strapi/strapi
🚀 Strapi is the leading open-source headless CMS. It’s 100% JavaScript/TypeScript, fully customizable, and developer-first.
How strapi is put together
This is the Strapi headless CMS monorepo (v5.52.1 line), a large Yarn-workspace/Nx-orchestrated repository of TypeScript packages under packages/core/* (CMS engine: admin panel, content-type-builder, content-manager, database, permissions, data-transfer, etc.), packages/cli/* (project scaffolding and Strapi Cloud interaction), plus examples and shared scripts. Each package is built independently with Rollup (code) and tsc (declarations), tested through a layered harness: unit tests via Jest and Vitest, API/CLI integration tests via Jest configs at the root, front-end tests via a shared Jest preset, and browser E2E via Playwright against generated test apps. The root README also documents a bundled JavaScript GitHub Action that validates PR labels/milestones before merge. Runtime is Node.js (>=20 <=26); the admin UI is React-based while backend packages run on Node.
Languages
Frameworks
Datastores
Infrastructure
Major components
packages/core/admin
Strapi's administration panel: front-end app and its serving/build tooling.
packages/core/content-type-builder
Content-type modeling UI/logic for defining schemas in Strapi projects.
packages/core/content-manager
CRUD management of entries for defined content types (has an OAS spec, oas.yml).
packages/core/content-releases
Content release/publishing workflow feature.
packages/core/database
Database layer abstraction for Strapi applications.
packages/core/data-transfer
Data import/export/transfer engine between Strapi instances.
packages/cli/cloud
@strapi/cloud-cli: commands to authenticate with and deploy to Strapi Cloud (axios, JWT/JWKS verification).
packages/cli/create-strapi-app
CLI generator that scaffolds new Strapi applications.
A quieter week focused on polish fixes for drag-and-drop, uploads, and database reliability.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter week focused on polish fixes for drag-and-drop, uploads, and database reliability.
Week of 2026-08-17
A high-volume week of 29 commits shipping release 5.52.1 plus fixes for uploads, admin performance, and MySQL memory issues.
Week of 2026-08-10
Release 5.52.0 shipped alongside continued media library redesign work and security updates.
Week of 2026-08-03
The busiest week at 59 commits: releases 5.51.2, MCP actions added to audit logs, a new migration runner, and heavy media library feature work.
Week of 2026-07-27
Thirty commits centered on mobile-friendly media library fixes, AI metadata generation after upload, and content-manager relation fixes.
Over the past five weeks the Strapi team shipped a steady stream of bug fixes across the admin panel, content manager, and database layers, alongside two releases (5.52.0 and 5.51.2). A major theme is a rebuilt media library being developed behind a beta flag, with weekly improvements to uploads, folders, drag-and-drop, and AI metadata generation. Supporting work included security hardening (SVG defaults, GraphQL limits, dependency bumps), test infrastructure modernization from Jest to Vitest, and numerous performance and reliability fixes for large datasets.
Week by week
2026-08-24A quieter week focused on polish fixes for drag-and-drop, uploads, and database reliability.latest6 changes
Fix
Smoother drag-and-drop in configuration view
Rearranging items in the settings screens now feels more fluid instead of jumping around.
Feature
Migration progress heartbeats
Database upgrades now send regular progress signals so long migrations are easier to monitor.
Fix
Draft-discard migration handles JSON data correctly
Fixed a migration that could corrupt structured data when discarding drafts.
Fix
Clear error for unsupported permission conditions
Users now get an understandable message when using advanced permission rules the system doesn't support.
Fix
Second file drop joins running upload
Dropping more files while an upload is already in progress now adds them to the same batch instead of failing.
Fix
Relation reordering saves correct position
Reordering linked items no longer saves them in the wrong spot.
2026-08-17A high-volume week of 29 commits shipping release 5.52.1 plus fixes for uploads, admin performance, and MySQL memory issues.6 changes
Chore
Release 5.52.1
A patch release rolled up the week's accumulated fixes.
Fix
Upload dialog shows queued files
The upload progress window now lists every file waiting to be uploaded so you can see what's happening.
Refactor
Faster admin startup with many roles
Removed redundant permission checks that made projects with lots of user roles slow to start.
Fix
MySQL out-of-memory fixes for history and audit logs
Listing version history or audit logs on MySQL databases no longer crashes on large datasets.
Fix
Access token rotation fixed for asymmetric JWT
Projects using certain secure token formats can now rotate access tokens without failure.
Fix
Logout clears refresh token cookie
Signing out now properly removes the session cookie so users are fully logged out.
2026-08-10Release 5.52.0 shipped alongside continued media library redesign work and security updates.6 changes
Chore
Release 5.52.0
The latest minor version of Strapi went out with the week's improvements bundled in.
Fix
Permission conditions no longer block unrelated pages
Users could previously be locked out of pages due to permission rules that had nothing to do with those pages; this is fixed.
Refactor
New media library endpoint names finalized
The upcoming redesigned media library settled its internal API naming ahead of launch.
Fix
Media library design and responsiveness adjustments
The new media library got layout tweaks so it works well on different screen sizes.
Fix
Unregistered RBAC conditions skipped safely
Custom permission conditions that aren't registered no longer break role-based access checks.
Chore
Security dependency updates
Updated several third-party libraries, including the AI tooling SDK, to patch known vulnerabilities.
2026-08-03The busiest week at 59 commits: releases 5.51.2, MCP actions added to audit logs, a new migration runner, and heavy media library feature work.6 changes
Chore
Release 5.51.2
A patch release was cut and merged back into the development branch.
Feature
AI assistant actions recorded in audit logs
Actions taken through Strapi's built-in AI tools are now logged for accountability.
Refactor
Internal migration runner replaces umzug
Strapi now uses its own code to run database upgrades, reducing external dependencies.
Feature
New media library unified behind beta flag
The redesigned media library can now be enabled as a single opt-in experience, with folder renaming and asset action menus added.
Chore
Unit tests migrated from Jest to Vitest
Several packages moved to a faster, more modern testing framework.
Fix
Data transfer skips orphaned links on restore
Importing data no longer fails when it encounters broken references left over from deleted content.
2026-07-27Thirty commits centered on mobile-friendly media library fixes, AI metadata generation after upload, and content-manager relation fixes.6 changes
Feature
AI metadata generated after upload
Uploaded files can now automatically get AI-generated descriptions, either one at a time or in bulk.
Fix
Asset drawer and crop tool work on mobile
The media preview panel stays visible and cropping by touch now tracks fingers correctly on phones and tablets.
Fix
URL imports stream to disk
Importing files from web addresses no longer loads everything into memory, preventing crashes on big files.
Fix
Relations keep their order after saving dynamic zones
Linked items no longer shuffle into the wrong order when saving pages with repeatable sections.
Fix
Relation creation keeps parent changes
Adding a related item no longer throws away unsaved edits made elsewhere on the page.
Feature
Component screenshots in dynamic zone picker
Content editors can optionally see visual previews when choosing which section type to add.
Dependencies and code review
Dependency advisories
Security Watch
1 vulnerable package (1 advisories) across 79 scanned dependencies.
nx 20.8.4
1 advisory. Fixed in 22.7.7.
How it can be abusedIf this repo uses a self-hosted Nx remote cache to share build outputs between developers and CI, anyone who can write to that cache could store a crafted artifact whose files unpack outside the cache folder, dropping malicious code onto the machines of every developer who later pulls that build result. It affects teams using Nx with a shared private cache, not projects running only local builds.
- highGHSA-vp3h-ghgh-jr7gNx: Zip-Slip in the self-hosted remote cache
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required