v5.47.1
renovatebot/renovatev5.47.1Jun 3, 2026by internal-releases[bot]
AI Summary
This is a maintenance release containing numerous bug fixes, security updates, and dependency bumps, including a fix for an ajv ReDoS vulnerability and improvements to the content manager and i18n plugins.
Key Highlights
- Resolved ajv ReDoS security vulnerability
- Improved i18n plugin translations
- Lazy-loaded dependencies for boot performance
- Removed aiMetadataJobsCleanup cron job
- Multiple content-manager fixes
New Features
- deleteMany respects filters combined with relation
- Improved i18n plugin translations
- Admin uses ISO 639-1 da for Danish locale
- Skip session secret check for API-only apps
Full Release Notes
## 5.47.1 (2026-06-03) ### 🔥 Bug fix - deleteMany respects filters combined with relation ([#25420](https://github.com/strapi/strapi/pull/25420)) - improve i18n plugin translations ([#22714](https://github.com/strapi/strapi/pull/22714)) - resolve ajv ReDoS vulnerability by forcing ajv@8.18.0 ([#26141](https://github.com/strapi/strapi/pull/26141)) - **admin:** use ISO 639-1 da for Danish admin locale ([#26322](https://github.com/strapi/strapi/pull/26322)) - **content-manager:** documentId(s) shown for relation when entry title set to numeric field ([#25622](https://github.com/strapi/strapi/pull/25622)) - **content-manager:** guard repeatable field .map() crash on relation… ([#26421](https://github.com/strapi/strapi/pull/26421)) - **content-manager:** fix frontend validation if not using "draft and publish" ([#25300](https://github.com/strapi/strapi/pull/25300)) - **core:** skip session secret check for API-only apps ([#26390](https://github.com/strapi/strapi/pull/26390)) - **data-transfer:** preserve core store when config stage is excluded ([#26484](https://github.com/strapi/strapi/pull/26484)) - **deps:** upgrade `koa-session` to v7.0.2 ([#26140](https://github.com/strapi/strapi/pull/26140)) - **homepage:** homepage count-documents slow on large D&P tables ([#26370](https://github.com/strapi/strapi/pull/26370)) - **i18n:** preserve non-localized field inheritance ([#26367](https://github.com/strapi/strapi/pull/26367)) - **strapi:** preserve tsbuildinfo across develop restarts ([#26264](https://github.com/strapi/strapi/pull/26264)) - **upgrade:** simplify registry URL resolution ([#25027](https://github.com/strapi/strapi/pull/25027)) ### 📚 Documentation Changes - **security:** overhaul vulnerability reporting policy ([#26393](https://github.com/strapi/strapi/pull/26393)) ### ⚙️ Chore - **admin:** remove punycode dependency ([#26189](https://github.com/strapi/strapi/pull/26189)) - **deps:** bump axios from 1.16.0 to 1.16.1 ([#26456](https://github.com/strapi/strapi/pull/26456)) - **deps:** bump express-rate-limit from 8.2.1 to 8.5.2 ([#26457](https://github.com/strapi/strapi/pull/26457)) - **deps:** bump @hono/node-server from 1.19.9 to 1.19.14 ([#26458](https://github.com/strapi/strapi/pull/26458)) - **deps:** bump qs from 6.15.0 to 6.15.2 ([#26417](https://github.com/strapi/strapi/pull/26417)) - **deps:** bump @babel/plugin-transform-modules-systemjs from 7.25.9 to 7.29.4 ([#26256](https://github.com/strapi/strapi/pull/26256)) - **deps:** bump hono from 4.11.9 to 4.12.23 ([#26455](https://github.com/strapi/strapi/pull/26455)) - **deps:** bump @tootallnate/once from 2.0.0 to 2.0.1 ([#26218](https://github.com/strapi/strapi/pull/26218)) - **docs:** migrate docusaurus config to typescript ([#26471](https://github.com/strapi/strapi/pull/26471)) - **mcp:** clarify registration lifecycle and simplify error messages ([#26517](https://github.com/strapi/strapi/pull/26517)) - **upload:** remove aiMetadataJobsCleanup cron job ([#26442](https://github.com/strapi/strapi/pull/26442)) ### 💅 Enhancement - **core:** lazy-load node-schedule and umzug at boot ([#26267](https://github.com/strapi/strapi/pull/26267)) - **core:** eliminate @strapi/typescript-utils from boot path ([#26270](https://github.com/strapi/strapi/pull/26270)) - **core/core:** lazy-load typescript-utils in Strapi and compile ([#26266](https://github.com/strapi/strapi/pull/26266)) - **strapi:** hash-cache peer-dep check; demote env-vars log to debug ([#26269](https://github.com/strapi/strapi/pull/26269)) - **strapi:** lazy-require worker-only deps in dev primary ([#26268](https://github.com/strapi/strapi/pull/26268)) ### ❤️ Thank You - Andrei L @unrevised6419 - Aurélien GEORGET - Ben Irvin @innerdvations - DMehaffy @derrickmehaffy - Jamie Howard @jhoward1994 - Jayesh Patel @itsmejay80 - Jonas Thelemann - José Luis @SalahAdDin - markkaylor @markkaylor - mehmet turac @mturac - Michael Olund - Nico André @nclsndr - Paul Bratslavsky @PaulBratslavsky - pksr @pksr - Subh aush singh - Vishal Kumar Singh @singhvishalkr - Weijie Sun @swjcpy