v5.48.0 Release
Strapi v5.48.0 includes new OpenAPI spec route configuration, fixes for upload URLs, widget error handling, media library navigation, GIF/WebP animation preservation, and database transaction stability. Additionally, security patches for uuid and qs vulnerabilities, dependency updates, and various performance enhancements are included.
5.48.0 (2026-06-10)
🚀 New feature
🔥 Bug fix
- upload returns unsigned URL on update media info (#25195)
- widgets show error when role has no access to mainfield of ct (#26537)
- admin: return empty object for empty json body in fetch client (#26277)
- build: build does not run install; add install-deps arg (#26483)
- ci: run build:size as full command for compressed-size-action v3 (#26556)
- ci: restore allowed paths-filter pin (#26575)
- content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
- content-manager: raise z-index of code block language selector (#25010, #26324)
- core: validate numeric inputs before DB unique checks (#26101)
- database: restore join-table relation sort order in components (#26553)
- database: avoid double finalising completed transactions (#26122)
- upload: folder navigation bugs in Media Library (#26515)
- upload: preserve animation frames in GIF and WebP images (#26126)
- utils: ignore empty sort when building orderBy (#26427)
📚 Documentation Changes
- openapi: add contributor documentation (#26410)
⚙️ Chore
- remove experimental-dev example app (#26552)
- update .gitignore for AI tooling directories (#26526)
- deps: bump axios from 1.16.1 to 1.17.0 (#26539)
- deps: bump the testing-library group across 1 directory with 2 updates (#26506)
- deps: bump actions/setup-node from 4 to 6 (#26496)
- deps: bump actions/stale from 10 to 10.2.0 (#26497)
- deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
- deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
- deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
- deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
- deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
- deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
- deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
- deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
- repo: skip change freeze ownership check when freeze disabled (#26474)
💅 Enhancement
- core/core: rounded thin borders for startup banner (#26273)
- graphql: use discriminated unions instead of unsafe type casting (#25913)
- upgrade: unhide and document upgrade to command (#26446)
🚨 Security
- deps: patch uuid (GHSA-w5hq-g745-h8pq) and qs DoS advisories (9aef801f35)
- deps: scope uuid/qs resolutions to affected descriptors (38b6831652)
❤️ Thank You
- Andrei L @unrevised6419
- Andrei Varapayeu @thisavoropaev
- Arav Menon @Arav-Menon
- Aurélien GEORGET
- Ben Irvin
- Dante Calderon @dantehemerson
- Jamie Howard @jhoward1994
- Maksim Zhukau @MaksZhukov
- mathildeleg @mathildeleg
- Nico André
Source: original entry ↗
More from Strapi
Follow Strapi to get its new changes in your feed and email digest.
v5.58.0 Release
Strapi 5.58.0 includes new audit logging for failed admin logins and SSO auto-registration, license details in the admin panel, and numerous bug fixes across content management, upload handling, and core services. Multiple dependency updates address security advisories in axios and handlebars.
v5.57.0 Release
Strapi 5.57.0 introduces new CLI enterprise install command, preserves data when renaming attributes, records workflow actions in audit logs, and fixes numerous bugs across admin, content manager, media library, and core components including performance improvements and security patches.
v5.56.0
Strapi 5.56.0 adds audit logging for admin account and password actions, improves webhook auditing, and fixes multiple bugs in content management and relations. This release also updates dependencies, enhances the upload module with custom AI provider support, and includes various UI and performance improvements.