5.52.2 (2026-08-26)
🔥 Bug fix
- make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
- admin: out of sort memory when listing audit logs on mysql (#27410)
- admin: send credentials on fetch client requests (#27413)
- admin: keep api token permissions on localized content types at boot (#27420)
- admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
- admin: slow startup with many roles due to redundant permission … (#27438)
- content-manager: draft status filter with i18n sibling locale published (#26835)
- content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
- content-manager: out of sort memory when listing history versions on mysql (#27394)
- core: Access token rotation fails with asymmetric JWT algorithms (#27201)
- core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
- core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
- database: relation reorder saves the wrong position (#27444)
- i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
- permissions: surface clear error for unsupported RBAC condition operators (#27355)
- plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
- upload: translate server error codes in the new media library (#27345)
- upload: sizeLimit is not enforced when replacing a file (#27414)
- upload: move replace media to the drawer footer, add tooltips (#27425)
- upload: list queued files in the upload progress dialog (#27416)
- upload: merge a second drop into the running upload batch (#27415)
⚙️ Chore
- replace lodash forEach with native Object.entries/values (#27409)
- add worktree bootstrap command (#27426)
- deps: upgrade memfs to 4.68.1 in @strapi/upgrade (#27406)
- deps: migrate first-party zod to 4.4.3 (#27428)
💅 Enhancement
- data-transfer: clarify partial transfer stage scope (#27322)
- database: log internal migrations at info level (#27324)
- database: add migration progress heartbeats (#27325)
🚨 Security
- graphql: warn about unbounded operation limits (#27390)
- upload: deny svg in generated project defaults (#27360)
⚠️ Changes to be aware of
New projects block SVG uploads by default
Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)
❤️ Thank You
- Adrien L @Adzouz
- Andrei L @unrevised6419
- Ayoub Hidri @ayhid
- Bassel Kanso
- Ben Irvin
- DMehaffy
- Eliau Elkouby @eliau2005
- Giulio Montagner @giu1io
- jasleenkaur-qed42 @jasleenkaur-qed42
- keke @kekekuli
- Lazizbek Ergashev @lazerg
- Merlijn van den Berg
- Nico André
- Omar MEBARKI
- Rohit Singh @HitOP2509
- Samran Asif @webdevsamran
- Ziyi @butcherZ