megachangelog
Announcement5.48.1

v5.48.1

Strapi v5.48.1 introduces billing portal integration features, adds paginated file upload endpoints and OpenAPI spec support, and includes fixes for upload URLs, widget permissions, IME input handling, admin registration security, and numerous other stability improvements across content management, CI/CD, and data transfer systems.

5.48.1 (2026-06-17)

🚀 New feature

  • linking to the Billing Portal (3df113f545)
  • pointing Upsell Banner to Strapi Billing (06b0c31f47)
  • add optional openapi spec route (#26239)
  • updating billing portal address (2d3fea21ff)
  • openapi: gate endpoint access with config (#26574)
  • upload: add paginated GET /api/upload/files/page endpoint (#26597)

🔥 Bug fix

  • upload returns unsigned URL on update media info (#25195)
  • widgets show error when role has no access to mainfield of ct (#26537)
  • correct IME Enter key handling in BlocksInput (#24997)
  • admin: return empty object for empty json body in fetch client (#26277)
  • admin: exclude disabled plugins from admin build (#26448)
  • admin: rate limit and serialize first admin registration (#26576)
  • admin: validate current user email updates (#26591)
  • admin: guard stale admin configuration (#26625)
  • build: build does not run install; add install-deps arg (#26483)
  • ci: run build:size as full command for compressed-size-action v3 (#26556)
  • ci: restore allowed paths-filter pin (#26575)
  • ci: avoid syncing CPR labels to CMS tickets (#26648)
  • content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
  • content-manager: raise z-index of code block language selector (#25010, #26324)
  • content-manager: dedupe bulk delete document ids (#26613)
  • content-manager: replace sanitize-html with dompurify in Wysiwyg preview (#26150)
  • core: validate numeric inputs before DB unique checks (#26101)
  • core/admin | content-manager: combine multi-role field-level permissions (#26055)
  • data-transfer: skip links referencing data that was never transferred (#26531)
  • data-transfer: buffer push assets before invoking uploadStream (#26086)
  • database: restore join-table relation sort order in components (#26553)
  • database: avoid double finalising completed transactions (#26122)
  • database: move document_id secondary indexes to schema sync (#26241)
  • strapi: stabilize admin redux deps during upgrade (#26249)
  • tsconfig: remove lodash from server compilerOptions.types (#26627)
  • upload: folder navigation bugs in Media Library (#26515)
  • upload: preserve animation frames in GIF and WebP images (#26126)
  • users-permissions: support documentId user relations (#26607)
  • utils: ignore empty sort when building orderBy (#26427)

📚 Documentation Changes

  • add CLAUDE.md alias and link PR template from AGENTS.md (#26251)
  • fix typos across contributor docs (#26590)
  • fix broken relative cross-doc links (#26601)
  • deprecate Node 20 in documentation (#26623)
  • openapi: add contributor documentation (#26410)

⚙️ Chore

  • remove experimental-dev example app (#26552)
  • update .gitignore for AI tooling directories (#26526)
  • release v5.48.0 update develop (#26599)
  • adding check for valid template on issue creation (#26546)
  • adding translations for manage subscription (aa0b3da3eb)
  • getting tests to pass (d2c06c6ca2)
  • *: support Node 26 (#26232)
  • ai/skills: add writing-a-skill skill (#26428)
  • ai/skills: add commit conventions (#26431)
  • ci: drop Node 20 from test workflow matrices (6f1a21c528)
  • ci: drop Node 20 from test workflow matrices (#26609)
  • core/strapi: dynamically import browserslist-to-esbuild (#25507)
  • data-transfer: move types into src so they are type-checked (#26352)
  • deps: bump axios from 1.16.1 to 1.17.0 (#26539)
  • deps: bump the testing-library group across 1 directory with 2 updates (#26506)
  • deps: bump actions/setup-node from 4 to 6 (#26496)
  • deps: bump actions/stale from 10 to 10.2.0 (#26497)
  • deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
  • deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
  • deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
  • deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
  • deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
  • deps: bump follow-redirects from 1.15.6 to 1.16.0 (#26580)
  • deps: bump shell-quote from 1.8.1 to 1.8.4 (#26585)
  • deps: bump @vitejs/plugin-react-swc (#26567)
  • deps: bump the rollup group across 1 directory with 3 updates (#26505)
  • deps: bump nrwl/nx-set-shas from 4 to 5 (#26565)
  • deps: bump anthropics/claude-code-action from 1 to 1.0.123 (#26640)
  • deps: bump trunk-io/analytics-uploader from 1.15.0 to 2.0.9 (#26638)
  • deps: bump rollup from 4.60.1 to 4.60.4 in the rollup group across 1 directory (#26641)
  • deps: bump open from 8.4.0 to 8.4.2 (#26643)
  • deps: bump stream-json and @types/stream-json (#26645)
  • deps: bump koa-helmet from 7.0.2 to 7.1.0 (#26642)
  • deps: bump axios from 1.17.0 to 1.18.0 (#26647)
  • deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
  • deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
  • deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
  • deps-dev: bump @types/webpack-hot-middleware from 2.25.9 to 2.25.12 (#26568)
  • deps-dev: bump @types/invariant from 2.2.36 to 2.2.37 (#26644)
  • repo: skip change freeze ownership check when freeze disabled (#26474)

💅 Enhancement

  • admin: hide deploy-now widget in production (#26660)
  • core/core: rounded thin borders for startup banner (#26273)
  • graphql: use discriminated unions instead of unsafe type casting (#25913)
  • upgrade: unhide and document upgrade to command (#26446)

🚨 Security

❤️ Thank You

releasebillingopenapiuploadadminsecurity

Source: original entry ↗