Strapi v5.53.0 — Release Notes & Engineering Impact

### :warning: Security Warning and Notice :warning: Strapi was made aware of a vulnerably that were patched in this release, for now we are going to delay the detailed disclosure of the exact details on how to exploit it and how it was patched to give time for users to upgrade before we do public disclosure. ## 5.53.0 (2026-09-09) ### 🚀 New feature - Add an export audit logs button ([#27427](https://github.com/strapi/strapi/pull/27427)) - **content-releases:** record release actions in audit logs ([#27436](https://github.com/strapi/strapi/pull/27436), [#27436](https://github.com/strapi/strapi/pull/27436)) ### 🔥 Bug fix - close the drawer on click on interactive elements ([4573d58806](https://github.com/strapi/strapi/commit/4573d58806)) - transfer configuration import discards the error that caused it ([#27565](https://github.com/strapi/strapi/pull/27565)) - misc users-permissions and admin ([2f3595fe61](https://github.com/strapi/strapi/commit/2f3595fe61)) - **content-type-builder:** default new private fields to not searchable ([#27482](https://github.com/strapi/strapi/pull/27482)) - **email-sendmail:** disable file and URL access for attachments ([#27430](https://github.com/strapi/strapi/pull/27430)) - **mcp:** bump mcp sdk@2 to stop clients droping advertised tools ([#27505](https://github.com/strapi/strapi/pull/27505)) - **strapi:** --sourcemap flag has no effect on the admin build ([#27545](https://github.com/strapi/strapi/pull/27545)) - **upload:** reserve list space for the bulk actions bar ([#27509](https://github.com/strapi/strapi/pull/27509)) - **upload:** filter the row replace picker by the asset's mime ([#27508](https://github.com/strapi/strapi/pull/27508)) - **upload:** bound the focal point fields to the crop area ([#27496](https://github.com/strapi/strapi/pull/27496)) - **upload:** folder navigation resets media library list scroll and p… ([#27449](https://github.com/strapi/strapi/pull/27449)) - **upload:** keep the drawer open when a control behind is pressed ([3ebdde0965](https://github.com/strapi/strapi/commit/3ebdde0965)) - **upload:** only a primary-button press dismisses the drawer ([3b81103657](https://github.com/strapi/strapi/commit/3b81103657)) - **upload:** contain fast provider rejections in upload batches ([#27543](https://github.com/strapi/strapi/pull/27543)) ### ⚙️ Chore - release v5.52.3 update develop ([2695ff53ff](https://github.com/strapi/strapi/commit/2695ff53ff)) - **.github/draft-release:** run the workflow more than once per release ([#27573](https://github.com/strapi/strapi/pull/27573)) - **ci:** pin all GitHub Actions to latest versions by commit SHA ([37d9438606](https://github.com/strapi/strapi/commit/37d9438606)) - **ci:** add the draft-release action and workflow ([#27562](https://github.com/strapi/strapi/pull/27562)) - **deps:** bump undici from 6.28.0 to 6.28.1 ([#27568](https://github.com/strapi/strapi/pull/27568)) - **lint:** make oxlint a blocking ci gate ([#27450](https://github.com/strapi/strapi/pull/27450)) ### ⚠️ Changes to be aware of #### MCP clients no longer drop advertised tools The built-in MCP server now advertises tools as JSON Schema 2020-12, so strict clients that previously dropped every tool keep the full list. If you register custom MCP tools or prompts: unknown or unauthorized tool calls now return JSON-RPC error `-32602` instead of `isError: true`; `extra.sendNotification` and `extra.sendRequest` are gone; and one prompt `argsSchema` that cannot become JSON Schema (for example `z.date()`) hides every prompt from `prompts/list`. ([#27505](https://github.com/strapi/strapi/pull/27505)) ### ❤️ Thank You - Adrien L @Adzouz - Adrien Lepoutre @Adzouz - Andrei L @unrevised6419 - Arthur Moreau - Bassel Kanso - Gonzalo Andres Garcia @gonbaum - Jamie Howard @jhoward1994 - Jan Kahmen @kah-ja - Moutaz-homsi - Nico André - Simon Norris