v5.52.2

5.52.2 (2026-08-26)

🔥 Bug fix

• make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
• admin: out of sort memory when listing audit logs on mysql (#27410)
• admin: send credentials on fetch client requests (#27413)
• admin: keep api token permissions on localized content types at boot (#27420)
• admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
• admin: slow startup with many roles due to redundant permission … (#27438)
• content-manager: draft status filter with i18n sibling locale published (#26835)
• content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
• content-manager: out of sort memory when listing history versions on mysql (#27394)
• core: Access token rotation fails with asymmetric JWT algorithms (#27201)
• core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
• core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
• database: relation reorder saves the wrong position (#27444)
• i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
• permissions: surface clear error for unsupported RBAC condition operators (#27355)
• plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
• upload: translate server error codes in the new media library (#27345)
• upload: sizeLimit is not enforced when replacing a file (#27414)
• upload: move replace media to the drawer footer, add tooltips (#27425)
• upload: list queued files in the upload progress dialog (#27416)
• upload: merge a second drop into the running upload batch (#27415)

⚙️ Chore

• replace lodash forEach with native Object.entries/values (#27409)
• add worktree bootstrap command (#27426)
• deps: upgrade memfs to 4.68.1 in @strapi/upgrade (#27406)
• deps: migrate first-party zod to 4.4.3 (#27428)

💅 Enhancement

• data-transfer: clarify partial transfer stage scope (#27322)
• database: log internal migrations at info level (#27324)
• database: add migration progress heartbeats (#27325)

🚨 Security

• graphql: warn about unbounded operation limits (#27390)
• upload: deny svg in generated project defaults (#27360)

⚠️ Changes to be aware of

New projects block SVG uploads by default

Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)

❤️ Thank You

• Adrien L @Adzouz
• Andrei L @unrevised6419
• Ayoub Hidri @ayhid
• Bassel Kanso
• Ben Irvin
• DMehaffy
• Eliau Elkouby @eliau2005
• Giulio Montagner @giu1io
• jasleenkaur-qed42 @jasleenkaur-qed42
• keke @kekekuli
• Lazizbek Ergashev @lazerg
• Merlijn van den Berg
• Nico André
• Omar MEBARKI
• Rohit Singh @HitOP2509
• Samran Asif @webdevsamran
• Ziyi @butcherZ