A complete revamped Media Library UI is available behind a feature flag. Set future.betaMediaLibrary: true in config/features and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs (https://docs.strapi.io/cms/features/media-library)
Feedback while it's behind the flag is very welcome. Enjoy!
graphql: warn about unbounded operation limits (#27390)
upload: deny svg in generated project defaults (#27360)
⚠️ Changes to be aware of
New projects block SVG uploads by default
Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow image/svg+xml in the generated upload security config.
(#27360)
This PR contains the following updates:
| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@strapi/plugin-cloud](https://strapi.io) ([source](https://github.com/strapi/strapi/tree/HEAD/packages/plugins/cloud)) | [`5.52.1` → `5.52.2`](https://renovatebot.com/diffs/npm/@strapi%2fplugin-cloud/5.52.1/5.52.2) |  |  |
| [@strapi/plugin-users-permissions](https://strapi.io) ([source](https://github.com/strapi/strapi/tree/HEAD/packages/plugins/users-permissions)) | [`5.52.1` → `5.52.2`](https://renovatebot.com/diffs/npm/@strapi%2fplugin-users-permissions/5.52.1/5.52.2) |  |  |
| [@strapi/strapi](https://strapi.io) ([source](https://github.com/strapi/strapi/tree/HEAD/packages/core/strapi)) | [`5.52.1` → `5.52.2`](https://renovatebot.com/diffs/npm/@strapi%2fstrapi/5.52.1/5.52.2) |  |  |
| [@strapi/typescript-utils](https://strapi.io) ([source](https://github.com/strapi/strapi/tree/HEAD/packages/utils/typescript)) | [`5.52.1` → `5.52.2`](https://renovatebot.com/diffs/npm/@strapi%2ftypescript-utils/5.52.1/5.52.2) |  |  |
---
### Release Notes
<details>
<summary>strapi/strapi (@​strapi/plugin-cloud)</summary>
### [`v5.52.2`](https://github.com/strapi/strapi/releases/tag/v5.52.2)
[Compare Source](https://github.com/strapi/strapi/compare/v5.52.1...v5.52.2)
##### 5.52.2 (2026-08-26)
##### ✨ New Media Library (opt-in beta)
A complete revamped Media Library UI is available behind a feature flag. Set `future.betaMediaLibrary: true` in `config/features` and restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs (<https://docs.strapi.io/cms/features/media-library>)
Feedback while it's behind the flag is very welcome. Enjoy!
<img width="1440" height="976" alt="Image details" src="https://github.com/user-attachments/assets/49a67b0d-fde3-4af5-8e87-f27f0fd24c04" />
##### 🔥 Bug fix
- make drag and drop more fluently in configuation view [fix#23161](https://github.com/fix/strapi/issues/23161) ([#​26320](https://github.com/strapi/strapi/pull/26320), [#​23161](https://github.com/strapi/strapi/issues/23161))
- **admin:** out of sort memory when listing audit logs on mysql ([#​27410](https://github.com/strapi/strapi/pull/27410))
- **admin:** send credentials on fetch client requests ([#​27413](https://github.com/strapi/strapi/pull/27413))
- **admin:** keep api token permissions on localized content types at boot ([#​27420](https://github.com/strapi/strapi/pull/27420))
- **admin:** honour redirectTo when the auth page redirects an authenticated user ([#​27213](https://github.com/strapi/strapi/pull/27213))
- **admin:** slow startup with many roles due to redundant permission … ([#​27438](https://github.com/strapi/strapi/pull/27438))
- **content-manager:** draft status filter with i18n sibling locale published ([#​26835](https://github.com/strapi/strapi/pull/26835))
- **content-manager:** reject MCP relation writes combining set with connect or disconnect ([#​27423](https://github.com/strapi/strapi/pull/27423))
- **content-manager:** out of sort memory when listing history versions on mysql ([#​27394](https://github.com/strapi/strapi/pull/27394))
- **core:** Access token rotation fails with asymmetric JWT algorithms ([#​27201](https://github.com/strapi/strapi/pull/27201))
- **core:** serialize JSON columns before INSERT in discard-drafts migration ([#​25927](https://github.com/strapi/strapi/pull/25927))
- **core/strapi:** local plugins duplicate the admin module graph and exhaust build memory ([#​27311](https://github.com/strapi/strapi/pull/27311))
- **database:** relation reorder saves the wrong position ([#​27444](https://github.com/strapi/strapi/pull/27444))
- **i18n:** correct broken placeholders in pt-BR translations ([#​27257](https://github.com/strapi/strapi/pull/27257), [#​27383](https://github.com/strapi/strapi/pull/27383))
- **permissions:** surface clear error for unsupported RBAC condition operators ([#​27355](https://github.com/strapi/strapi/pull/27355))
- **plugins:** admin build fails to resolve [@​strapi/admin](https://github.com/strapi/admin) under isolated node\_modules ([#​27337](https://github.com/strapi/strapi/pull/27337))
- **upload:** translate server error codes in the new media library ([#​27345](https://github.com/strapi/strapi/pull/27345))
- **upload:** sizeLimit is not enforced when replacing a file ([#​27414](https://github.com/strapi/strapi/pull/27414))
- **upload:** move replace media to the drawer footer, add tooltips ([#​27425](https://github.com/strapi/strapi/pull/27425))
- **upload:** list queued files in the upload progress dialog ([#​27416](https://github.com/strapi/strapi/pull/27416))
- **upload:** merge a second drop into the running upload batch ([#​27415](https://github.com/strapi/strapi/pull/27415))
##### ⚙️ Chore
- replace lodash forEach with native Object.entries/values ([#​27409](https://github.com/strapi/strapi/pull/27409))
- add worktree bootstrap command ([#​27426](https://github.com/strapi/strapi/pull/27426))
- **deps:** upgrade memfs to 4.68.1 in [@​strapi/upgrade](https://github.com/strapi/upgrade) ([#​27406](https://github.com/strapi/strapi/pull/27406))
- **deps:** migrate first-party zod to 4.4.3 ([#​27428](https://github.com/strapi/strapi/pull/27428))
##### 💅 Enhancement
- **data-transfer:** clarify partial transfer stage scope ([#​27322](https://github.com/strapi/strapi/pull/27322))
- **database:** log internal migrations at info level ([#​27324](https://github.com/strapi/strapi/pull/27324))
- **database:** add migration progress heartbeats ([#​27325](https://github.com/strapi/strapi/pull/27325))
##### 🚨 Security
- **graphql:** warn about unbounded operation limits ([#​27390](https://github.com/strapi/strapi/pull/27390))
- **upload:** deny svg in generated project defaults ([#​27360](https://github.com/strapi/strapi/pull/27360))
##### ⚠️ Changes to be aware of
##### New projects block SVG uploads by default
Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow `image/svg+xml` in the generated upload security config.
([#​27360](https://github.com/strapi/strapi/pull/27360))
##### ❤️ Thank You
- Adrien L [@​Adzouz](https://github.com/Adzouz)
- Andrei L [@​unrevised6419](https://github.com/unrevised6419)
- Ayoub Hidri [@​ayhid](https://github.com/ayhid)
- Bassel Kanso
- Ben Irvin
- DMehaffy
- Eliau Elkouby [@​eliau2005](https://github.com/eliau2005)
- Giulio Montagner [@​giu1io](https://github.com/giu1io)
- jasleenkaur-qed42 [@​jasleenkaur-qed42](https://github.com/jasleenkaur-qed42)
- keke [@​kekekuli](https://github.com/kekekuli)
- Lazizbek Ergashev [@​lazerg](https://github.com/lazerg)
- Merlijn van den Berg
- Nico André
- Omar MEBARKI
- Rohit Singh [@​HitOP2509](https://github.com/HitOP2509)
- Samran Asif [@​webdevsamran](https://github.com/webdevsamran)
- Ziyi [@​butcherZ](https://github.com/butcherZ)
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40Ni40IiwidXBkYXRlZEluVmVyIjoiNDQuNDYuNCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJhdXRvbWF0ZWQiLCJkZXBlbmRlbmNpZXMiXX0=-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
5.52.1→5.52.25.52.1→5.52.25.52.1→5.52.25.52.1→5.52.2Release Notes
strapi/strapi (@strapi/plugin-cloud)
v5.52.2Compare Source
5.52.2 (2026-08-26)
✨ New Media Library (opt-in beta)
A complete revamped Media Library UI is available behind a feature flag. Set
future.betaMediaLibrary: trueinconfig/featuresand restart your app; it replaces the legacy Media Library when enabled (disabled by default). More info in docs (https://docs.strapi.io/cms/features/media-library)Feedback while it's behind the flag is very welcome. Enjoy!
🔥 Bug fix
⚙️ Chore
💅 Enhancement
🚨 Security
⚠️ Changes to be aware of
New projects block SVG uploads by default
Apps created with create-strapi-app now reject SVG files in the Media Library by default, because SVG can include active browser content. Existing projects are unchanged; if you need SVG in a new project, allow
image/svg+xmlin the generated upload security config.(#27360)
❤️ Thank You
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate CLI.