Traceary

Catalog / Strapi

5.52.2

todaysecurityaddedOriginal notes

5.52.2 (2026-08-26)

✨ New Media Library (opt-in beta)

A complete revamped Media Library UI is available behind a feature flag. Set future.betaMediaLibrary: true in config/features and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs (https://docs.strapi.io/cms/features/media-library)

Feedback while it's behind the flag is very welcome. Enjoy!

🔥 Bug fix

  • make drag and drop more fluently in configuation view fix#23161 (#26320, #23161)
  • admin: out of sort memory when listing audit logs on mysql (#27410)
  • admin: send credentials on fetch client requests (#27413)
  • admin: keep api token permissions on localized content types at boot (#27420)
  • admin: honour redirectTo when the auth page redirects an authenticated user (#27213)
  • admin: slow startup with many roles due to redundant permission … (#27438)
  • content-manager: draft status filter with i18n sibling locale published (#26835)
  • content-manager: reject MCP relation writes combining set with connect or disconnect (#27423)
  • content-manager: out of sort memory when listing history versions on mysql (#27394)
  • core: Access token rotation fails with asymmetric JWT algorithms (#27201)
  • core: serialize JSON columns before INSERT in discard-drafts migration (#25927)
  • core/strapi: local plugins duplicate the admin module graph and exhaust build memory (#27311)
  • database: relation reorder saves the wrong position (#27444)
  • i18n: correct broken placeholders in pt-BR translations (#27257, #27383)
  • permissions: surface clear error for unsupported RBAC condition operators (#27355)
  • plugins: admin build fails to resolve @strapi/admin under isolated node_modules (#27337)
  • upload: translate server error codes in the new media library (#27345)
  • upload: sizeLimit is not enforced when replacing a file (#27414)
  • upload: move replace media to the drawer footer, add tooltips (#27425)
  • upload: list queued files in the upload progress dialog (#27416)
  • upload: merge a second drop into the running upload batch (#27415)

⚙️ Chore

  • replace lodash forEach with native Object.entries/values (#27409)
  • add worktree bootstrap command (#27426)
  • deps: upgrade memfs to 4.68.1 in @strapi/upgrade (#27406)
  • deps: migrate first-party zod to 4.4.3 (#27428)

💅 Enhancement

  • data-transfer: clarify partial transfer stage scope (#27322)
  • database: log internal migrations at info level (#27324)
  • database: add migration progress heartbeats (#27325)

🚨 Security

  • graphql: warn about unbounded operation limits (#27390)
  • upload: deny svg in generated project defaults (#27360)

⚠️ Changes to be aware of

New projects block SVG uploads by default

Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config. (#27360)

❤️ Thank You

  • Adrien L @Adzouz
  • Andrei L @unrevised6419
  • Ayoub Hidri @ayhid
  • Bassel Kanso
  • Ben Irvin
  • DMehaffy
  • Eliau Elkouby @eliau2005
  • Giulio Montagner @giu1io
  • jasleenkaur-qed42 @jasleenkaur-qed42
  • keke @kekekuli
  • Lazizbek Ergashev @lazerg
  • Merlijn van den Berg
  • Nico André
  • Omar MEBARKI
  • Rohit Singh @HitOP2509
  • Samran Asif @webdevsamran
  • Ziyi @butcherZ