npm @strapi/strapi 5.62.0
v5.62.0
on Node.js NPM

latest release: 0.0.0-experimental.db60de8e3edc5ef68335b3110d9cfa97b67c8572
one hour ago

5.62.0 (2026-11-12)

⚠️ Security Warning and Notice ⚠️

Strapi was made aware of a vulnerability that was patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure.

⚠️ Changes to be aware of

Invalid boolean filter values now return 400

Filtering a boolean field by an empty value, yes/no/on/off, a value padded with spaces, or a number other than 0/1 now returns a 400 error. Before, most of these silently matched the true entries. TRUE/FALSE (and T/F) are now read case-insensitively, and routes that query the database directly answer invalid filter values with 400 instead of 500.

(#28172)

Optional time in date-time list filters

In the Content Manager list view and the audit logs, date-time filters now accept a date alone, which matches that whole day. You can still add a time, which matches that exact minute. Plugins that use the admin Filters component with a date-time option should pass their filters through the new toApiFilters(filters, options) before calling their API.

(#28367)

Faster, safer email validation

Email validation no longer slows down sharply on crafted input, which could stall the server from the unauthenticated forgot-password routes. The stricter pattern also rejects a dot inside a domain label, such as example.co..uk.

(#28059)

Upload Content API ignores unsupported query parameters (since 5.61.1)

GET /api/upload/files, /api/upload/files/page and /api/upload/files/:id now pass only supported query parameters to the upload service. Projects with api.rest.strictParams enabled get a 400 for unknown parameters, as on other Content API routes. Other projects keep ignoring them.

(f531775c87)

Data transfer: --throttle now applies to entities and links

strapi export, import and transfer now apply --throttle and global transforms to every stage. Before, they skipped entities and links. If you run a transfer inside Jest (export, import or transfer called from a test), start Node with --experimental-vm-modules. The CLI commands do not need it.

(#28206)

Upload File type now requires five keys (TypeScript only)

width, height, formats, previewUrl and provider_metadata are now required on the File type of @strapi/upload, though their values can still be null. TypeScript code that builds a File object itself, such as a test stub or a mock provider, must set them, for example to null.

(#28209)

Policy handlers may be async (TypeScript only)

Core.PolicyHandler can now return a promise, and policyContext.state is typed. TypeScript code that uses a policy handler's result directly must await it.

(#28469)

Sanitizer and traversal results use unknown values (TypeScript only)

traverseEntity, defaultSanitizeOutput, sanitizePasswords, Sanitizer and Validator from @strapi/utils now take and return objects with unknown values, id included. Check a field's type before you use it (for example typeof value === 'string'). In strict-mode projects, type the entity parameter of a custom sanitizer or validator as Record<string, unknown>.

(#28539)

🚀 New feature

  • admin: show an upgrade banner when Strapi is out of date (93dfbb8af7)
  • admin: confirm before closing a modal with unsaved changes (#28239)
  • cli: show plugins outside the license as unselectable in strapi enterprise install (#28213)
  • content-manager: optional time on date-time list filters (#28367)
  • content-manager: copy existing components (#26611)
  • content-releases: partial releases (#28339)
  • create-strapi-app: report agent, ci or human runs in telemetry (6cbfa23ee1)
  • i18n: warn before editing shared fields on secondary locales (#27370)
  • strapi: remove the unstableNextDesignSystem future flag (#28357)
  • tests: shared app generation and server lifecycle (0c092732c0)

🔥 Bug fix

  • update typed scope fixtures with invocation and agentname (e5da19b87d)
  • fixed the type check failure (10fe65e6b9)
  • oxlint fix (735b9f26e5)
  • fixed the type error in Auth.test.tsx (ea7a47a3b7)
  • admin: align upgrade banner with design system and copy review (2a9dd81573)
  • admin: audit log actions, routes and table persistence follow different gates (#28337)
  • admin: keep permissions of actions registered in the app bootstrap (#28327)
  • admin: read only user-set expiresIn for session lifespan fallbacks (#28378)
  • admin: previous user's cached permissions after login without a page reload (#27368)
  • admin: audit log entry can be read without its user on MySQL and Postgres (#28290)
  • admin: bulk actions bar can stay empty after selecting all entries (#28292)
  • admin: signing in right after a logout can reset the login page (#28390)
  • admin: reject granting role permissions the requester does not hold (#27999)
  • admin: keep audit-log grants when admin.auditLogs.enabled is turned off (#28379)
  • admin: log the permissions the boot cleanup deletes (#28383)
  • admin: useFetchClient requests aborted under React StrictMode (#27895)
  • admin: mark config-disabled audit-log permissions in the permission editors (#28382)
  • admin: keep the disabled-by-config badge readable on narrow screens (#28440)
  • admin: hide audit logs entry points when admin.auditLogs.enabled is false (#28413)
  • admin: keep permission cleanup warnings on one line (#28414)
  • admin: use the textarea-enum custom field option type (#28477)
  • admin: keep the data type in permissions manager sanitizeInput and sanitizeOutput (#28522)
  • admin: role addPermissions declares a wider type than the permissions it stores (#28523)
  • admin: role managers cannot re-save roles with unlocalized rows (#28569)
  • content-manager: sanitized query shortcuts use the rules of their action (#28331)
  • content-manager: do not crash uid generation on non-string values (#28417)
  • content-manager: pass an undefined locale to clone when the body locale is null (#28534)
  • content-manager: recent documents title is not a string for non-string main fields (#28538)
  • content-releases: deleting an entry rewrites published releases (#28169)
  • content-type-builder: stop waiting on a schema status request that is never answered (51338f056e)
  • content-type-builder: stop polling the restart status after unmount (9595cc2254)
  • content-type-builder: restore file watcher after a refused schema update (#28332)
  • content-type-builder: validation errors return an empty error body (#28191)
  • content-type-builder: type schema handler uid by handler kind (#28395)
  • content-type-builder: reject createContentType calls without a displayName (#28464)
  • content-type-builder: keep entries and media when a component uid changes (#28398)
  • core: expose numeric license feature options as numbers (#28335)
  • core: await entries.publish in document-service publish to satisfy return-await (#28401)
  • core: fail at startup when a policy or middleware module has no handler (#28463)
  • core/core: telemetry requests ignore their timeout (#28171)
  • create-strapi-app: type-check JS templates without node_modules noise (#28393)
  • create-strapi-app: make the example JS template seed script pass checkJs (#28470)
  • create-strapi-app: default the sqlite file when --dbfile is omitted (#28467)
  • database: pool timeout stack traces stop at knex instead of the calling code (#27981)
  • database: boolean filters match true rows for any unrecognised value (#28172)
  • deps: align tests-next/ui Playwright pin to 1.64.1 (#28501)
  • deps: bump @strapi/design-system and @strapi/icons to 2.3.1 (#28602)
  • email: templated email without html throws a missing attributes error (#28258)
  • email: content api send answers 500 instead of 400 on an invalid body (#28251)
  • i18n: lock non-localized fields on secondary locales (#27184)
  • i18n: ai localizations read a missing document locale as a string (#28537)
  • provider-email-nodemailer: build the files the ./utils export points to (#28474)
  • review-workflows: read workflow and stage limits from the license feature options (#28250)
  • review-workflows: workflow limit modal reopens on the edit page after a save (#28452)
  • review-workflows: check weeklySchedule in ensureWeeklyStoredCronSchedule (#28461)
  • review-workflows: pass an empty content type list when creating a workflow without one (#28528)
  • strapi: stop the app when strapi develop hits a TypeScript compile error (#28473)
  • strapi: keep the admin html entry when a custom vite config replaces the input (#28356)
  • tests: don't open a browser tab when a test app starts (19fe86c23d)
  • tests: stop test servers reliably and keep their env and ports in bounds (a672064768)
  • types: declare @types/json-logic-js as a dependency of @strapi/types (#28472)
  • types: type policy context state, async policies and controller helpers (#28469)
  • types: nested filters with a generic content type uid run tsc out of memory (#28478)
  • typescript-utils: sort generated type keys independently of the machine locale (#28460)
  • upload: ignore unsupported query params in content API (f531775c87)
  • upload: media library input delete tests time out on loaded ci runners (#28369)
  • upload: the file type does not require the nullable keys every stored row has (#28209)
  • upload: type the folder structure as a tree of nodes (#28415)
  • upload: AI metadata job dates are ISO strings (#28416)
  • upload: let the media library folder sidebar scroll to its last folder (#28449)
  • upload: latest AI metadata job contract declares a { data } envelope the route never sends (#28515)
  • upload: folder-structure response typed as ids mixed with picker nodes (#28517)
  • upload: asset details drawer cannot be edited inside the relation modal (3b6e480b77)
  • utils: make yup email validation run in linear time (#28059)
  • utils: match Strapi errors across copies of @strapi/utils (#27995)
  • utils: treat a string -1 pagination limit as no limit (#28465)
  • utils: type withDefaultPagination input as the query values that arrive (#28462)
  • utils: traverseEntity and sanitizers reject documents with unknown values (#28539)

📚 Documentation Changes

  • fix wrong testing instructions (b568f56f9a)
  • fix the e2e runner env in the CLI tests README and the yarn build description (22a22e8692)

⚙️ Chore

  • merge back release 5.61.0 (e731656f09)
  • release v5.61.0 update develop (56bed88a29)
  • admin: remove the unused IS_EE env var from front tests (7e50eafc2b)
  • ci: send vitest unit coverage to sonarcloud (#28272)
  • content-manager: narrow the relations morph check with an in check (#28524)
  • content-type-builder: check custom field option types have a renderer (#28493)
  • data-transfer: read and write JSONL with stream-chain (#28206)
  • deps: bump nodemailer from 10.0.9 to 10.1.4 (#28245)
  • deps: bump graphql-scalars from 1.22.2 to 2.0.1 (#28343)
  • deps: bump qs from 6.16.1 to 6.16.2 (#28341)
  • deps: bump follow-redirects from 1.16.1 to 1.16.2 (#28364)
  • deps: bump ip-address from 10.7.3 to 10.7.5 (#28243)
  • deps: bump body-parser from 1.20.8 to 1.20.9 (#28247)
  • deps: bump @graphql-tools/utils from 12.0.1 to 12.0.2 (622da2424f)
  • deps: bump minimatch from 10.2.5 to 10.2.6 (#28387)
  • deps: bump undici from 8.12.3 to 8.12.4 (#28491)
  • deps: bump @graphql-tools/utils from 12.0.2 to 12.0.3 (#28490)
  • deps: update Playwright to 1.64.1 and CI to the latest Ubuntu (#28405)
  • e2e: run Chromium only by default locally (02a09e4471)
  • tests: remove misleading dead code from the test setup (aaeabf6e59)
  • tests: scaffold the /tests-next workspaces (5c9c852ce4)
  • tests: lock the tests-shared workspace dependencies (d717b75601)
  • tests: exclude /tests-next from the Sonar analysis, like /tests (699d1452c7)
  • tests: lint /tests-next at commit time and in lint_oxlint (710c3e5a36)
  • upload: read the upload provider once in the provider service (#28536)

💅 Enhancement

  • utils: walk nested populate once per level (#28157)

🚨 Security

  • document admin-configured webhook destinations as a specific exclusion (#28543)

❤️ Thank You

Check out latest releases or
releases around @strapi/strapi 5.62.0

Don't miss a new strapi release

NewReleases is sending notifications on new releases.

Get notifications