Skip to Content
Strapi Page Builder 1.2 is now available 🎉

Upgrading to 1.2

Version 1.2 of @wecre8websites/strapi-page-builder-react and the Strapi plugin closes a security problem in 1.1 and earlier, and fixes a number of bugs. For most projects the upgrade needs no code changes.

Upgrade steps

  1. Update the Strapi plugin and rebuild Strapi:

    npm install @wecre8websites/strapi-page-builder@latest
npm run build

  2. Update the React library in your web app:

    npm install @wecre8websites/strapi-page-builder-react@latest

  3. Make sure your editor route and pages that use <Render /> are Server Components (the default in the Next.js App Router) and that your Next.js version is 15.5, or 16.4 and later (or 16.0 to 16.3 with --webpack).

  4. Run the secrets check against your editor route and a public page.

  5. Rotate your secrets if you ever deployed 1.1.2 or earlier with a public editor route, or used <Render strapi={{ authToken }} /> on a public page: revoke the API key on your account page, create a new Strapi API token, and update your environment.

  6. Optional but recommended: set allowedParentOrigin on <Editor /> and send a frame-ancestors header (details).

Update the plugin and the React library together. Either order works, and the new editor keeps working while the licence service is being updated.

What changed

Security

  • <Editor /> and <Render /> keep apiKey and authToken on the server (see Security). A page that used to contain them no longer does.
  • Editor tokens are validated on the server, expire after 12 hours, and the licence service no longer hands the list of valid tokens to newer editors.
  • The Strapi plugin now checks permissions: content lookups need Content Manager read access to that content type and never return user or admin content, saving settings needs the settings permission, and the API key is masked for users who cannot change settings. Template creation requires a valid content type.
  • Messages between Strapi and the editor are origin and source checked.

Fixes

  • Content from Strapi fields was resolved in the wrong language on pages rendered after the first locale; each render now uses its own locale.
  • Only the first Strapi field of a component was resolved; all of them are now, including inside arrays and objects.
  • Content types with irregular plurals (category) are looked up correctly; set pluralName for unusual ones.
  • The editor no longer asks to discard unsaved changes right after loading.
  • ServerRender with richtext fields. Puck 0.21 added its own richtext field type, which clashed with Page Builder’s rich text (a Strapi blocks array) when rendering on the server: blocks received a React element instead of their content and development builds crashed. Page Builder’s rich text now renders unchanged.
  • Template, content and duplicate-template pickers are searchable and no longer empty each other, and the Preview content picker shows the title of the entry that is open.
  • Following a link in the editor preview no longer takes the editor over: external links are ignored and internal links can open the matching entry (resolveLink).

Dependencies

  • The editor engine is now Puck  0.23 under its new package name, @puckeditor/core (it was @measured/puck). If your own code imports from @measured/puck, change the import. Everything you import from @wecre8websites/strapi-page-builder-react is unchanged. The editor shows a new Blocks/Outline rail on the left.
  • <DropZone> is deprecated. It keeps working; see migrating to slots.
  • The plugin’s peer range for @strapi/strapi is now ^5.31.2 instead of exactly 5.31.2, so it installs on newer Strapi 5 releases.

New

  • strapi-page-builder-check-secrets command, validateEditorToken helper (from /rsc), allowedParentOrigin prop, pluralName option on strapi fields.
  • strapi-page-builder-migrate-slots command and the PAGE_BUILDER_SLOT_MIGRATION setting.

Troubleshooting

The editor shows INVALID_TOKEN or an error about the licence server. Reload the editor from Strapi to get a fresh token (tokens expire after 12 hours). Check that the origin of your web app matches the editor URL in the Page Builder settings; development accounts can only use localhost and 127.0.0.1.

Strapi fields show an empty list for some editors. Give their role the Read permission on those content types.

The editor says “The editor’s server action was not found” (the browser shows a 404 for the /editor request and Next.js logs “Failed to find Server Action”). Next.js 16.0 to 16.3 with Turbopack, the default bundler in Next.js 16, does not register server actions that live inside a package. Upgrade to Next.js 16.4 or later, or run next dev --webpack / next build --webpack.

Last updated on
SecurityEditor Configuration