4.18.0

medusajs/medusa4.18.0Jul 15, 2026by HFO4

AI Summary

A feature update introducing one-click recycle bin emptying, pinned shared folders, and critical security fixes.

Key Highlights

New one-click empty recycle bin feature
New Pro feature to pin shared folders or files to the sidebar
Fixed multiple security vulnerabilities
Fixed thumbnail generation issues via share links
Fixed upload failures related to local storage policy

New Features

One-click empty recycle bin
Pin shared folders/files
Config separator support for environment variables

Full Release Notes

* New: One-click empty recycle bin (#3473)
  * <details>
     <summary>
      Details
     </summary>
     
     <img width="678" height="304" alt="image" src="https://github.com/user-attachments/assets/614b598e-c8dd-407a-ac2e-97479f4d94b2" />

     </details>
* New: [Pro] Pin shared folders or files to a user's sidebar via group settings
  * <details>
     <summary>
      Details
     </summary>

     
     <img width="1218" height="562" alt="image" src="https://github.com/user-attachments/assets/73ed4658-be2c-463d-b764-620b8d3674aa" />

     </details>
* New: Optionally use `__` as the separator when overriding configuration items with environment variables (#3498)
* Improved: Automatically clear the input after an incorrect CAPTCHA entry (cloudreve/frontend#343 @jcbl1)
* Fixed: [Community Edition] Thumbnails could not be generated when accessed via share links (#3495)
* Fixed: Uploads failed on the local storage policy after enabling parallel chunked uploads
* Fixed: Multiple security vulnerabilities. Full details will be disclosed after 30 days. Thanks to @newugly, @de3erve-hunter, and @tonghuaroot for reporting.