v5.49.0

## 5.49.0 (2026-06-24)

### 🚀 New feature

- **mcp:** export defineTool/defineResource/definePrompt builders ([#26603](https://github.com/strapi/strapi/pull/26603))

### 🔥 Bug fix

- add support for initiallySelectedAssets ([#26679](https://github.com/strapi/strapi/pull/26679))
- homepage dashboard duplicates entries for users with multiple roles ([#25860](https://github.com/strapi/strapi/pull/25860))
- avoid buffering large uploads for MIME detection ([#26678](https://github.com/strapi/strapi/pull/26678))
- throw ValidationError when populate exceeds qs arrayLimit ([#25632](https://github.com/strapi/strapi/pull/25632), [#25916](https://github.com/strapi/strapi/pull/25916))
- push anchor into view to prevent off-screen tooltips ([#26303](https://github.com/strapi/strapi/pull/26303))
- **admin:** support array of links in StrapiApp.addSettingsLink ([#26433](https://github.com/strapi/strapi/pull/26433))
- **admin:** admin users logged out mid-session by access-token expiry timer ([#26680](https://github.com/strapi/strapi/pull/26680))
- **content-manager:** use top-level Core type import in MCP types ([#26681](https://github.com/strapi/strapi/pull/26681))
- **content-manager:** save draft with Cmd/Ctrl+Enter, publish with Cmd/Ctrl+Shift+Enter ([#26621](https://github.com/strapi/strapi/pull/26621))
- **content-manager:** reduce MCP relation output to identity-only shape ([#26560](https://github.com/strapi/strapi/pull/26560))
- **content-manager:** deduplicate MCP tool names when plugin has multiple content types ([#26710](https://github.com/strapi/strapi/pull/26710))
- **core/core:** mcp misleading lifecycle docs ([#26698](https://github.com/strapi/strapi/pull/26698))
- **create-strapi-app:** allow pnpm to build better-sqlite3 for SQLite scaffolds ([#26675](https://github.com/strapi/strapi/pull/26675))
- **data-transfer:** transfer admin menu and auth logos with configuration ([#26425](https://github.com/strapi/strapi/pull/26425))
- **database:** stop full-schema component_type IN on dynamic zone populate ([#26734](https://github.com/strapi/strapi/pull/26734))
- **document-service:** preserve published relations from non-dp sources ([#26654](https://github.com/strapi/strapi/pull/26654))
- **strapi:** default allowedHosts and pin Vite HMR to main server in dev ([#26244](https://github.com/strapi/strapi/pull/26244))
- **types:** add explicit return types to recursive functions ([#26704](https://github.com/strapi/strapi/pull/26704))

### 📚 Documentation Changes

- fix spelling typos in content-manager relations guide ([#26724](https://github.com/strapi/strapi/pull/26724))

### ⚙️ Chore

- removing coderabbit status ([#26703](https://github.com/strapi/strapi/pull/26703))
- **core:** upgrade package-json to 10.0.1 + rollup interop 'auto' ([#26673](https://github.com/strapi/strapi/pull/26673))
- **deps:** bump markdown-it from 14.1.1 to 14.2.0 in the richtext-editor-security group across 1 directory ([#26688](https://github.com/strapi/strapi/pull/26688))
- **deps:** bump dompurify from 3.4.5 to 3.4.9 ([#26684](https://github.com/strapi/strapi/pull/26684))
- **deps:** bump nodemailer from 8.0.5 to 8.0.9 ([#26689](https://github.com/strapi/strapi/pull/26689))
- **deps:** bump tar from 7.5.11 to 7.5.16 ([#26691](https://github.com/strapi/strapi/pull/26691))
- **deps:** bump form-data from 4.0.4 to 4.0.6 ([#26692](https://github.com/strapi/strapi/pull/26692))
- **deps:** bump anthropics/claude-code-action from 1.0.123 to 1.0.132 ([#26727](https://github.com/strapi/strapi/pull/26727))
- **deps:** bump piscina from 4.9.2 to 4.9.3 ([#26716](https://github.com/strapi/strapi/pull/26716))
- **deps:** bump undici from 6.25.0 to 6.27.0 ([#26714](https://github.com/strapi/strapi/pull/26714))
- **deps:** bump dompurify from 3.4.9 to 3.4.11 ([#26719](https://github.com/strapi/strapi/pull/26719))
- **deps-dev:** bump @babel/core ([#26667](https://github.com/strapi/strapi/pull/26667))

### 💅 Enhancement

- **upload:** add optional replace method to upload providers ([#26582](https://github.com/strapi/strapi/pull/26582))

### ❤️ Thank You

- akash-dabhi-qed @akash-dabhi-qed
- Andrei L @unrevised6419
- Andrew Bone
- Bassel Kanso @Bassel17 
- Ben Irvin 
- Giulio Montagner @giu1io
- guoyangzhen
- jasleenkaur-qed42
- Nico André
- Shivam S @BIGSUS24
- Simon Norris @cache-your-dreams
- Travis Swientek @travelton
- Vallabh Mahajan @Vallabh-1504
- Vishal Kumar Singh @singhvishalkr

### ⚠️ Changes to be aware of

#### Content Manager keyboard shortcuts

Save a draft with **Cmd/Ctrl+Enter** (or **Cmd/Ctrl+S**). Publish with **Cmd/Ctrl+Shift+Enter**. Since v5.31.3, plain Cmd/Ctrl+Enter published immediately — that shortcut now saves instead. ([#26621](https://github.com/strapi/strapi/pull/26621))