Update all digest updates #105
No Assignees
Valentin Popov
Valentin Popov
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: valentineus/strapi-plugin-checkbox-list#105
Reference in new issue
Block a user
This PR contains the following updates:
5.52.3→5.60.05.52.3→5.60.05.52.3→5.60.05.52.3→5.60.019.2.18→19.3.019.2.7→19.3.011.4.0→11.4.130.5.1→30.5.23.9.6→3.9.1012.0.1→12.1.66.5.3→6.6.07.2.2→7.3.1Release Notes
strapi/strapi (@strapi/plugin-cloud)
v5.60.0Compare Source
5.60.0 (2026-10-28)
🚀 New feature
🔥 Bug fix
⚙️ Chore
💅 Enhancement
❤️ Thank You
v5.59.0Compare Source
5.59.0 (2026-10-21)
🚀 New feature
🔥 Bug fix
📚 Documentation Changes
⚙️ Chore
💅 Enhancement
⚠️ Changes to be aware of
Database driver update (knex 3.3.0)
Custom code that uses
strapi.db.connectionand callsdelete()withlimitorhaving, ortruncate()withwhere,havingorlimit, now throws on PostgreSQL and SQLite. MySQL now applies theLIMIT. Before, the limit was ignored and every matching row was deleted, so check plugins or scripts that build such queries. Connection pool timeout errors now include the underlying connection error, and knex warnings now appear in the Strapi log as[database] knex: ….(#27982)
Token and role names are limited to 255 characters
The name and description of API tokens, admin tokens, transfer tokens and admin roles now accept at most 255 characters. Longer values get a validation error under the field. Before, PostgreSQL returned a generic server error. Existing tokens with longer values keep working, but the admin rejects that long text on save until you shorten it.
(#28004) (#28002)
Node.js 22.19 or later is required
Strapi now uses undici 8, which requires Node.js 22.19.0 or later. The
enginesfield still says>=20.0.0, so check your runtime: this release was only tested on Node 22.20 and later.(#27934)
limitInputPixelsmust be a number or a booleanThe upload plugin now applies
sharp.limitInputPixels. Strapi refuses to start if the value is nottrue,falseor an integer of 0 or more. A value read straight from an environment variable is a string, so useenv.int().(#27161)
Known issue: deleting an entry changes past releases
When you delete an entry that belongs to a release that was already published, the entry is removed from that release, and the release status changes from "done" to "empty" or "ready". The published content is not affected. This already happened for localized entries, and it now happens for all entries.
(#28023)
Known issue: editing webhook headers
In Settings > Webhooks, if you clear the last header row and type a new header name, the old text can stay in front of it (for example
X-CX-Dinstead ofX-D). Check the header names before you save.(#27671)
❤️ Thank You
v5.58.0Compare Source
5.58.0 (2026-10-14)
🚀 New feature
🔥 Bug fix
📚 Documentation Changes
⚙️ Chore
❤️ Thank You
v5.57.0Compare Source
5.57.0 (2026-10-07)
🚀 New feature
🔥 Bug fix
📚 Documentation Changes
⚙️ Chore
💅 Enhancement
🚨 Security
❤️ Thank You
v5.56.0Compare Source
5.56.0 (2026-09-30)
🚀 New feature
🔥 Bug fix
📚 Documentation Changes
⚙️ Chore
💅 Enhancement
❤️ Thank You
v5.55.1Compare Source
5.55.1 (2026-09-24)
This is a hotfix release patching v5.55.0 that were causing a performance drop for the projects that have the documentation plugin.
⏪ Revert
v5.55.0Compare Source
5.55.0 (2026-09-23)
🚀 New feature
🔥 Bug fix
⚙️ Chore
❤️ Thank You
v5.54.0Compare Source
5.54.0 (2026-09-16)
🎉 The new Media Library is here!
We've been heads-down on this for months, and it's the change we're most excited to put in your hands: the redesigned Media Library is now the default for everyone in version 5.54.0.
This isn't a fresh coat of paint. We rebuilt the Media Library entirely around how people actually work with assets:
📚 Read the full documentation
Not ready for the big change yet? You're feeling nostalgic and need the old one back?
We know upgrades land in the middle of real work. If you'd rather stay on the previous interface for now, you can add this to
config/features:Full details in Restoring the previous Media Library in the docs.
Huge thanks to everyone who tested the beta and sent feedback. Can't wait to hear what you think 💙
🚀 New features
🔥 Bug fixes
⚙️ Chore
💅 Enhancement
❤️ Thank You
v5.53.0Compare Source
⚠️ Security Warning and Notice ⚠️
Strapi was made aware of a vulnerably that were patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure.
5.53.0 (2026-09-09)
🚀 New feature
🔥 Bug fix
⚙️ Chore
⚠️ Changes to be aware of
MCP clients no longer drop advertised tools
The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error
-32602instead ofisError: true;extra.sendNotificationandextra.sendRequestare gone; and one promptargsSchemathat cannot become JSON Schema (for examplez.date()) hides every prompt fromprompts/list.(#27505)
❤️ Thank You
jprichardson/node-fs-extra (fs-extra)
v11.4.1Compare Source
emptyDir*()(#1080)jestjs/jest (jest)
v30.5.2Compare Source
Features
[@jest/transform]Strip TypeScript types with Node when no transformer claims a.ts,.mtsor.ctsfile (#16421)Fixes
[jest-core, jest-haste-map, jest-transform]Keeprequire('../package.json')external when bundling, sojest --versionand the transform and haste-map cache keys report the released version instead of the previous one (#16422)[jest-each]Escape a table row's keys before building the$variableinterpolationRegExp, so a column name such ascount(*)no longer fails the whole table withInvalid regular expression, and a.or|in a column name is matched literally (#16345)[@jest/source-map]Resolve absolute Windows paths in a source map'ssourcesandsourceRootagain, instead of appending them to the transformed file's directory (#16439)prettier/prettier (prettier)
v3.9.10Compare Source
diff
Markdown: Update
micromark-extension-gfm-tableto fix the table parse issue on performance (#20266 by @fisker)See micromark/micromark-extension-gfm-table@
4f43eadfor details.v3.9.9Compare Source
diff
Markdown: Fix text with
$been incorrectly parsed as math syntax (#20140 by @fisker)v3.9.8Compare Source
diff
Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @seiyab)
v3.9.7Compare Source
diff
Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @Austin1serb, @giaBaoJS)
JavaScript: Fix embedded template literal idempotency (#19725 by @fisker)
Markdown: Preserve Liquid blocks after Markdown tables (#19730 by @wanxiankai, @seiyab)
Markdown: Preserve single tildes in Markdown (#19739 by @lazerg)
Since 3.9.0, single-tilde spans like
H~2~Owere rewritten to double tildes, turning subscript syntax into strike-through. Only double tildes are treated that way now, matching GitHub.Markdown: Fix Markdown blockquote containing
>characters (#19802 by @seiyab)Markdown: Strip blockquote markers from a setext heading's continuation lines (#19878 by @Kjubikstronk)
A setext heading spanning multiple lines inside a blockquote kept the
>marker of its continuation lines as literal text.Markdown: Fix HTML block indentation drift in markdown list items (#19987 by @lazerg)
Angular: Support
@boundaryerror boundaries (#20014 by @Yahiro025)formatjs/formatjs (react-intl)
v12.1.6: react-intl: 12.1.6Compare Source
Bug Fixes
v12.1.5: react-intl: 12.1.5Compare Source
Bug Fixes
Dependencies
v12.1.4: react-intl: 12.1.4Compare Source
Bug Fixes
Dependencies
v12.1.3: react-intl: 12.1.3Compare Source
Bug Fixes
v12.1.2: react-intl: 12.1.2Compare Source
Dependencies
v12.1.1: react-intl: 12.1.1Compare Source
Bug Fixes
Dependencies
v12.1.0: react-intl: 12.1.0Compare Source
Features
Dependencies
v12.0.2: react-intl: 12.0.2Compare Source
Bug Fixes
Dependencies
styled-components/styled-components (styled-components)
v6.6.0Compare Source
Minor Changes
7ce6aea: Added aStyledComponent<Target, Props>type for annotating explicitly-typed styled component exports.Packages that emit their own declaration files, including any project using
isolatedDeclarations, must annotate every exported styled component, and there was no public type for it: consumers reached into internal paths or hand-assembled one that dropped members like a wrapped component's hoisted statics.StyledComponentis exported from the web and native entries. Name the target and props as you passed them tostyled:It resolves to the exact type
styled(Target)<Props>produces, so the annotation is not lossy.Patch Changes
7afbd11: Fixedattrsno longer applying its value when a prop was explicitly passed asundefined(the 6.3.12 to 6.5.x behavior).styled.button.attrs(({ type = 'button', ...rest }) => ({ type, ...rest }))rendered withouttype="button"when the caller passedtype={undefined}, and an object-form default such as.attrs({ type: 'button' })was lost the same way, including through a wrapper component that spreads its own props over the styled component.attrsnow always wins for the keys it returns, matching every other case where a prop is passed alongsideattrs.Also fixed: a prop passed explicitly as
undefined(and not overridden byattrs) is now forwarded to a wrapped component so that component can fall back to its own default, the pattern MUI'sButtonBaserelies on (for example<Root role="button" {...props} />). Wrapped components have dropped this prop entirely since v6.0, so a component that checks'role' in propsor merges{...defaults, ...props}to detect an explicitly-passed prop may see and behave differently now that the key is present again. This only applies when wrapping another component; a DOM tag such asstyled.divstill drops theundefinedprop entirely, since browsers have no notion of an "undefined" attribute.If you were relying on an explicit
undefinedto clear anattrsdefault, use the function form and check for the prop's presence instead:Passing
rel={undefined}now renders norelattribute, and omitting the prop rendersrel="noopener".React Native already forwarded an explicit
undefinedprop to a wrapped component; it now also matches web in never forwarding anundefinedthatattrsitself produced.209317c: Rendering styled-components on the server with the edge runtime (for exampleexport const runtime = 'edge'in a Next.js route) now fails with a clear message that names the fix: use the Node.js runtime for routes that render styled-components. Previously the same setup ended in an obscure crash, either atnext buildor on the first request.3de03c2: Type-checking is faster when you annotate exported styled components with an explicit type, the pattern that packages emitting their own declaration files (including any project usingisolatedDeclarations) rely on. The improvement is largest in codebases that annotate many components built on intrinsic tags such asstyled.div,styled.span, andstyled.button, and wrappers over polymorphic components whose props are a union.Nothing about the styled component's type changes for your code: props,
defaultProps,propTypes, ref forwarding, andaspolymorphism all behave exactly as before. This is purely a type-check speedup.7afbd11: Fixed a typo in theuseThemeerror message's example code (a misspelled component name in error 18), so the copy-pasted example compiles as written.7afbd11: Fixed global styles fromcreateGlobalStyledisappearing in React Server Components: a global style rendered in a loading state (a React<Suspense>fallback) and again once the real content streamed in could vanish entirely once the fallback was replaced. The same loss could happen across a client-side navigation when a global style was rendered by both a layout and one of its pages, and the layout's copy never re-rendered.Each server-rendered instance of a global style now carries its own styles, so a global style shown in more than one place in a request always survives, whether the page reveals streamed content or the user navigates to a sibling route.
52c5f6e: Fixed a crash ("Rendered fewer hooks than expected") and a related stale-style bug for components that call a React hook, or read any value outside their props and theme, from inside a style interpolation. This affected@mui/styled-engine-scwith MUI X DataGrid, which calls hooks within an interpolation, and was a regression introduced in 6.4.0.Style interpolations now run on every render, so a hook called inside one runs consistently and a value read inside one always reflects its current state.
If a component re-renders often with unchanged props and its interpolations are expensive, wrap it in
React.memoto skip those re-renders. That is the right place to bail out, because only the calling code knows the full set of inputs its styles depend on.7afbd11: Fixed//JavaScript-style line comments in React Native style declarations. Only/* */block comments were recognized before; a//comment left in a template literal was parsed as part of the surrounding CSS, which could drop or corrupt the styles that followed it on the same line. Line comments are now stripped the same way block comments already were, while a URL used as a raw value (for exampleurl(http://example.com/image.png)or an unquotedhttps://value in a custom property) is left untouched.1c0e309: Fixed styles disappearing from a server-rendered component when it is revealed from behind a React<Suspense>boundary, such as a streaming Next.js route (includingcacheComponents). A component shown first in a Suspense fallback and then in the resolved content kept its class name but lost its CSS, because the rule had been emitted only inside the fallback that React discards on reveal.Each server-rendered instance now carries its own inline
<style>, so its styles always travel with it and survive the boundary. The data React sends for server components includes each distinct style once on React 19, however many instances repeat it. In the HTML, nearby duplicates compress away almost for free under gzip, but gzip can only look back about 32 KB, so once repeats are farther apart on the page each one costs roughly its own compressed size; brotli's much larger window keeps it cheap regardless of distance. Only a very large repeated list (thousands of instances of one component on a single page) is worth restyling from a single parent element, and a development-only warning points that out if it happens.7afbd11: styled-components now installs the stylis type declarations its own published types rely on.The shipped declarations reference types from
stylis(thestylisPluginsoption andstylisPluginRSC), andstylisships no types of its own. WithskipLibCheckturned off, a project that had not installed@types/stylisitself could fail to type-check with an error inside styled-components' declarations. Nothing changes at runtime.7afbd11: Fixed the shipped types failing to compile, withskipLibCheckturned off, against@types/react16, 17, and 18.2.6 through 18.2.11. Those versions don't declare the<search>HTML element, and styled-components' types assumed they did. The published types now compile on every supported@types/react.styled.searchis present in the types on every version, and accepts the same props it did before, so no existing code stops compiling.7afbd11: Fixed an error inside styled-components' own type declarations, withskipLibCheckturned off, for projects using React 16 or 17 type packages or without@types/react-dominstalled. TheServerStyleSheetstreaming API's types referenced a type that only@types/react-dom18 and later provide.interleaveWithNodeStreamstill accepts the result ofrenderToPipeableStreamand Node readable streams exactly as before.7afbd11: Added a development-only warning for when the server and the browser are running different versions of styled-components. Class names are derived in part from the library's own version, so a mismatch made every server-rendered class name silently fail to match on the client, with no hint as to why styles disappeared or hydration broke. The warning names both versions and points atnpm ls styled-componentsto find the duplicate. A page that intentionally hosts more than one app, each on its own styled-components version (for example a micro-frontend setup), can ignore it. It is stripped from production builds.ladjs/supertest (supertest)
v7.3.1Compare Source
884cd26e74a1e0v7.3.0Compare Source
71dc5fb3b5ba5cc3419b27e409dbb55a7f97a5deaaa75f6eec2cb33e7fb34e7c3575842a01b57343394d6b203e9d40ca7eb6f599581766ca985ac7c58baa5fc406e82Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
67c0f13ee1to0a345a54100a345a5410tof0c48c01aff0c48c01afto62ad528ac362ad528ac3tod12fe34f9ed12fe34f9eto761fc49922761fc49922to115e335ccf115e335ccfto3bd0e1d4523bd0e1d452to40ff4224ce40ff4224ceto12dbef816312dbef8163to57aa2265dc57aa2265dctoe130c795cfe130c795cftob14398d55ab14398d55ato2eeca9f9212eeca9f921to534369c11c534369c11ctof06264f84bf06264f84bto41e2c84fd941e2c84fd9toaf62c9f628af62c9f628to6f0615f07c6f0615f07cto0f3042947d0f3042947dtod75677fa67d75677fa67toaafe4d27b3aafe4d27b3to138275a44f138275a44ftod27b1515d0d27b1515d0to1f36ac48f21f36ac48f2to2b6ce58fae2b6ce58faeto673408baab673408baabtoc845941a5fc845941a5ftoeee83c01dceee83c01dcto2b478f756c2b478f756cto98805d4b9498805d4b94to0712730d240712730d24to7fc6ea6f187fc6ea6f18to4b17fa9aca4b17fa9acato0b709bb1d90b709bb1d9to1b4aeb14dc1b4aeb14dctof75257a231f75257a231tof9e4e9df5af9e4e9df5atod3917b43b6d3917b43b6to8d3c12cea48d3c12cea4to3f066da2e93f066da2e9tof4d32f55dcf4d32f55dcto71f3c7925571f3c79255to57f81bb03c57f81bb03cto15068b7ba915068b7ba9to1f516f6064View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.