v5.48.1

## 5.48.1 (2026-06-17)

### 🚀 New feature

- linking to the Billing Portal ([3df113f545](https://github.com/strapi/strapi/commit/3df113f545))
- pointing Upsell Banner to Strapi Billing ([06b0c31f47](https://github.com/strapi/strapi/commit/06b0c31f47))
- add optional openapi spec route ([#26239](https://github.com/strapi/strapi/pull/26239))
- updating billing portal address ([2d3fea21ff](https://github.com/strapi/strapi/commit/2d3fea21ff))
- **openapi:** gate endpoint access with config ([#26574](https://github.com/strapi/strapi/pull/26574))
- **upload:** add paginated GET /api/upload/files/page endpoint ([#26597](https://github.com/strapi/strapi/pull/26597))

### 🔥 Bug fix

- upload returns unsigned URL on update media info ([#25195](https://github.com/strapi/strapi/pull/25195))
- widgets show error when role has no access to mainfield of ct ([#26537](https://github.com/strapi/strapi/pull/26537))
- correct IME Enter key handling in BlocksInput ([#24997](https://github.com/strapi/strapi/pull/24997))
- **admin:** return empty object for empty json body in fetch client ([#26277](https://github.com/strapi/strapi/pull/26277))
- **admin:** exclude disabled plugins from admin build ([#26448](https://github.com/strapi/strapi/pull/26448))
- **admin:** rate limit and serialize first admin registration ([#26576](https://github.com/strapi/strapi/pull/26576))
- **admin:** validate current user email updates ([#26591](https://github.com/strapi/strapi/pull/26591))
- **admin:** guard stale admin configuration ([#26625](https://github.com/strapi/strapi/pull/26625))
- **build:** build does not run install; add install-deps arg ([#26483](https://github.com/strapi/strapi/pull/26483))
- **ci:** run build:size as full command for compressed-size-action v3 ([#26556](https://github.com/strapi/strapi/pull/26556))
- **ci:** restore allowed paths-filter pin ([#26575](https://github.com/strapi/strapi/pull/26575))
- **ci:** avoid syncing CPR labels to CMS tickets ([#26648](https://github.com/strapi/strapi/pull/26648))
- **content-manager:** use ReadonlyArray for layout prop and fix Repeatable test fixture ([#26522](https://github.com/strapi/strapi/pull/26522))
- **content-manager:** raise z-index of code block language selector ([#25010](https://github.com/strapi/strapi/pull/25010), [#26324](https://github.com/strapi/strapi/pull/26324))
- **content-manager:** dedupe bulk delete document ids ([#26613](https://github.com/strapi/strapi/pull/26613))
- **content-manager:** replace sanitize-html with dompurify in Wysiwyg preview ([#26150](https://github.com/strapi/strapi/pull/26150))
- **core:** validate numeric inputs before DB unique checks ([#26101](https://github.com/strapi/strapi/pull/26101))
- **core/admin | content-manager:** combine multi-role field-level permissions ([#26055](https://github.com/strapi/strapi/pull/26055))
- **data-transfer:** skip links referencing data that was never transferred ([#26531](https://github.com/strapi/strapi/pull/26531))
- **data-transfer:** buffer push assets before invoking uploadStream ([#26086](https://github.com/strapi/strapi/pull/26086))
- **database:** restore join-table relation sort order in components ([#26553](https://github.com/strapi/strapi/pull/26553))
- **database:** avoid double finalising completed transactions ([#26122](https://github.com/strapi/strapi/pull/26122))
- **database:** move document_id secondary indexes to schema sync ([#26241](https://github.com/strapi/strapi/pull/26241))
- **strapi:** stabilize admin redux deps during upgrade ([#26249](https://github.com/strapi/strapi/pull/26249))
- **tsconfig:** remove lodash from server compilerOptions.types ([#26627](https://github.com/strapi/strapi/pull/26627))
- **upload:** folder navigation bugs in Media Library ([#26515](https://github.com/strapi/strapi/pull/26515))
- **upload:** preserve animation frames in GIF and WebP images ([#26126](https://github.com/strapi/strapi/pull/26126))
- **users-permissions:** support documentId user relations ([#26607](https://github.com/strapi/strapi/pull/26607))
- **utils:** ignore empty sort when building orderBy ([#26427](https://github.com/strapi/strapi/pull/26427))

### 📚 Documentation Changes

- add CLAUDE.md alias and link PR template from AGENTS.md ([#26251](https://github.com/strapi/strapi/pull/26251))
- fix typos across contributor docs ([#26590](https://github.com/strapi/strapi/pull/26590))
- fix broken relative cross-doc links ([#26601](https://github.com/strapi/strapi/pull/26601))
- deprecate Node 20 in documentation ([#26623](https://github.com/strapi/strapi/pull/26623))
- **openapi:** add contributor documentation ([#26410](https://github.com/strapi/strapi/pull/26410))

### ⚙️ Chore

- remove experimental-dev example app ([#26552](https://github.com/strapi/strapi/pull/26552))
- update .gitignore for AI tooling directories ([#26526](https://github.com/strapi/strapi/pull/26526))
- release v5.48.0 update develop ([#26599](https://github.com/strapi/strapi/pull/26599))
- adding check for valid template on issue creation ([#26546](https://github.com/strapi/strapi/pull/26546))
- adding translations for manage subscription ([aa0b3da3eb](https://github.com/strapi/strapi/commit/aa0b3da3eb))
- getting tests to pass ([d2c06c6ca2](https://github.com/strapi/strapi/commit/d2c06c6ca2))
- ***:** support Node 26 ([#26232](https://github.com/strapi/strapi/pull/26232))
- **ai/skills:** add writing-a-skill skill ([#26428](https://github.com/strapi/strapi/pull/26428))
- **ai/skills:** add commit conventions ([#26431](https://github.com/strapi/strapi/pull/26431))
- **ci:** drop Node 20 from test workflow matrices ([6f1a21c528](https://github.com/strapi/strapi/commit/6f1a21c528))
- **ci:** drop Node 20 from test workflow matrices ([#26609](https://github.com/strapi/strapi/pull/26609))
- **core/strapi:** dynamically import browserslist-to-esbuild ([#25507](https://github.com/strapi/strapi/pull/25507))
- **data-transfer:** move types into src so they are type-checked ([#26352](https://github.com/strapi/strapi/pull/26352))
- **deps:** bump axios from 1.16.1 to 1.17.0 ([#26539](https://github.com/strapi/strapi/pull/26539))
- **deps:** bump the testing-library group across 1 directory with 2 updates ([#26506](https://github.com/strapi/strapi/pull/26506))
- **deps:** bump actions/setup-node from 4 to 6 ([#26496](https://github.com/strapi/strapi/pull/26496))
- **deps:** bump actions/stale from 10 to 10.2.0 ([#26497](https://github.com/strapi/strapi/pull/26497))
- **deps:** bump preactjs/compressed-size-action from 2 to 3 ([#26498](https://github.com/strapi/strapi/pull/26498))
- **deps:** resolve vulnerable transitive deps via lockfile dedupe and resolutions ([#26540](https://github.com/strapi/strapi/pull/26540))
- **deps:** bump cheerio from 1.0.0 to 1.2.0 ([#26569](https://github.com/strapi/strapi/pull/26569))
- **deps:** bump dorny/paths-filter from 3.0.3 to 4.0.1 ([#26566](https://github.com/strapi/strapi/pull/26566))
- **deps:** bump actions/download-artifact from 4.3.0 to 8.0.1 ([#26564](https://github.com/strapi/strapi/pull/26564))
- **deps:** bump follow-redirects from 1.15.6 to 1.16.0 ([#26580](https://github.com/strapi/strapi/pull/26580))
- **deps:** bump shell-quote from 1.8.1 to 1.8.4 ([#26585](https://github.com/strapi/strapi/pull/26585))
- **deps:** bump @vitejs/plugin-react-swc ([#26567](https://github.com/strapi/strapi/pull/26567))
- **deps:** bump the rollup group across 1 directory with 3 updates ([#26505](https://github.com/strapi/strapi/pull/26505))
- **deps:** bump nrwl/nx-set-shas from 4 to 5 ([#26565](https://github.com/strapi/strapi/pull/26565))
- **deps:** bump anthropics/claude-code-action from 1 to 1.0.123 ([#26640](https://github.com/strapi/strapi/pull/26640))
- **deps:** bump trunk-io/analytics-uploader from 1.15.0 to 2.0.9 ([#26638](https://github.com/strapi/strapi/pull/26638))
- **deps:** bump rollup from 4.60.1 to 4.60.4 in the rollup group across 1 directory ([#26641](https://github.com/strapi/strapi/pull/26641))
- **deps:** bump open from 8.4.0 to 8.4.2 ([#26643](https://github.com/strapi/strapi/pull/26643))
- **deps:** bump stream-json and @types/stream-json ([#26645](https://github.com/strapi/strapi/pull/26645))
- **deps:** bump koa-helmet from 7.0.2 to 7.1.0 ([#26642](https://github.com/strapi/strapi/pull/26642))
- **deps:** bump axios from 1.17.0 to 1.18.0 ([#26647](https://github.com/strapi/strapi/pull/26647))
- **deps-dev:** bump the eslint group across 1 directory with 10 updates ([#26500](https://github.com/strapi/strapi/pull/26500))
- **deps-dev:** bump @types/delegates from 1.0.0 to 1.0.3 ([#26570](https://github.com/strapi/strapi/pull/26570))
- **deps-dev:** bump the nx group across 1 directory with 2 updates ([#26502](https://github.com/strapi/strapi/pull/26502))
- **deps-dev:** bump @types/webpack-hot-middleware from 2.25.9 to 2.25.12 ([#26568](https://github.com/strapi/strapi/pull/26568))
- **deps-dev:** bump @types/invariant from 2.2.36 to 2.2.37 ([#26644](https://github.com/strapi/strapi/pull/26644))
- **repo:** skip change freeze ownership check when freeze disabled ([#26474](https://github.com/strapi/strapi/pull/26474))

### 💅 Enhancement

- **admin:** hide deploy-now widget in production ([#26660](https://github.com/strapi/strapi/pull/26660))
- **core/core:** rounded thin borders for startup banner ([#26273](https://github.com/strapi/strapi/pull/26273))
- **graphql:** use discriminated unions instead of unsafe type casting ([#25913](https://github.com/strapi/strapi/pull/25913))
- **upgrade:** unhide and document upgrade to command ([#26446](https://github.com/strapi/strapi/pull/26446))

### 🚨 Security

- **deps:** patch uuid (GHSA-w5hq-g745-h8pq) and qs DoS advisories ([9aef801f35](https://github.com/strapi/strapi/commit/9aef801f35))
- **deps:** scope uuid/qs resolutions to affected descriptors ([38b6831652](https://github.com/strapi/strapi/commit/38b6831652))

### ❤️ Thank You

- Adrien L @Adzouz
- Andrei L @unrevised6419
- Andrei Varapayeu @thisavoropaev
- Arav Menon @Arav-Menon
- Aurélien GEORGET
- Ayoub Hidri @ayhid
- Bassel Kanso @Bassel17
- Ben Irvin
- Dante Calderon @dantehemerson
- DMehaffy
- Giulio Montagner @giu1io
- Jamie Howard @jhoward1994
- Jasleen Kaur @Jasleen-Kaur96
- Maksim Zhukau @MaksZhukov
- Masamune Utsunomiya @masamunet
- mathildeleg @mathildeleg
- nclsndr
- Nico André
- Pierre Levavasseur @plevavas
- Simon Norris @cache-your-dreams
- Yazan Amer Abu Obaideh @yazan-abu-obaideh
- Ziyi @butcherZ