 (#26585)
  • deps: bump @vitejs/plugin-react-swc (#26567)
  • deps: bump the rollup group across 1 directory with 3 updates (#26505)
  • deps: bump nrwl/nx-set-shas from 4 to 5 (#26565)
  • deps: bump anthropics/claude-code-action from 1 to 1.0.123 (#26640)
  • deps: bump trunk-io/analytics-uploader from 1.15.0 to 2.0.9 (#26638)
  • deps: bump rollup from 4.60.1 to 4.60.4 in the rollup group across 1 directory (#26641)
  • deps: bump open from 8.4.0 to 8.4.2 (#26643)
  • deps: bump stream-json and @types/stream-json (#26645)
  • deps: bump koa-helmet from 7.0.2 to 7.1.0 (#26642)
  • deps: bump axios from 1.17.0 to 1.18.0 (#26647)
  • deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
  • deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
  • deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
  • deps-dev: bump @types/webpack-hot-middleware from 2.25.9 to 2.25.12 (#26568)
  • deps-dev: bump @types/invariant from 2.2.36 to 2.2.37 (#26644)
  • repo: skip change freeze ownership check when freeze disabled (#26474)

💅 Enhancement

  • admin: hide deploy-now widget in production (#26660)
  • core/core: rounded thin borders for startup banner (#26273)
  • graphql: use discriminated unions instead of unsafe type casting (#25913)
  • upgrade: unhide and document upgrade to command (#26446)

🚨 Security

❤️ Thank You

Check out latest releases or
releases around @strapi/strapi 5.48.1

Don't miss a new strapi release

NewReleases is sending notifications on new releases.

Get notifications