Impact Score: 5/10
Strapi v5.10.3 — Release Notes & Engineering Impact
Source available — automated, not human-reviewed
Component: strapi · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Strapi v5.10.3. Source highlight: :warning: Security Warning and Notice :warning:
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (6)
- 72 byte maximum for creating and updating passwords (41f8cdf116)
- do not validate byte length on empty values (9efe8c85f4)
- use path in error message (195eaa367f)
- validation on front-end forms (1f8e39868e)
- validation message shape (e07a466901)
- add max length to users-permissions password (5c1ae79cf1)
📄 View Raw Release Notes (Original Developer Log)
### :warning: Security Warning and Notice :warning:
Strapi was made aware of a vulnerably that were patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure.
## 5.10.3 (2025-02-19)
### 🔥 Bug fix
- 72 byte maximum for creating and updating passwords ([41f8cdf116](https://github.com/strapi/strapi/commit/41f8cdf116))
- do not validate byte length on empty values ([9efe8c85f4](https://github.com/strapi/strapi/commit/9efe8c85f4))
- use path in error message ([195eaa367f](https://github.com/strapi/strapi/commit/195eaa367f))
- validation on front-end forms ([1f8e39868e](https://github.com/strapi/strapi/commit/1f8e39868e))
- validation message shape ([e07a466901](https://github.com/strapi/strapi/commit/e07a466901))
- add max length to users-permissions password ([5c1ae79cf1](https://github.com/strapi/strapi/commit/5c1ae79cf1))
- note md format ([#22859](https://github.com/strapi/strapi/pull/22859))
- flaky tests ([#22829](https://github.com/strapi/strapi/pull/22829))
- password validation tests ([#22904](https://github.com/strapi/strapi/pull/22904))
- add new email ratelimit middleware and apply to admin pass reset ([#22813](https://github.com/strapi/strapi/pull/22813))
- apply advanced permissions in content manager home widgets ([#22921](https://github.com/strapi/strapi/pull/22921))
### ⚙️ Chore
- remove outdated tutorial ([6cde24cc98](https://github.com/strapi/strapi/commit/6cde24cc98))
- swap Download icon for Earth icon ([#22881](https://github.com/strapi/strapi/pull/22881))
- fix build:code not including copy-files step ([#22907](https://github.com/strapi/strapi/pull/22907))
- **deps:** bump undici from 6.19.2 to 6.21.1 ([#22697](https://github.com/strapi/strapi/pull/22697))
### ❤️ Thank You
- Alexandre BODIN @alexandrebodin
- Ben Irvin
- DMehaffy
- Jamie Howard @jhoward1994
- Marc-Roig
- markkaylor
- Rémi de Juvigny @remidej