v5.48.0
v5.48.0
View on GitHubView PackagePublished: Jun 10, 2026

Release Notes

5.48.0 (2026-06-10)

🚀 New feature

  • add optional openapi spec route (#26239)
  • openapi: gate endpoint access with config (#26574)

🔥 Bug fix

  • upload returns unsigned URL on update media info (#25195)
  • widgets show error when role has no access to mainfield of ct (#26537)
  • admin: return empty object for empty json body in fetch client (#26277)
  • build: build does not run install; add install-deps arg (#26483)
  • ci: run build:size as full command for compressed-size-action v3 (#26556)
  • ci: restore allowed paths-filter pin (#26575)
  • content-manager: use ReadonlyArray for layout prop and fix Repeatable test fixture (#26522)
  • content-manager: raise z-index of code block language selector (#25010, #26324)
  • core: validate numeric inputs before DB unique checks (#26101)
  • database: restore join-table relation sort order in components (#26553)
  • database: avoid double finalising completed transactions (#26122)
  • upload: folder navigation bugs in Media Library (#26515)
  • upload: preserve animation frames in GIF and WebP images (#26126)
  • utils: ignore empty sort when building orderBy (#26427)

📚 Documentation Changes

  • openapi: add contributor documentation (#26410)

⚙️ Chore

  • remove experimental-dev example app (#26552)
  • update .gitignore for AI tooling directories (#26526)
  • deps: bump axios from 1.16.1 to 1.17.0 (#26539)
  • deps: bump the testing-library group across 1 directory with 2 updates (#26506)
  • deps: bump actions/setup-node from 4 to 6 (#26496)
  • deps: bump actions/stale from 10 to 10.2.0 (#26497)
  • deps: bump preactjs/compressed-size-action from 2 to 3 (#26498)
  • deps: resolve vulnerable transitive deps via lockfile dedupe and resolutions (#26540)
  • deps: bump cheerio from 1.0.0 to 1.2.0 (#26569)
  • deps: bump dorny/paths-filter from 3.0.3 to 4.0.1 (#26566)
  • deps: bump actions/download-artifact from 4.3.0 to 8.0.1 (#26564)
  • deps-dev: bump the eslint group across 1 directory with 10 updates (#26500)
  • deps-dev: bump @types/delegates from 1.0.0 to 1.0.3 (#26570)
  • deps-dev: bump the nx group across 1 directory with 2 updates (#26502)
  • repo: skip change freeze ownership check when freeze disabled (#26474)

💅 Enhancement

  • core/core: rounded thin borders for startup banner (#26273)
  • graphql: use discriminated unions instead of unsafe type casting (#25913)
  • upgrade: unhide and document upgrade to command (#26446)

🚨 Security

  • deps: patch uuid (GHSA-w5hq-g745-h8pq) and qs DoS advisories (9aef801f35)
  • deps: scope uuid/qs resolutions to affected descriptors (38b6831652)

❤️ Thank You

  • Andrei L @unrevised6419
  • Andrei Varapayeu @thisavoropaev
  • Arav Menon @Arav-Menon
  • Aurélien GEORGET
  • Ben Irvin
  • Dante Calderon @dantehemerson
  • Jamie Howard @jhoward1994
  • Maksim Zhukau @MaksZhukov
  • mathildeleg @mathildeleg
  • Nico André