v5.50.0

## 5.50.0 (2026-07-02)

### 🚀 New feature

- **admin:** add active devices session management ([#26628](https://github.com/strapi/strapi/pull/26628))
- **cli:** add security defaults to create-strapi-app templates ([#26737](https://github.com/strapi/strapi/pull/26737))
- **database:** export lifecycle event type ([#25637](https://github.com/strapi/strapi/pull/25637))
- **provider-email-sendgrid:** add region option for EU data residency ([#25907](https://github.com/strapi/strapi/pull/25907))
- **provider-upload-aws-s3:** accept a credential provider function ([#26796](https://github.com/strapi/strapi/pull/26796))
- **translations:** comprehensive Japanese (ja) translation update for admin and 9 plugins ([#26687](https://github.com/strapi/strapi/pull/26687))
- **ts:** augment all context error response methods ([#25424](https://github.com/strapi/strapi/pull/25424))

### 🔥 Bug fix

- refresh token cookies missing Max-Age when sessions.cookie.maxAg… ([#26747](https://github.com/strapi/strapi/pull/26747))
- add test database healthchecks ([#26511](https://github.com/strapi/strapi/pull/26511))
- generate apis in named directories ([#26354](https://github.com/strapi/strapi/pull/26354))
- **admin:** retry lazy chunk loads and improve loading and error UX ([#25954](https://github.com/strapi/strapi/pull/25954))
- **admin:** open "Upgrade your admin panel" link in new tab ([#26510](https://github.com/strapi/strapi/pull/26510))
- **admin:** remove @ts-expect-error in useQueryParams hook ([#25006](https://github.com/strapi/strapi/pull/25006))
- **admin:** hide boolean clear action when field is disabled ([#26294](https://github.com/strapi/strapi/pull/26294))
- **admin:** restore default locale in permissions when adding i18n to ct ([#26548](https://github.com/strapi/strapi/pull/26548))
- **admin:** keep static fallback paths url-safe ([#26518](https://github.com/strapi/strapi/pull/26518))
- **admin:** stop storing IP addresses in session metadata ([#26873](https://github.com/strapi/strapi/pull/26873))
- **ci:** use allowlisted thollander action ref in experimental publish workflow ([#26768](https://github.com/strapi/strapi/pull/26768))
- **content-api:** validate populate for polymorphic structures ([#25854](https://github.com/strapi/strapi/pull/25854))
- **content-manager:** warn before publishing with draft relations ([#26736](https://github.com/strapi/strapi/pull/26736))
- **content-manager:** use ListViewTable relation-loaded translation key ([#26798](https://github.com/strapi/strapi/pull/26798))
- **content-manager:** serve live preview script from server endpoint ([#26732](https://github.com/strapi/strapi/pull/26732))
- **content-manager:** capitalize component category names in dynamic zone ([#24426](https://github.com/strapi/strapi/pull/24426), [#26337](https://github.com/strapi/strapi/pull/26337))
- **content-manager:** add Japanese EditView shortcut hint translations ([#26814](https://github.com/strapi/strapi/pull/26814))
- **content-manager:** prevent dynamic zone crash when value is null ([#26816](https://github.com/strapi/strapi/pull/26816))
- **content-manager:** skip publish warning for M2M links to published entries ([#26858](https://github.com/strapi/strapi/pull/26858))
- **content-type-builder:** improve component category validation error message ([#25455](https://github.com/strapi/strapi/pull/25455))
- **core:** preserve M2M relation order on published version after reo… ([#26791](https://github.com/strapi/strapi/pull/26791))
- **core:** maxFileSize error not detected in body middleware ([#25011](https://github.com/strapi/strapi/pull/25011))
- **core:** resolve relations on non-localized entries with stale locale column ([#26805](https://github.com/strapi/strapi/pull/26805))
- **create-strapi-app:** scaffold pnpm 11 allowBuilds for Strapi Cloud ([#26757](https://github.com/strapi/strapi/pull/26757))
- **create-strapi-app:** enable strict TypeScript in app scaffolds ([#26779](https://github.com/strapi/strapi/pull/26779))
- **create-strapi-app:** limit odd Node major warning to versions before 26 ([#26810](https://github.com/strapi/strapi/pull/26810))
- **data-transfer:** restore localizations links that use document_id refs ([#26870](https://github.com/strapi/strapi/pull/26870))
- **graphql:** preserve M2M relation order with pagination ([#26577](https://github.com/strapi/strapi/pull/26577), [#26785](https://github.com/strapi/strapi/pull/26785))
- **test:** tighten jest ignore patterns to match path segments ([#26753](https://github.com/strapi/strapi/pull/26753))
- **translations:** correct ja "characters" mistranslation in WYSIWYG controls ([#26845](https://github.com/strapi/strapi/pull/26845))
- **types:** tighten Core.Config typings with backward-compatible deprecations ([#26787](https://github.com/strapi/strapi/pull/26787))
- **upload:** disable asset editing and deletion on published entries ([#26127](https://github.com/strapi/strapi/pull/26127))
- **users-permissions:** accept documentId for the role relation on user create/update ([#26715](https://github.com/strapi/strapi/pull/26715))
- **users-permissions:** correct "occured" → "occurred" typo in error notifications ([#26508](https://github.com/strapi/strapi/pull/26508))
- **utils:** prevent crash on null dynamic zone entry during traversal ([#24303](https://github.com/strapi/strapi/pull/24303), [#26842](https://github.com/strapi/strapi/pull/26842))

### 📚 Documentation Changes

- fix typos and grammar slips in content-manager docs ([#26600](https://github.com/strapi/strapi/pull/26600))

### ⚙️ Chore

- add ai-tooling sync script for skill symlinks ([#26594](https://github.com/strapi/strapi/pull/26594))
- rename ai-tooling yarn scripts to ai:* ([#26767](https://github.com/strapi/strapi/pull/26767))
- reduce Vercel noise on PRs (contributor-docs ignore step) ([#26772](https://github.com/strapi/strapi/pull/26772))
- cloud plugin updates ([#26801](https://github.com/strapi/strapi/pull/26801))
- update cli deploy copies ([f0fa460525](https://github.com/strapi/strapi/commit/f0fa460525))
- **deps:** hoist @types/node to root and align with 20, min supported engine ([#26291](https://github.com/strapi/strapi/pull/26291))
- **deps:** upgrade TypeScript to 5.9.3 ([#26782](https://github.com/strapi/strapi/pull/26782))
- **deps:** bump hono from 4.12.23 to 4.12.27 ([#26761](https://github.com/strapi/strapi/pull/26761))
- **deps:** bump design-system to v2.2.1 ([#26788](https://github.com/strapi/strapi/pull/26788))
- **deps:** bump axios from 1.18.0 to 1.18.1 ([#26762](https://github.com/strapi/strapi/pull/26762))
- **deps:** upgrade lint-staged to 16 and scope linting to staged files ([#26765](https://github.com/strapi/strapi/pull/26765))
- **deps:** remove unused @strapi/ts-zen dev dependency ([#26759](https://github.com/strapi/strapi/pull/26759))
- **typescript:** enable erasableSyntaxOnly and noUncheckedSideEffectImports ([#26790](https://github.com/strapi/strapi/pull/26790))
- **workflows:** make documentation flag name more obvious ([#26649](https://github.com/strapi/strapi/pull/26649))

### 💅 Enhancement

- **admin:** add uz-Cyrl native name to languageNativeNames ([#24920](https://github.com/strapi/strapi/pull/24920))
- **strapi:** lazy-load TypeScript chain for non-build CLI commands ([#26265](https://github.com/strapi/strapi/pull/26265))
- **utils:** add env.required for strict scaffold secrets ([#26830](https://github.com/strapi/strapi/pull/26830))

### 🚨 Security

- **users-permissions:** default legacy JWT verify to HS256 ([#26752](https://github.com/strapi/strapi/pull/26752))

### ❤️ Thank You

- Akash Santra @Akash504-ai
- Andrei L @unrevised6419
- Arthur
- Aurélien GEORGET
- Ayoub Hidri @ayhid
- Ben Irvin
- Daiske @daiske
- Florent Baldino @Baldinof
- greymoth
- ivseb @ivseb
- jasleenkaur-qed42
- Jian Zhang @Jian-Zhang08
- Joseph Ajayi @ajayi-joseph
- kdt523
- kibwashere
- Maksim Zhukau @MaksZhukov
- mariekirsch @mariekirsch
- mathildeleg @mathildeleg
- mehmet turac @mturac
- mhsnsfh
- Minh Lê @DucMinhNe
- Nico André
- Niels Kaspers @nielskaspers
- Nuraliev Alirahmon
- Pierre Wizla
- Rowan-Paul
- Tewson Seeoun @tewson
- Vibhu Gupta @VibhuGupta-dev
- Vishal Kumar Singh @singhvishalkr