What strapi/strapi shipped
Written by FoxPlug from the repository's own releases; not affiliated with Strapi. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/strapi/strapi; Strapi did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Content Manager component fields gain a Use existing content flow that copies a component from another entry of the same content type or from the last saved version of the current entry. Pull request #26611
- The upload API now accepts an entry documentId as refId when uploading files, so media can be linked by documentId as well as numeric id. Pull request #28347
- Strapi develop now destroys the loaded instance when a TypeScript compile error occurs, stopping the app before it waits for a fix. Pull request #28473
- Type generation sorts attribute names and object literal keys with a fixed English collation instead of the machine locale. Pull request #28460
- Changing a component uid now rewrites stored uid values in the component join tables and polymorphic columns, keeping entries and media attached. Pull request #28398
- Deleting an entry no longer modifies releases that are already published; release lookups and action deletes only target releases with releasedAt null. Pull request #28169
- Startup now fails when a route references a policy or middleware registered without a handler function. Pull request #28463
- Telemetry requests now abort after one second with an abort signal created per request, since native fetch ignored the previous timeout option. Pull request #28171
- Boolean attribute filters now cast strictly, accepting booleans, 1 and 0, and the strings true, t, 1, false, f and 0 in any case, and throwing InvalidBooleanError otherwise. Pull request #28172
- With audit logs licensed but admin.auditLogs.enabled set to false, the admin hides the audit logs settings link, page and related entry points. Pull request #28413
Why it matters
This week brings a new way to reuse existing components in the Content Manager and lets uploads reference entries by documentId. It also fixes several cases that could surprise people in production: published releases being rewritten on entry deletion, component uid changes orphaning data, and telemetry requests hanging past their intended timeout. Type generation output is now consistent across machines, which matters for teams whose generated files end up in version control.
Changelog entry
- Content Manager: copy existing components into component fields via a Use existing content flow. Pull request #26611
- Upload: accept an entry documentId as refId when uploading files. Pull request #28347
- Strapi develop: stop the app when the TypeScript compile fails after load. Pull request #28473
- Type generation: sort attribute names and object keys with a fixed English collation. Pull request #28460
- Content-Type Builder: rewrite stored uids when a component uid changes, keeping entries and media. Pull request #28398
- Content Releases: deleting an entry no longer rewrites published releases. Pull request #28169
- Core: fail at startup when a policy or middleware module has no handler. Pull request #28463
- Telemetry: abort requests after one second using a per-request abort signal. Pull request #28171
- Database: boolean filters cast strictly and reject unrecognised values with InvalidBooleanError. Pull request #28172
- Admin: hide audit logs entry points when admin.auditLogs.enabled is false. Pull request #28413
- Create-strapi-app: default the sqlite file to.tmp/data.db when --dbfile is omitted. Pull request #28467
- Upload: media library folder sidebar can scroll to its last folder. Pull request #28449
This week: a Use existing content flow for component fields in the Content Manager, uploads that accept a documentId as refId, and strapi develop now stops the app on a TypeScript compile error. Also: stable type generation sorting, fixes for published releases on entry delete, a
Changes this week in Strapi: Content Manager component fields gain a Use existing content flow that copies a component from another entry or from the last saved version of the current entry. Uploads now accept an entry's documentId as refId, so media can be linked by documentId as well as numeric id. strapi develop now stops the app when a TypeScript compile error occurs. Type generation sorts keys with a fixed English collation, so output no longer depends on the machine. Component uid changes rewrite stored uids in join tables and polymorphic columns, keeping entries and media attached. Deleting an entry no longer modifies already published releases.
Week of October 26, 2026
What shipped
- Version 5.53.0 was released with a security fix; details of the vulnerability and its patch are withheld so users have time to upgrade before disclosure. Release
- Version 5.60.0 was released with SSO settings updates recorded in audit logs and webhook entry events that can be selected per content type. Release
- The rich text editors now use the new asset picker and support dropping images directly into the editor. Pull request #28176
- The Content Manager media field now opens the Media Library asset details drawer instead of the legacy edit dialog. Pull request #28283
- Collection types gain a native custom order for their entries behind the unstableCustomOrder future flag, with a toggle in Configure the view. Pull request #27935
- Audit logs now record content history restores, discarded drafts, project and media settings updates, and media events use the standard payload. Pull request #28178
- Custom entry ordering for collection types is available behind the unstableCustomOrder future flag. Pull request #27935
- The release details page now shows what happened to each entry before and after a release runs. Pull request #28282
- A side panel lets users create a new release from the entries a partial or failed release skipped. Pull request #28212
- The releases page lists pending and released releases together in one paginated, filterable and sortable table. Pull request #28254
Why it matters
This week brings two releases, including a security fix whose details are held back so users can upgrade first, and new admin features for webhooks and audit logs. Content Releases gets a reworked details page and a way to create a release from skipped entries, while the rich text editors adopt the new asset picker. The Content Type Builder also receives several fixes around schema options, kind changes and single type conversion guards.
Changelog entry
- Release 5.53.0, including a security fix whose details are delayed until users can upgrade. Release
- Release 5.60.0 with SSO settings audit logs and per content type webhook entry events. Release
- Rich text editors use the new asset picker and support image drop. Pull request #28176
- Content Manager media field opens the Media Library asset details drawer. Pull request #28283
- Native custom order for collection type entries behind the unstableCustomOrder flag. Pull request #27935
- Audit logs for content history restores, discarded drafts, project and media settings updates. Pull request #28178
- Releases page lists, filters and sorts releases in one paginated table. Pull request #28254
- Release details page shows what happened to each entry before and after a release. Pull request #28282
- Create a release from the entries a partial or failed release skipped. Pull request #28212
- Optional document input attributes now accept null, except repeatable components and dynamic zones. Pull request #27902
- Node 20 is dropped from runtime and tooling support declarations. Pull request #26631
- Content Manager edit view performance improved on large content types. Pull request #27994
Strapi 5.53.0 and 5.60.0 are out, including a security fix we are not detailing yet so you can upgrade first. Also this week: a new asset picker in the rich text editors, a reworked release details page, and audit logs for settings and media events.
Two Strapi releases shipped this week: 5.53.0, which includes a security fix whose details are deliberately withheld until users have time to upgrade, and 5.60.0, which records SSO settings updates in audit logs and lets webhook entry events be selected per content type. The rich text editors now use the new asset picker and accept image drops, and the Content Manager media field opens the asset details drawer instead of the legacy dialog. Content Releases gained a reworked details page and a side panel that creates a new release from the entries a partial or failed release skipped.
Week of October 19, 2026
What shipped
- Webhooks can now listen to entry events for specific content types, with content types listed under the Entry row in the webhook form. Pull request #27931
- A new endpoint creates a planned release from the entries a partial or failed release skipped. Pull request #28160
- Releases whose run will never happen are now frozen as Failed instead of staying Pending with a past date. Pull request #28124
- The media field opens a new asset picker built on the Media Library list, replacing the legacy asset dialog. Pull request #28091
- The Content Manager media field now shows status-aware rows and cards for uploads started from the field. Pull request #28080
- OpenAPI generation now includes meta in content-API response schemas such as collection find. Pull request #28114
- Saving Single Sign-On settings now writes an sso-settings.update row to the audit log with the options that changed. Pull request #28135
- Server-side changes reduce the number of database queries for entries with many relations and components. Pull request #28092
- Document middleware and lifecycle subscriber removers now only remove an entry that is actually registered. Pull request #28047
- The preview URL endpoint now validates status against the shared schema and accepts only draft and published. Pull request #28148
Why it matters
This week brings targeted fixes across upload, admin, core and content releases, including listener removal, preview URL validation and bootstrap handling. It also adds features developers can use directly: per-content-type webhook events, a new asset picker in the media field, and creating a release from skipped entries. Reliability work on relations and release statuses keeps stored data and admin state consistent.
Changelog entry
- Feat(webhooks): select entry events per content type Pull request #27931
- Feat(content-releases): create a release from skipped entries of a partial or failed release Pull request #28160
- Feat(content-releases): freeze overdue releases as Failed Pull request #28124
- Enhancement(upload): add new content manager asset picker Pull request #28091
- Enhancement(upload): show status-aware rows and cards in the media field Pull request #28080
- Fix(core): include meta in OpenAPI content-API response schemas Pull request #28114
- Fix(core): document middleware and lifecycle subscriber removers remove the wrong entry Pull request #28047
- Fix(core): event hub off() and once() remove the wrong listener Pull request #28051
- Fix(content-manager): preview URL accepts any status string Pull request #28148
- Fix(admin): admin user updates and deletes crash when the super admin role does not exist Pull request #28149
- Feat(admin): record SSO settings updates in audit logs Pull request #28135
- Enhancement: fewer database queries per relation field and per write on relation-heavy entries Pull request #28092
This week: per-content-type webhook events, create a release from skipped entries, overdue releases frozen as Failed, a new asset picker in the media field, and fixes for event hub listeners, preview URL validation and admin user updates.
This week in the repository: webhooks can now listen to entry events for specific content types, and a new endpoint creates a planned release from the entries a partial or failed release skipped. Overdue releases are frozen as Failed instead of sitting in Pending with a past date. The Content Manager media field gets a new asset picker and status-aware rows and cards. On the fix side, document middleware and lifecycle subscriber removers only remove registered entries, the event hub stops removing the wrong listener, admin user updates no longer crash when the super admin role is missing, and the preview URL endpoint accepts only draft and published. Server-side query work also reduces database reads for entries with many relations.
Week of October 12, 2026
What shipped
- Publishing an entry linked from a widely reused component no longer takes minutes, after two cost fixes in how document-service decides which component relations carry over to the new entry version. Pull request #27942
- Postgres and MySQL connections acquired when a connection function is used are now released instead of being held forever, with the SQLite branch unchanged. Pull request #27979
- Each release run now stores how many entries it published, unpublished and skipped, as nullable integers written with the run status inside its lock transaction. Pull request #28077
- A release whose run released nothing is now frozen as failed, so it no longer stays in Pending and can no longer be edited back into a ready or blocked state. Pull request #28040
- Each release action of a planned release now stores why its entry is not publishable, next to the existing boolean, instead of discarding the reason. Pull request #28048
- Bulk deleting a non-localized entry now removes it from its releases instead of leaving it listed in the release UI. Pull request #28023
- Admin auth cookies now get paths matching who reads them, with the non-httpOnly access cookie defaulting to the path from admin.url rather than a shared /admin path. Pull request #27619
- The upload image-manipulation service now passes the limitInputPixels setting into every sharp instance it creates, for both file-path and stream inputs. Pull request #27161
- Content Manager now registers an attribute-rename handler that rewrites stored list and edit layouts, metadata keys, labels, mainField and defaultSortBy in place when a rename migration runs. Pull request #28036
- A failed post-commit event emit in the document service is now caught and logged instead of becoming an unhandled rejection that kills the process. Pull request #28017
Why it matters
This week fixes two performance and resource problems that hit busy projects: slow publishing for entries tied to widely reused components, and database pool connections held forever on Postgres and MySQL. Release management also gains more detail, with stored publish, unpublish and skip counts per run, stored reasons an entry is not publishable, and failed releases frozen as failed. Smaller fixes tighten admin token limits, media field behavior and review workflow panels.
Changelog entry
- Fix slow publishing for entries linked from widely reused components. Pull request #27942
- Release the connection acquired by a connection function on Postgres and MySQL. Pull request #27979
- Store published, unpublished and skipped entry counts on each release run. Pull request #28077
- Freeze a release whose run released nothing as failed. Pull request #28040
- Store why a planned release entry is not publishable. Pull request #28048
- Remove bulk-deleted non-localized entries from their releases. Pull request #28023
- Derive admin auth cookie paths from admin.url. Pull request #27619
- Honor the sharp limitInputPixels setting in image manipulation. Pull request #27161
- Keep list columns when an attribute is renamed. Pull request #28036
- Catch and log failed post-commit event emits in the document service. Pull request #28017
- Reject token names and descriptions longer than 255 characters. Pull request #28004
- Hide the review workflow panel on the published tab and in live preview. Pull request #28009
A busy week for the project: publishing entries linked from widely reused components is fast again, database connections are released on Postgres and MySQL, and releases now record what a run published, unpublished and skipped.
Two fixes land for teams running busy projects: publishing an entry linked from a widely reused component no longer takes minutes, and Postgres and MySQL connections are no longer held forever. Release management gives more detail too, each run now stores how many entries it published, unpublished and skipped, a planned release records why an entry is not publishable, and a release whose run released nothing is frozen as failed. Alongside these, bulk deleting a non-localized entry now removes it from its releases, admin auth cookies get paths matching who reads them, and a failed post-commit event emit is logged instead of killing the process.
Week of October 5, 2026
What shipped
- The CLI gained a strapi enterprise install command that installs or upgrades Enterprise plugins without manually configuring a private registry. Pull request #27849
- Content Releases now have a per-release publishMode field with
release_all_approvedandwait_for_allvalues, defaulting towait_for_all. Pull request #27894 - Renaming an attribute in the Content-Type Builder now preserves data through guarded rename migrations, and schema-sync no longer drops renamed columns. Pull request #26749
- Field conditions in the Content-Type Builder now follow attribute renames instead of pointing at the old name. Pull request #27953
- Failed admin logins, including SSO, and SSO auto-registration are now recorded in the audit log. Pull request #27930
- Settings Overview gained cards for License details on Growth and Enterprise plans and a Support debug dump. Pull request #27034
- Build and develop now load their implementation inside the command action, so the admin build toolchain is no longer loaded on every CLI command. Pull request #27910
- The lockfile now resolves a single qs 6.16.0 across express, body-parser and other dependencies. Pull request #27870
- The legacy media library Cancel action now aborts the in-flight upload or asset edit instead of leaving it running. Pull request #27896
- Relation field search options no longer share cached results across component instances, since the cache key includes id, locale and status. Pull request #27732
Why it matters
This week brings two features that change day-to-day work: data-preserving attribute renames in the Content-Type Builder and a CLI command for installing Enterprise plugins, alongside a per-release publishMode for Content Releases. It also adds audit log coverage for failed admin logins and SSO auto-registration, plus license and support cards in Settings Overview. A set of smaller fixes tightens the media library, i18n tooltips, relation search caching and admin password strength feedback.
Changelog entry
- Add strapi enterprise install command to install or upgrade Enterprise plugins. Pull request #27849
- Add publishMode to Content Releases with
release_all_approvedandwait_for_all, defaulting towait_for_all. Pull request #27894 - Preserve data when renaming attributes in the Content-Type Builder via guarded rename migrations. Pull request #26749
- Make Content-Type Builder field conditions follow attribute renames. Pull request #27953
- Record failed admin logins and SSO auto-registration in the audit log. Pull request #27930
- Add License details and Support debug dump cards to Settings Overview. Pull request #27034
- Stop loading the admin build toolchain on every CLI command. Pull request #27910
- Resolve every qs copy in the lockfile to 6.16.0. Pull request #27870
- Make the legacy media library Cancel action abort in-flight uploads and asset edits. Pull request #27896
- Fix relation field options being shared across component instances. Pull request #27732
- Add the Strapi version to admin telemetry events. Pull request #27922
- Fix the i18n globe tooltip displaying object object. Pull request #27890
This week: strapi enterprise install in the CLI, data-preserving attribute renames in the Content-Type Builder, publishMode on Content Releases, audit logs for failed admin logins and SSO auto-registration, and License plus Support cards in Settings Overview.
This week in the repository: a new strapi enterprise install command installs or upgrades Enterprise plugins without hand-configuring a private registry. Content Releases gained a per-release publishMode with release_all_approved and wait_for_all, defaulting to wait_for_all. Renaming an attribute in the Content-Type Builder now preserves data through guarded rename migrations, and field conditions follow renames. Failed admin logins and SSO auto-registration are recorded in the audit log, and Settings Overview now has License details and Support debug dump cards. Smaller fixes cover media library cancel aborting in-flight uploads, relation search cache keys, i18n globe tooltips and reset password strength feedback.
Week of September 28, 2026
What shipped
- Version 5.56.0 released with audit logging for admin accounts, webhooks, and review workflows. Release
- Service type checking now available behind typescript.strictTypes flag for stricter type safety on strapi.service() calls. Pull request #27859
- Vite upgraded to patch a server.fs.deny bypass vulnerability on Windows. Pull request #27860
- Admin panel can now compile Tailwind from a single host stylesheet when unstableNextDesignSystem flag is enabled. Pull request #27550
- Core localization capability added so i18n behavior is accessed through strapi.localization instead of plugin methods. Pull request #27806
- Media Library image editor gains rotate left and rotate right buttons alongside existing crop and focal point tools. Pull request #27714
- Right-click context menu added to media library folders and list items for easier asset management. Pull request #27816
- Documentation plugin fixed to prevent memory exhaustion when generating relation schemas for content-type graphs. Pull request #27780
- Upload plugin content API now accepts documentId in addition to numeric id for file endpoints. Pull request #27834
- Validation error messages now explain why status and publicationFilter cannot be used in nested populate queries. Pull request #27857
Why it matters
This release stabilizes core architecture with stronger type safety for services and a security fix for Windows deployments. Several quality-of-life improvements across the media library, audit logging, and content management reduce friction for developers and administrators managing assets and workflows.
Changelog entry
- 5.56.0 released Release
- Service types now strict behind typescript.strictTypes flag Pull request #27859
- Vite upgraded to 6.4.3 for GHSA-fx2h-pf6j-xcff security fix Pull request #27860
- Admin panel Tailwind compilation available via unstableNextDesignSystem flag Pull request #27550
- Strapi.localization core capability added Pull request #27806
- Media Library image editor rotate functionality Pull request #27714
- Right-click context menu for media library folders and items Pull request #27816
- Documentation plugin relation schema generation optimized Pull request #27780
- Upload content API accepts documentId parameter Pull request #27834
- Relation field loading behavior improved in content manager Pull request #27682
- Audit logging for review workflows and stages Pull request #27814
- Better validation error messages for nested populate restrictions Pull request #27857
5.56.0 ships stricter service types, Vite security patch for Windows, and better media library workflows. Plus audit logging for webhooks and review workflows.
Strapi 5.56.0 is here. We patched a Vite vulnerability, added TypeScript type checking for services, improved media library interactions with right-click menus and image rotation, and expanded audit logging to webhooks and review workflows. New projects can also opt into unified Tailwind compilation for the admin panel.
Week of September 21, 2026
What shipped
- The new Media Library exits beta and becomes the plugin's default, with the previous version moved to legacy. Pull request #27666
- Content type folders let developers organize collection and single types in the Content-Type Builder and Content Manager. Pull request #27419
- Admin account and password actions are now recorded in audit logs with standard payload shape instead of legacy user logs. Pull request #27748
- Version 5.55.0 shipped with token management in audit logs, content type folders, and fixes for AI endpoints and SSO. Release
- Version 5.55.1 hotfix reverted a documentation plugin change that caused performance drops in projects. Release
- UpdateMany now respects _q and filter parameters instead of ignoring them. Pull request #27769
- Folder deletion in Media Library now checks authorization on all assets before removing them. Pull request #27654
- Create-relation-on-the-fly modal no longer leaks state into the background entry or loses unsaved changes. Pull request #27674
- Pull requests now require an explicit QA label (qa-done or qa-skipped) to merge. Pull request #27464
- Content-Type Builder edit modal now properly clears stale folder field state when closing. Pull request #27770
Why it matters
The new Media Library goes live as the default, content type folders bring better organization for developers, and audit logging expands to cover admin account changes. Multiple fixes address state management issues, authorization checks, and query parameter handling that affect content management workflows.
Changelog entry
- Feat(upload): promote the new media library out of future/ Pull request #27666
- Feat(admin): content type folders Pull request #27419
- Feat(admin): record admin account and password actions in audit logs Pull request #27748
- Fix(database): updateMany now respects _q and filters Pull request #27769
- Fix(upload): folder deletion checks authorization before removing assets Pull request #27654
- Fix(content-manager): relation-on-the-fly modal no longer leaks state Pull request #27674
- Fix(content-type-builder): clear stale folder field in edit modal Pull request #27770
- Fix(content-manager): disable create-relation option for Single Type targets Pull request #27717
5.55.0 ships with content type folders, expanded audit logging for admin accounts, and the new Media Library becomes default. 5.55.1 hotfix addresses a performance regression.
Strapi 5.55.0 is here: the revamped Media Library exits beta as the default, content type folders let you organize collection and single types, admin account actions are now tracked in audit logs, and AI endpoint handling is fixed. A quick 5.55.1 hotfix follows for projects using the documentation plugin.
Week of September 14, 2026
What shipped
- The redesigned Media Library is now the default for everyone in version 5.54.0 after months of development. Release
- The beta notice has been removed from the new Media Library's asset list. Pull request #27667
- The Media Library grid now displays more columns on wider screens by using an intrinsic track list instead of fixed breakpoints. Pull request #27711
- The Media Library now works for roles without settings.read permission by gating GET /upload/settings on plugin::upload.read instead. Pull request #27687
- Private upload providers now store unsigned URLs in richtext and blocks fields to avoid presigned URL expiration issues. Pull request #27593
- API token, admin token and transfer token management events are now recorded in audit logs. Pull request #27605
- Expired access tokens no longer trigger a logout; the next request now refreshes the token transparently. Pull request #27424
- The document-id migration for large localized tables has been optimized to complete in minutes instead of hours. Pull request #27404
- Custom GraphQL resolvers now correctly preserve draft-and-publish relations instead of returning null. Pull request #27462
- An interface for registering custom AI providers has been added with an implementation for generated translations in the i18n plugin. Pull request #27563
Why it matters
The new Media Library is now default, bringing performance improvements and broader permission support. Several fixes address long-standing issues with relations, authentication, and large migrations. Token audit logging and custom AI providers add operational visibility and extensibility.
Changelog entry
- Media Library is now the default for all users in v5.54.0 Release
- Media Library grid displays more columns on wider screens Pull request #27711
- Media Library read access now uses plugin::upload.read instead of plugin::upload.settings.read Pull request #27687
- Private upload providers now store unsigned URLs in richtext and blocks fields Pull request #27593
- Admin editor performance improved by suppressing MISSING_TRANSLATION errors in IntlProvider Pull request #26108
- Added audit log events for API token, admin token and transfer token create, update, delete and regenerate actions Pull request #27605
- Expired access tokens no longer trigger logout; tokens refresh transparently on next request Pull request #27424
- Document-id migration for large localized tables optimized from hours to minutes Pull request #27404
- Custom GraphQL resolvers now correctly preserve draft-and-publish relations Pull request #27462
- Added interface for registering custom AI providers Pull request #27563
- Fixed updateMany with relation filter subqueries Pull request #26909
- Fixed Koa response helper types missing in consumer projects Pull request #27380
- Fixed stream buffering to handle UTF-8 string chunks with multibyte characters Pull request #27700
- Time fields no longer expose native browser time picker Pull request #27632
- Saved list sort preferences no longer reset on base-route navigation Pull request #27663
- Create-on-the-fly modal now prefills inverse relations with parent document Pull request #27636
5.54.0 ships the redesigned Media Library as default. Plus: faster large migrations, fixed relations, token audit logs, and custom AI provider support.
Strapi 5.54.0 is live with the redesigned Media Library now default for everyone. This release includes major improvements: faster document-id migrations on large tables, fixed custom GraphQL resolvers with draft-and-publish relations, access token refresh without logout, audit logging for token management, and a new interface for custom AI providers. The Media Library also works better for roles without full settings access and stores unsigned URLs properly in richtext fields.