Strapi

5.48.1 (2026-06-17)

🚀 New feature

• linking to the Billing Portal (3df113f545)
• pointing Upsell Banner to Strapi Billing (06b0c31f47)
• add optional openapi spec route (#26239)
• updating billing portal address (2d3fea21ff)
• openapi: gate endpoint access with config (#26574)
• upload: add paginated GET /api/upload/files/page endpoint (#26597)

🔥 Bug fix

• upload returns unsigned URL on update media info (#25195)
• widgets show error when role has no access to mainfield of ct (#26537)
• correct IME Enter key handling in BlocksInput (#24997)
• admin: return empty object for empty json body in fetch client (#26277)
• admin: exclude disabled plugins from admin build (#26448)
• admin: rate limit and serialize first admin registration (#26576)
• admin: validate current user email updates (#26591)
• admin: guard stale admin configuration (#26625)
• build: build does not run install; add install-deps arg (#26483)
• ci: run build:size as full command for compressed-size-action v3 (#26556)
• ci: restore allowed paths-filter pin (#26575)
• ci: avoid syncing CPR labels to CMS tickets (#26648)
• content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
• content-manager: raise z-index of code block language selector (#25010, #26324)
• content-manager: dedupe bulk delete document ids (#26613)
• content-manager: replace sanitize-html with dompurify in Wysiwyg preview (#26150)
• core: validate numeric inputs before DB unique checks (#26101)
• core/admin | content-manager: combine multi-role field-level permissions (#26055)
• data-transfer: skip links referencing data that was never transferred (#26531)
• data-transfer: buffer push assets before invoking uploadStream (#26086)
• database: restore join-table relation sort order in components (#26553)
• database: avoid double finalising completed transactions (#26122)
• database: move document_id secondary indexes to schema sync (#26241)
• strapi: stabilize admin redux deps during upgrade (#26249)
• tsconfig: remove lodash from server compilerOptions.types (#26627)
• upload: folder navigation bugs in Media Library (#26515)
• upload: preserve animation frames in GIF and WebP images (#26126)
• users-permissions: support documentId user relations (#26607)
• utils: ignore empty sort when building orderBy (#26427)

📚 Documentation Changes

• add CLAUDE.md alias and link PR template from AGENTS.md (#26251)
• fix typos across contributor docs (#26590)
• fix broken relative cross-doc links (#26601)
• deprecate Node 20 in documentation (#26623)
• openapi: add contributor documentation (#26410)

⚙️ Chore

• remove experimental-dev example app (#26552)
• update .gitignore for AI tooling directories (#26526)
• release v5.48.0 update develop (#26599)
• adding check for valid template on issue creation (#26546)
• adding translations for manage subscription (aa0b3da3eb)
• getting tests to pass (d2c06c6ca2)
• *: support Node 26 (#26232)
• ai/skills: add writing-a-skill skill (#26428)
• ai/skills: add commit conventions (#26431)
• ci: drop Node 20 from test workflow matrices (6f1a21c528)
• ci: drop Node 20 from test workflow matrices (#26609)
• core/strapi: dynamically import browserslist-to-esbuild (#25507)
• data-transfer: move types into src so they are type-checked (#26352)
• deps: bump axios from 1.16.1 to 1.17.0 (#26539)
• deps: bump the testing-library group across 1 directory with 2 updates (#26506)
• deps: bump actions/setup-node from 4 to 6 (#26496)
• deps: bump actions/stale from 10 to 10.2.0 (#26497)
• deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
• deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
• deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
• deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
• deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
• deps: bump follow-redirects from 1.15.6 to 1.16.0 (#26580)
• deps: bump shell-quote from 1.8.1 to 1.8.4 (#26585)
• deps: bump @vitejs/plugin-react-swc (#26567)
• deps: bump the rollup group across 1 directory with 3 updates (#26505)
• deps: bump nrwl/nx-set-shas from 4 to 5 (#26565)
• deps: bump anthropics/claude-code-action from 1 to 1.0.123 (#26640)
• deps: bump trunk-io/analytics-uploader from 1.15.0 to 2.0.9 (#26638)
• deps: bump rollup from 4.60.1 to 4.60.4 in the rollup group across 1 directory (#26641)
• deps: bump open from 8.4.0 to 8.4.2 (#26643)
• deps: bump stream-json and @types/stream-json (#26645)
• deps: bump koa-helmet from 7.0.2 to 7.1.0 (#26642)
• deps: bump axios from 1.17.0 to 1.18.0 (#26647)
• deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
• deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
• deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
• deps-dev: bump @types/webpack-hot-middleware from 2.25.9 to 2.25.12 (#26568)
• deps-dev: bump @types/invariant from 2.2.36 to 2.2.37 (#26644)
• repo: skip change freeze ownership check when freeze disabled (#26474)

💅 Enhancement

• admin: hide deploy-now widget in production (#26660)
• core/core: rounded thin borders for startup banner (#26273)
• graphql: use discriminated unions instead of unsafe type casting (#25913)
• upgrade: unhide and document upgrade to command (#26446)

🚨 Security

• deps: patch uuid (GHSA-w5hq-g745-h8pq) and qs DoS advisories (9aef801f35)
• deps: scope uuid/qs resolutions to affected descriptors (38b6831652)

❤️ Thank You

• Adrien L @Adzouz
• Andrei L @unrevised6419
• Andrei Varapayeu @thisavoropaev
• Arav Menon @Arav-Menon
• Aurélien GEORGET
• Ayoub Hidri @ayhid
• Bassel Kanso @Bassel17
• Ben Irvin
• Dante Calderon @dantehemerson
• DMehaffy
• Giulio Montagner @giu1io
• Jamie Howard @jhoward1994
• Jasleen Kaur @Jasleen-Kaur96
• Maksim Zhukau @MaksZhukov
• Masamune Utsunomiya @masamunet
• mathildeleg @mathildeleg
• nclsndr
• Nico André
• Pierre Levavasseur @plevavas
• Simon Norris @cache-your-dreams
• Yazan Amer Abu Obaideh @yazan-abu-obaideh
• Ziyi @butcherZ