fix(deps): update dependency @strapi/strapi to v4.13.1 [security]

[plural-renovate]

This PR contains the following updates:

Package	Type	Update	Change
@strapi/strapi (source)	dependencies	minor	4.5.2 -> 4.13.1

GitHub Vulnerability Alerts

CVE-2023-22894

Summary

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.

Details

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses. An unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token and changing the admin password. This can be exploited on all Strapi versions <=4.7.1.

IoC

The exploitation of CVE-2023-22894 is easily detectable, since the payload is within the GET parameters and are normally included in request logs. The following regex pattern will extract requests that are exploiting this vulnerability to leak user's email, password and password reset token columns.

/(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)/

You can search log files for this IoC by using the following grep command.

grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE

If the above regex pattern matches any lines in your log files, take extra precaution to look out for multiple requests that include password, reset_password_token or resetPasswordToken. This would indicate that an attacker has leaked the password hashes and reset tokens on your Strapi server and you need to immediately start an incident response!

Impact

All Strapi users below 4.8.0

CVE-2023-34093

Summary

Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it.

Details

When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container:

strapi.container.get('content-types').extend(contentTypeUID, (contentType) => newContentType);

The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the privateAttributes getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes).

PoC

Extend any content type on runtime (like in the bootstrap functions) and do a copy of the content-type object.

strapi.container.get('content-types').extend(contentTypeUID, (contentType) => {
  const newCT = { ... contentType, attributes: { ...contentType.attributes, newAttr: {} } };
  return newCT;
});

This will have as effect to remove the getter and as we rely on it in sanitization, every attributes will be considered as public.

Impact

Everyone can be impacted. Depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected.

CVE-2023-39345

System Details

Name	Value
OS	Windows 11
Version	4.11.1 (node v16.14.2)
Database	mysql

Description

I marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields.

To prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function did not filter out private fields.

  const { auth } = ctx.state;
  const data = ctx.request.body;
  const userSchema = strapi.getModel("plugin::users-permissions.user");

  sanitize.contentAPI.input(data, userSchema, { auth });

here's the solution I've temporarily kept to myself, code snippet

  const body = ctx.request.body;

  const { attributes } = strapi.getModel("plugin::users-permissions.user");

  const sanitizedData = _.omitBy(body, (data, key) => {
    const attribute = attributes[key];

    if (_.isNil(attribute)) {
      return false;
    }

    //? If you want, you can throw an error for fields that we did not expect.

    // if (_.isNil(attribute))
    //   throw new ApplicationError(`Unexpected value ${key}`);

    // if private value is true, we do not want to send it to the database.
    return attribute.private;
  });

  return sanitizedData;

---

Release Notes

strapi/strapi (@​strapi/strapi)

v4.13.1

Compare Source

⚠️ Breaking Changes ⚠️

Starting with Strapi v4.13.1, requests to the Content API using invalid query parameters will be rejected with an error response instead of being silently removed from the query. If you are seeing “Invalid parameter” errors in a Content API request, please ensure that every parameter in your query string is valid. If you need the previous behavior of filtering out invalid parameters, you will need to use a custom controller that only calls sanitizeQuery and not validateQuery. For more information as to why we made this change please see #​17001

⚠️ Security Warning and Notice ⚠️

Strapi was made aware of a few vulnerabilities that were patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure.

For now the delay timeline looks like we will release the detailed information in the next two (2) weeks, we expect to do public disclosure (via a blog post) on Wednesday Sept 13th, 2023. The previous disclosure mentioned in v4.12.1 was delayed and will also be disclosed on Sept 13th, 2023.

💅 Enhancement

• [core:admin] List view: new cog button icon with the view settings in the list view page https://github.com/strapi/strapi/pull/175511) @​simotae14
• [core:admin] List view: new cog button icon with the view settings in the list view page https://github.com/strapi/strapi/pull/176022) @​simotae14
• [core:content-manager] Feat: Allow writeable & nonvisible fields as default sort https://github.com/strapi/strapi/pull/172055) @​Marc-Roig
• [core:utils] 💥 Throw error on missing schema in sanitization https://github.com/strapi/strapi/pull/176933) @​innerdvations

🚀 New feature

• [core:admin] Feature/nps https://github.com/strapi/strapi/pull/175700) @​simotae14
• [core:content-manager] Feature: Workflow Assignees https://github.com/strapi/strapi/pull/172888) @​jhoward1994
• [core:content-manager] Enhancement: Improve content-manager sorting & filtering capabilities https://github.com/strapi/strapi/pull/174777) @​gu-stav
• [core:content-manager] feat: add auto-focussing via URLSearchParam to content-manager https://github.com/strapi/strapi/pull/176133) @​joshuaellis
• [typescript] [Feature] Entity Service typeshttps://github.com/strapi/strapi/pull/1779999) @​innerdvations @​Convly @​Bassel17 @​christiancp100 @​marcoautiero

🔥 Bug fix

• [core:admin] fix: dont use relative paths, use webpack alias instead https://github.com/strapi/strapi/pull/177333) @​joshuaellis
• [core:admin] fix(app): Handle errors gracefully https://github.com/strapi/strapi/pull/178333) @​gu-stav
• [core:content-manager] fix: display role names https://github.com/strapi/strapi/pull/177022) @​Marc-Roig
• [core:data-transfer] [DTS] Only delete types of data that are being transferredhttps://github.com/strapi/strapi/pull/1773030) @​innerdvations
• [core:review-workflows] fix: include strapi_assignee as a known feature in data transfer https://github.com/strapi/strapi/pull/177688) @​Marc-Roig
• [core:review-workflows] fix: Ignore review workflow fields on user content type modifications check https://github.com/strapi/strapi/pull/178655) @​Marc-Roig
• [core:strapi] feat: proxy content type in controller factory https://github.com/strapi/strapi/pull/177722) @​Marc-Roig
• [typescript] Fix circular dependency caused by Attribute.UID in Attribute.Any https://github.com/strapi/strapi/pull/175699) @​Convly

🚨 Security

• [core:utils] Add validate utility and use it to validate query params in API controllers https://github.com/strapi/strapi/pull/176399) @​innerdvations
• [plugin:users-permissions] [U&P] Add allowedFields configuration optiohttps://github.com/strapi/strapi/pull/17804804) @​innerdvations

⚙️ Chore

• [core:admin] Revert "Chore: Refactor admin app entries" https://github.com/strapi/strapi/pull/178533) @​gu-stav
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/178255) @​dependabot
• [dependencies] chore(deps): bump axios from 1.4.0 to 1.5.0 https://github.com/strapi/strapi/pull/178277) @​dependabot
• [dependencies] chore(deps): bump node-fetch from 2.6.9 to 2.7.0 https://github.com/strapi/strapi/pull/178288) @​dependabot

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.13.0

Compare Source

v4.12.7

Compare Source

• Revert to v4.12.5 due to high severity issue.

v4.12.6

Compare Source

⚙️ Chore

• [core:admin] added support for Valencian locale https://github.com/strapi/strapi/pull/175355) @​x3r0z
• [core:admin] Chore: Reorganize enterprise hooks https://github.com/strapi/strapi/pull/176733) @​gu-stav
• [core:admin] Chore: Refactor admin app entries https://github.com/strapi/strapi/pull/176744) @​gu-stav
• [dependencies] chore(deps-dev): bump @​rollup/plugin-node-resolve from 15.1.0 to 15.2.0 (https://github.com/strapi/strapi/pull/17716) @​dependabot
• [dependencies] chore(helper-plugin): setup dependabot pattern group, bump storybook https://github.com/strapi/strapi/pull/177211) @​gu-stav
• [external] Upgrade mysql2 client to 3.6.0 for CI https://github.com/strapi/strapi/pull/175922) @​innerdvations
• [plugin:users-permissions] Chore: Refactor roles list, create and edit pages https://github.com/strapi/strapi/pull/176500) @​gu-stav
• [tooling] Remove upload-artifact for playwright-reports https://github.com/strapi/strapi/pull/176977) @​innerdvations
• [typescript] chore(@​​strapi/typescript-utils): add repository info to packagehttps://github.com/strapi/strapi/pull/17488l/17488) @​douglasduteil

📖 Documentation

• [docs] Fix Strapi dark and light mode images on readme https://github.com/strapi/strapi/pull/176811) @​innerdvations

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.12.5

Compare Source

🔥 Bug fix

• [core:admin] Fix: Disable noImplicitAny until the admin app can be typed https://github.com/strapi/strapi/pull/176455) @​gu-stav
• [core:admin] Fix: Ensure fresh data for list and edit-views (api-tokens, users) https://github.com/strapi/strapi/pull/176688) @​gu-stav
• [core:content-manager] fix: remove fixed id binding in WYSIWYG https://github.com/strapi/strapi/pull/168222) @​gitstart
• [core:content-manager] Go to the last page if current page doesn't exist https://github.com/strapi/strapi/pull/175899) @​Feranchz
• [core:content-manager] Fix - Navigation between single types in the Content Manager https://github.com/strapi/strapi/pull/176000) @​jhoward1994
• [core:helper-plugin] fix: cannot clear date-field https://github.com/strapi/strapi/pull/175999) @​joshuaellis

⚙️ Chore

• [core:admin] translate en to zh-Hans by using claude.ai https://github.com/strapi/strapi/pull/173000) @​smoothdvd
• [core:content-manager] Fix: Remove configure the view confirmation https://github.com/strapi/strapi/pull/176655) @​gu-stav
• [core:helper-plugin] chore: update storybook to v7 https://github.com/strapi/strapi/pull/176322) @​joshuaellis
• [dependencies] chore: update ds to 1.9.0 https://github.com/strapi/strapi/pull/176211) @​joshuaellis
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/176622) @​dependabot
• [dependencies] chore(deps-dev): bump lint-staged from 13.2.2 to 13.3.0 https://github.com/strapi/strapi/pull/176644) @​dependabot
• [plugin:i18n] Update ru.json in i18n plugin https://github.com/strapi/strapi/pull/175166) @​hide-me

💅 Enhancement

• [core:admin] fix: ListView in ApiTokens and TransferTokens shows empty content table https://github.com/strapi/strapi/pull/176099) @​bogdaaamn

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.12.4

Compare Source

⚙️ Chore

• [core:admin] Chore: Consolidate useAdminRoles and useAdminRolePermissions hooks https://github.com/strapi/strapi/pull/175277) @​gu-stav
• [core:admin] Chore: Move marketplace and plugins hooks into their page contexts https://github.com/strapi/strapi/pull/175333) @​gu-stav
• [core:helper-plugin] chore: setup helper-plugin for TS conversion https://github.com/strapi/strapi/pull/174600) @​joshuaellis
• [dependencies] chore: bump strapi/eslint-config to 0.2.0 https://github.com/strapi/strapi/pull/174866) @​joshuaellis
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/175888) @​dependabot
• [tooling] Chore: Enforce build sourcemaps with an environment variable https://github.com/strapi/strapi/pull/174588) @​gu-stav

🔥 Bug fix

• [core:admin] [Fix] Bulk publish: show the count of already published entrieshttps://github.com/strapi/strapi/pull/1754545) @​simotae14
• [core:admin] Support cellformatter in ListView table https://github.com/strapi/strapi/pull/175900) @​markkaylor
• [core:content-manager] fix: save component's view configuration https://github.com/strapi/strapi/pull/175799) @​MonsterDeveloper
• [core:upload] fix(upload): Use native fetch over API client for downloadFile https://github.com/strapi/strapi/pull/175133) @​gu-stav
• [core:upload] Fix : Media Library List View navigation https://github.com/strapi/strapi/pull/175655) @​noobCode-69
• [typescript] Fix sanitizeQuery types https://github.com/strapi/strapi/pull/175566) @​christiancp100

📖 Documentation

• [docs] Docs: add audit logs to contributor docs https://github.com/strapi/strapi/pull/175222) @​Feranchz
• [docs] Update: README files with new links + Strapi Cloud option https://github.com/strapi/strapi/pull/175444) @​Mcastres

---

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.12.2

Compare Source

v4.12.1

Compare Source

⚠️ Security Warning and Notice ⚠️

Strapi was made aware of a few vulnerabilities that were patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure.

For now the delay timeline looks like we will release the detailed information in the next four (4) weeks, we expect to do public disclosure (via a blog post) on Wednesday Aug 30th, 2023.

⚙️ Chore

• [core:admin] Chore: Drop getRequestUrl from the admin app https://github.com/strapi/strapi/pull/174399) @​gu-stav
• [core:admin] Chore: Move marketplace and plugins hooks into their page contexts https://github.com/strapi/strapi/pull/175333) @​gu-stav
• [core:content-manager] Chore: Inline fetch functions and drop getRequestUrl from content-manager https://github.com/strapi/strapi/pull/174377) @​gu-stav
• [core:content-manager] Chore: Drop lodash from configure the view page https://github.com/strapi/strapi/pull/174388) @​gu-stav
• [core:content-manager] Chore: Cleanup configure the view styles https://github.com/strapi/strapi/pull/174400) @​gu-stav
• [core:strapi] Drop Node 14 support, add Node 20 https://github.com/strapi/strapi/pull/165577) @​innerdvations
• [dependencies] chore(deps): bump winston from 3.9.0 to 3.10.0 https://github.com/strapi/strapi/pull/172688) @​dependabot
• [dependencies] Update semver to remove audit warnings https://github.com/strapi/strapi/pull/174499) @​derrickmehaffy
• [dependencies] chore(deps-dev): bump the eslint group with 3 updates https://github.com/strapi/strapi/pull/175077) @​dependabot
• [dependencies] chore(deps-dev): bump core-js from 3.31.0 to 3.32.0 https://github.com/strapi/strapi/pull/175088) @​dependabot
• [docs] Fix some spelling and standardiZe regional usages https://github.com/strapi/strapi/pull/174911) @​innerdvations
• [tooling] tests(e2e): init playwright, add small test suite & cli https://github.com/strapi/strapi/pull/148077) @​alexandrebodin

💅 Enhancement

• [core:content-manager] Add case insensitive filters to content manager https://github.com/strapi/strapi/pull/169600) @​marob
• [core:content-manager] Feat: Add creator fields as filter options https://github.com/strapi/strapi/pull/170433) @​Feranchz
• [core:data-transfer] [DTS] Add detail to ws upgrade errorhttps://github.com/strapi/strapi/pull/1745252) @​innerdvations
• [core:utils] Wildcard populate performance optimizations https://github.com/strapi/strapi/pull/165077) @​Convly
• [generators:app] fix: Update env.example https://github.com/strapi/strapi/pull/165700) @​xiaotiandada

🔥 Bug fix

• [core:admin] Fix: Registration - Send null for lastname instead of empty string https://github.com/strapi/strapi/pull/174622) @​gu-stav
• [core:data-transfer] Fix data transfer relations https://github.com/strapi/strapi/pull/174755) @​christiancp100
• [core:review-workflows] fix: reorder rw permissions so they appear as CRUD https://github.com/strapi/strapi/pull/174933) @​Marc-Roig
• [core:review-workflows] fix: Content API partial update fails when not populating stage field https://github.com/strapi/strapi/pull/175122) @​Marc-Roig
• [core:upload] fixed: Media Library - Can`t delete empty folder #​17263 (https://github.com/strapi/strapi/pull/17280) @​noobCode-69
• [core:upload] Update media thumbnails on replace https://github.com/strapi/strapi/pull/174555) @​jhoward1994
• [core:upload] Fix: Upload assets from url https://github.com/strapi/strapi/pull/174599) @​Feranchz
• [tooling] Fix intermittently failing API tests by using consistent versions of sqlite packages https://github.com/strapi/strapi/pull/174900) @​innerdvations

---

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.12.0

Compare Source

🚀 New feature

• [core:admin, core:review-workflows] Feature: Multiple review workflows https://github.com/strapi/strapi/pull/167555) @​gu-stav
• [core:admin] Feature: Improved Bulk Publish https://github.com/strapi/strapi/pull/171855) @​markkaylor

⚙️ Chore

• [core:admin] Chore: Split user RBAC permissions from useLicenseLimits hook https://github.com/strapi/strapi/pull/172855) @​gu-stav
• [dependencies] chore(deps): bump semver from 7.5.1 to 7.5.2 https://github.com/strapi/strapi/pull/170900) @​dependabot
• [dependencies] chore(deps): bump word-wrap from 1.2.3 to 1.2.4 https://github.com/strapi/strapi/pull/173644) @​dependabot
• [dependencies] chore(deps): bump sanitize-html from 2.10.0 to 2.11.0 https://github.com/strapi/strapi/pull/174155) @​dependabot
• [dependencies] chore(deps): bump aws-sdk from 2.1415.0 to 2.1420.0 https://github.com/strapi/strapi/pull/174177) @​dependabot
• [plugin:documentation] refactor: documentation tests https://github.com/strapi/strapi/pull/173688) @​joshuaellis

💅 Enhancement

• [core:admin] Chore: Give precedence to error.message over error.details https://github.com/strapi/strapi/pull/173544) @​gu-stav
• [core:admin] Feat: Add RBAC permissions for review-workflow settings pages https://github.com/strapi/strapi/pull/173588) @​gu-stav
• [core:review-workflows] Multiple Workflows - Tracking events https://github.com/strapi/strapi/pull/172944) @​jhoward1994
• [providers] Chunk Cloudinary uploads only for large files https://github.com/strapi/strapi/pull/171599) @​goodhoko

🔥 Bug fix

• [core:admin] admin lastname defaults to undefined https://github.com/strapi/strapi/pull/173199) @​fbalhawan
• [core:admin] [SSO] Accept null value for ssoLockedRoleshttps://github.com/strapi/strapi/pull/1734141) @​innerdvations
• [core:admin] [SSO] allow defaultRole to be nullable when autoRegister is falsehttps://github.com/strapi/strapi/pull/1738787) @​innerdvations
• [core:admin] [bulk publish] Deselect the entries that were published from the list viewhttps://github.com/strapi/strapi/pull/1740202) @​markkaylor
• [core:admin] [bulk publish] Set page size to the number of selected entrieshttps://github.com/strapi/strapi/pull/1740505) @​markkaylor
• [core:content-manager] Bulk Publish: fix Select All not working inside the Modal https://github.com/strapi/strapi/pull/174033) @​simotae14
• [core:admin] [bulk publish] Move edit icon to the right in the Modalhttps://github.com/strapi/strapi/pull/1742323) @​simotae14
• [core:admin] [bulk publish] Change published label in the modalhttps://github.com/strapi/strapi/pull/1742626) @​simotae14
• [core:admin] Bulk publish: fix, enable countManyEntriesDraftRelations API only when you have selected entries in the modal https://github.com/strapi/strapi/pull/174288) @​simotae14
• [core:admin] [bulk publish] Remove sorting from the bulk publish modalhttps://github.com/strapi/strapi/pull/1743131) @​simotae14
• [core:admin] Await for isSsoLocked promise, fix #​17409 (https://github.com/strapi/strapi/pull/17410) @​wtchnm
• [core:content-manager] Fix error on adding relations https://github.com/strapi/strapi/pull/173400) @​hasebsiddiqui
• [core:content-manager] fix: display & clone relations in components https://github.com/strapi/strapi/pull/173633) @​joshuaellis
• [core:database] fix: relations are not returned in the correct order https://github.com/strapi/strapi/pull/172622) @​Marc-Roig
• [core:strapi] Fix command not mounting the routes correctly https://github.com/strapi/strapi/pull/173966) @​alexandrebodin
• [core:utils] Fix Strapi utils with ts migration https://github.com/strapi/strapi/pull/173800) @​alexandrebodin

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.11.7

Compare Source

Skipping v4.11.6 due to publication errors

🔥 Bug fix

• [core:admin] Add cellFormatter support https://github.com/strapi/strapi/pull/173477) @​markkaylor
• [core:admin] Fix: Remove @​strapi/babel-plugin-switch-ee-ce again (https://github.com/strapi/strapi/pull/17353) @​gu-stav
• [core:content-manager] fix(i18n): entity locale actions were aimed at default locale https://github.com/strapi/strapi/pull/173355) @​joshuaellis
• [core:content-type-builder] add translation for aria-label https://github.com/strapi/strapi/pull/172711) @​nitinmadelyn
• [core:data-transfer] Transfer assets to and from external providers https://github.com/strapi/strapi/pull/171055) @​Bassel17
• [core:helper-plugin] fix(helper-plugin): useRBAC needs to recalc if the userPermissions argument changes (https://github.com/strapi/strapi/pull/17333) @​joshuaellis
• [core:strapi] Return routes once only https://github.com/strapi/strapi/pull/172900) @​alexandrebodin
• [plugin:i18n] Do not try to add API endpoint for content type plugins using i18N https://github.com/strapi/strapi/pull/172700) @​alexandrebodin

⚙️ Chore

• [core:admin] Chore: Drop babel ee_else_ce plugin and babel from @​strapi/admin (https://github.com/strapi/strapi/pull/17206) @​gu-stav
• [core:admin] refactor: remove simple menu v1 https://github.com/strapi/strapi/pull/172144) @​joshuaellis
• [dependencies] chore: update ds to 1.8.2 https://github.com/strapi/strapi/pull/172655) @​joshuaellis
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/172677) @​dependabot
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/173266) @​dependabot
• [dependencies] chore(deps-dev): bump nx from 16.4.0 to 16.5.2 https://github.com/strapi/strapi/pull/173299) @​dependabot

---

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.11.6

Compare Source

v4.11.5

Compare Source

⚙️ Chore

• [core:admin] Chore: Refactor useLicenseLimits() hook https://github.com/strapi/strapi/pull/170500) @​gu-stav
• [core:admin] Add params serializer https://github.com/strapi/strapi/pull/170744) @​markkaylor
• [core:admin] Chore: Remove unique identifier https://github.com/strapi/strapi/pull/171266) @​Mcastres
• [core:admin] Chore: Apply default color to ReviewWorkflowsColumn https://github.com/strapi/strapi/pull/172133) @​gu-stav
• [core:content-manager] chore: remove step from time configure view modal https://github.com/strapi/strapi/pull/171555) @​joshuaellis
• [core:helper-plugin] chore: refactor helper-plugin tests & PaginationURLQuery https://github.com/strapi/strapi/pull/171833) @​joshuaellis
• [dependencies] chore(deps-dev): bump lerna from 6.5.1 to 6.6.2 https://github.com/strapi/strapi/pull/167855) @​dependabot
• [dependencies] chore(deps): bump graphql-scalars from 1.20.1 to 1.22.2 https://github.com/strapi/strapi/pull/170177) @​dependabot
• [dependencies] chore(deps-dev): bump the jest group with 4 updates https://github.com/strapi/strapi/pull/171899) @​dependabot
• [dependencies] chore(deps): bump the webpack group with 1 update https://github.com/strapi/strapi/pull/171911) @​dependabot
• [dependencies] chore(deps-dev): bump stylelint from 13.13.1 to 15.10.1 https://github.com/strapi/strapi/pull/172355) @​dependabot
• [dependencies] chore(deps-dev): bump jest-environment-jsdom from 29.5.0 to 29.6.1 https://github.com/strapi/strapi/pull/172400) @​dependabot
• [dependencies] chore(deps-dev): bump @​typescript-eslint/eslint-plugin from 5.59.1 to 5.61.0 (https://github.com/strapi/strapi/pull/17241) @​dependabot
• [dependencies] chore(deps): bump react-redux from 8.0.5 to 8.1.1 https://github.com/strapi/strapi/pull/172422) @​dependabot
• [dependencies] chore(deps-dev): bump the eslint group with 2 updates https://github.com/strapi/strapi/pull/172477) @​dependabot
• [tooling] Update Yarn to v3.6.1 https://github.com/strapi/strapi/pull/170644) @​smorimoto
• [tooling] Chore: Group dependabot updates https://github.com/strapi/strapi/pull/171844) @​gu-stav
• [tooling] Chore: Improve and extend dependabot groups https://github.com/strapi/strapi/pull/172433) @​gu-stav

💅 Enhancement

• [core:admin] Chore: Refactor CM list-view review-workflow columns to use useEnterprise https://github.com/strapi/strapi/pull/170477) @​gu-stav
• [core:admin] Enhancement: Add a getFeature convenience method to the useLicenseLimit hook https://github.com/strapi/strapi/pull/171988) @​gu-stav
• [core:content-type-builder] Add link(back icon) on Add Another Field popup to improve user experience (https://github.com/strapi/strapi/pull/17062) @​nitinmadelyn
• [typescript] feat: Add an any type for strapi.admin https://github.com/strapi/strapi/pull/171755) @​boazpoolman

🔥 Bug fix

• [core:admin] Fix bug #​17187: updated the handleClick function (https://github.com/strapi/strapi/pull/17188) @​noobCode-69
• [core:admin] fix: only run the query if sso is enabled https://github.com/strapi/strapi/pull/172177) @​joshuaellis
• [core:admin] Fix settings menu permissions in CE https://github.com/strapi/strapi/pull/172377) @​noobCode-69
• [core:data-transfer] Delete merge presence in data transfer strategies https://github.com/strapi/strapi/pull/172155) @​christiancp100
• [core:upload] fix: CM media-input browsing https://github.com/strapi/strapi/pull/172533) @​joshuaellis
• [plugin:i18n] fix: i18n CM EditView locale selector flex gap https://github.com/strapi/strapi/pull/171955) @​joshuaellis

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚
• ⚠️ If you experience no assets visible at the root of the Media Library please check this migration guide ⚠️

v4.11.4

Compare Source

⚙️ Chore

• [core:content-manager] Remove unnecessary code replaced by sanitize https://github.com/strapi/strapi/pull/171088) @​alexandrebodin
• [core:helper-plugin] chore: remove react-select usage from RelationInput https://github.com/strapi/strapi/pull/166711) @​joshuaellis
• [core:utils] Init utils in ts https://github.com/strapi/strapi/pull/169388) @​alexandrebodin
• [dependencies] Bump webpack-bundle-analyzer from 4.8.0 to 4.9.0 https://github.com/strapi/strapi/pull/171644) @​dependabot
• [dependencies] Bump aws-sdk from 2.1399.0 to 2.1409.0 https://github.com/strapi/strapi/pull/171655) @​dependabot
• [dependencies] chore: update DS to 1.8.1 https://github.com/strapi/strapi/pull/171699) @​joshuaellis
• [docs] Fix broken links in contributor docs https://github.com/strapi/strapi/pull/171144) @​innerdvations
• [tooling] Bump jest versions to 29.5 and ts-jest to 29.1 https://github.com/strapi/strapi/pull/167022) @​innerdvations

🔥 Bug fix

• [core:admin] fix: Update lastUsedAt once an hour https://github.com/strapi/strapi/pull/170999) @​Marc-Roig
• [core:admin] fix bug on Settings > Documentation & Advanced setting tab while saving https://github.com/strapi/strapi/pull/171100) @​nitinmadelyn
• [core:admin] Fix : Content manager shows 403 (permissions error) on page reload https://github.com/strapi/strapi/pull/171211) @​geeky-biz
• [core:admin] [ADMIN] fix bug on saving user detailshttps://github.com/strapi/strapi/pull/1714141) @​nitinmadelyn
• [core:content-manager] EE Fix missing review workflows column https://github.com/strapi/strapi/pull/171311) @​markkaylor
• [core:content-type-builder] fix: Content-Type-Builder removes hidden fields on save https://github.com/strapi/strapi/pull/168255) @​gitstart
• [core:data-transfer] Optimise pull transfer for entities, configurations, links and assets https://github.com/strapi/strapi/pull/171222) @​christiancp100
• [core:database] Fix date parser https://github.com/strapi/strapi/pull/172044) @​christiancp100
• [core:helper-plugin] fix: remove parseISO and just use native Date instead https://github.com/strapi/strapi/pull/171177) @​joshuaellis
• [core:helper-plugin] refactor: useRBAC hook to stop infinite loop https://github.com/strapi/strapi/pull/171400) @​joshuaellis
• [core:review-workflows] migration FIX: Review Workflows webhooks blitz bugs https://github.com/strapi/strapi/pull/171288) @​jhoward1994
• [core:upload] fix: Preview issue after image replacement https://github.com/strapi/strapi/pull/170955) @​danishjoseph
• [core:upload] refactor: useAsset query to use folderPath https://github.com/strapi/strapi/pull/171544) @​joshuaellis
• [core:utils] Fix entity-service filter $between operator to allow Date objects https://github.com/strapi/strapi/pull/171399) @​innerdvations
• [plugin:graphql] Fix GraphQL pagination results https://github.com/strapi/strapi/pull/171433) @​innerdvations
• [plugin:i18n] add transformParamsToQuery back to fix error https://github.com/strapi/strapi/pull/171277) @​Boegie19

📖 Documentation

• [docs] [DTS] Contributor docs for data-transfer packagehttps://github.com/strapi/strapi/pull/1695353) @​innerdvations
• [docs] doc: examples of async utils https://github.com/strapi/strapi/pull/171377) @​Marc-Roig

---

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚
• ⚠️ If you experience no assets visible at the root of the Media Library please check this migration guide ⚠️

v4.11.3

Compare Source

💅 Enhancement

• [core:admin] Enhancement: Replace ee_else_ce imports with useEnterprise in settings - users https://github.com/strapi/strapi/pull/169955) @​gu-stav
• [core:admin] Enhancement: Replace ee_else_ce imports with useEnterprise in auth https://github.com/strapi/strapi/pull/169966) @​gu-stav
• [core:content-manager] [Enhancement]: Clone entity relations on the serverhttps://github.com/strapi/strapi/pull/1619292) @​Marc-Roig

🔥 Bug fix

• [core:admin] [ADMIN] Prevent unnecessary api calls on profile savehttps://github.com/strapi/strapi/pull/1710202) @​nitinmadelyn
• [core:admin] Memoize permissions https://github.com/strapi/strapi/pull/171255) @​Marc-Roig
• [core:content-manager] Maintain consistent backend validation for publish and bulk publish https://github.com/strapi/strapi/pull/170266) @​markkaylor
• [core:content-manager] Fix: Improve stage change success notification https://github.com/strapi/strapi/pull/170499) @​gu-stav
• [core:content-manager] Fix bulk publish removed https://github.com/strapi/strapi/pull/170699) @​markkaylor
• [core:content-manager] Fix bulk publish padding https://github.com/strapi/strapi/pull/170766) @​markkaylor
• [core:content-manager] fix: Cannot save "required" dynamic-zone or component https://github.com/strapi/strapi/pull/171122) @​Marc-Roig
• [core:content-manager] fix: Clone entities Not Found Error https://github.com/strapi/strapi/pull/171133) @​Marc-Roig
• [core:upload] fix: media library multiple selection https://github.com/strapi/strapi/pull/168022) @​damuso
• [typescript] Fix/overlapping date type https://github.com/strapi/strapi/pull/170300) @​LuizPelegrini

⚙️ Chore

• [core:admin] Chore: Move plugin permissions into constants https://github.com/strapi/strapi/pull/170344) @​gu-stav
• [core:admin] Chore: Move admin permissions into redux https://github.com/strapi/strapi/pull/170355) @​gu-stav
• [core:strapi] chore(telemetry): send event ID as a custom https://github.com/strapi/strapi/pull/170299) @​Baldinof
• [dependencies] chore(deps-dev): bump nx from 16.3.2 to 16.4.0 https://github.com/strapi/strapi/pull/170977) @​dependabot

📚 Update and Migration Guides

• General update guide can be found here
• Migration guides can be found here 📚

v4.11.2

Compare Source

🔥 Bug fix

• [core:admin] FIX - Detect is webhook form is dirty https://github.com/strapi/strapi/pull/170255) @​jhoward1994
• [core:content-manager] fix: RBAC conditions with relations https://github.com/strapi/strapi/pull/168144) [@​Marc-Roig

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.