This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+12 more
ReleasePort's take
Moderate signalStrapi v4 reaches end of life with v5.46 release. The update adds media preview capabilities and fixes stability issues across admin, database, and API layers.
Why it matters: v4 end of life requires migration planning. v5.46 adds media preview, fixes telemetry blocking, and strengthens database stability. Upgrade now to maintain support.
Summary
AI summaryAdded preview support for images and videos in Strapi.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | Medium |
Strapi v4 marked as End of Life Strapi v4 marked as End of Life Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Add preview support to images and videos Add preview support to images and videos Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Replace sendmail package with nodemailer in email provider Replace sendmail package with nodemailer in email provider Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Add possibility to customize blocks in content-manager Add possibility to customize blocks in content-manager Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add concurrentUploadSize config for upload control Add concurrentUploadSize config for upload control Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add close button for trial banner Add close button for trial banner Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Add collapse button Add collapse button Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Dependency | Medium |
Migrate MSW from 1.x to 2.13.4 in admin test suites Migrate MSW from 1.x to 2.13.4 in admin test suites Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Performance | Medium |
Remove await from telemetry calls to prevent blocking Remove await from telemetry calls to prevent blocking Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Resolve prism is not defined error in admin Resolve prism is not defined error in admin Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Handle 204 no-content responses in fetch client Handle 204 no-content responses in fetch client Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Skip draft and modified count queries for non-D&P content types Skip draft and modified count queries for non-D&P content types Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Keep draft link on x-to-one relations from non-D&P to D&P Keep draft link on x-to-one relations from non-D&P to D&P Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Morph typeField wins over same-name fields in populate Morph typeField wins over same-name fields in populate Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Isolate root query args per root field in GraphQL Isolate root query args per root field in GraphQL Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Use injected strapi instance in validation Use injected strapi instance in validation Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Append primary key to ORDER BY for paginated selects Append primary key to ORDER BY for paginated selects Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Throw ValidationError for all invalid query params Throw ValidationError for all invalid query params Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Auto-expand and scroll to newly added dynamic zone components Auto-expand and scroll to newly added dynamic zone components Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Make schema hash deterministic by sorting tables Make schema hash deterministic by sorting tables Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Add isValid and translations for UI elements Add isValid and translations for UI elements Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Fix admin and content API tokens retro-compatibility Fix admin and content API tokens retro-compatibility Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Update local-storage when filters are removed Update local-storage when filters are removed Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Fix long component names overflow in dynamic zone picker Fix long component names overflow in dynamic zone picker Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Improve button float styling behavior Improve button float styling behavior Source: llm_adapter@2026-05-21 Confidence: low |
— |
Full changelog
5.46.0 (2026-05-13)
🚀 New feature
- close button for the trial banner (3fd5f9fd56)
- adding collapse button (901465b1e2)
- updating design after Claude comments (d1cb08f76e)
- getting that button to stick while the banner doesn't (f04fe97a75)
- add preview support to images and videos (#25216)
- content-manager: add possibility to customize blocks (#22063)
- email: replace sendmail package with nodemailer in provider (#25893)
🔥 Bug fix
- making button float better (c5396f1c18)
- using isValid & adding translations (59498861f7)
- auto-expand and scroll to newly added dynamic zone components (#26044)
- keep draft link on x-to-one relations non-dp to dp (#26179)
- long component names overflow in dynamic zone picker (#26010)
- remove await from several telemetry calls to prevent blocking (#24743)
- admin: resolve prism is not defined (#25660)
- admin: handle 204 no-content response in fetch client (#25416)
- content-manager: local-storage was not updated if filters were removed (#26240)
- content-manager: skip draft/modified count queries for non-D&P content types (#26049)
- core/admin: admin and content api tokens retro-compatibility (#26313)
- core/core: validation uses injected strapi instance (#26211)
- database: morph typeField wins over same-name fields in populate (#26120)
- database: append primary key to ORDER BY for paginated selects (#26032)
- db: deterministic schema hash by sorting tables before hashing (#26202)
- graphql: isolate root query args per root field (#26178)
- test: check button attribute differently (#26212)
- utils: throw ValidationError for all invalid query params (not just sort) (#25894)
⚙️ Chore
- adding translations for the banner (e696d94627)
- turkish translations for cloud (#26223)
- .github: bump CI runners to node 24 (#26231)
- ai: ignore .agents/local-skills and .agents/local-state for local only harness (#26276)
- deps: bump eslint-plugin-react (#26227)
- deps: migrate msw 1.x → 2.13.4 across admin test suites (#26065)
- deps: upgrade typedoc to 0.28.19 and related plugins (#26082)
- security: mark Strapi v4 as End of Life (#26162)
- upload: add concurrentUploadSize config (#26053)
❤️ Thank You
- Alanderson Zelindro da Rosa
- Andrei L @unrevised6419
- Anslem @ace2016
- Ben Irvin
- Christian Dreier
- DMehaffy
- Florent Baldino @Baldinof
- guoyangzhen
- Jamie Howard @jhoward1994
- markkaylor
- mathildeleg @mathildeleg
- Nico André
- Nicolò
- ozzy @ddoemonn
- Rémi de Juvigny @remidej
- Simen @Eventyret
- Simon Norris
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Strapi
The most advanced open-source Content Management Framework (headless-CMS) to build powerful API with no effort.
Beta — feedback welcome: [email protected]