April 2023 Summaries

In the first quarter of 2023, Strapi made significant advancements by releasing four minor updates and unveiling Strapi Cloud, which allows users to choose between self-hosting or using the cloud service. Key new features include seamless data migration with the Data Export, Import, and Transfer tool, enhanced security with support for Private S3 buckets, and the introduction of Audit Logs for better compliance and team collaboration. The community contributed actively, with content creators publishing 14 articles and new team members joining the remote workforce, which now spans 15 countries. Looking ahead to the second quarter, Strapi plans to enhance TypeScript support with typed factories, improve the Rich Text Editor, introduce a Review Workflows feature, and allow deployment in new regions. The company remains committed to its open-source roots and invites participation in its upcoming StrapiConf 2023. Additionally, Strapi plans to add more real-world examples to its documentation and is enhancing back-end customization options, reflecting its dedication to community-driven development and continuous improvement.

Astro is a modern web framework built on React that provides lightning-fast performance with no JavaScript required for delivery, allowing websites to be entirely static while still supporting dynamic components. Next.js is an open-source React framework that adds structure and features to quickly create server-rendered React applications, offering pre-built techniques for data retrieval. Remix is an edge-native full-stack JavaScript framework that unifies client and server with web standards, providing a modern user experience without partial hydration support like Astro. All three frameworks have a low learning curve due to their React foundation and offer developer-friendly documentation.

On December 29th, 2022, a security researcher reported an SSTI (server-side template injection) vulnerability in the users-permissions plugin's email template system of Strapi. This vulnerability allowed malicious code execution via RCE (remote code execution). The scope was initially believed to be limited to those with access to the Strapi Admin Panel, but it was later found that unauthenticated users could exploit this vulnerability on all Strapi <=4.5.5 servers by chaining CVE-2023-22621 and CVE-2023-22894 together. Strapi has released patches for these vulnerabilities in versions 4.5.6, 4.6.0, and 4.8.0. The Strapi security team advises users to upgrade beyond v4.8.0 as quickly as possible due to other security vulnerabilities patched in those versions. To detect if your application was impacted by these vulnerabilities, review request log files for specific IoCs (Indicators of Compromise). For CVE-2023-22621, search for a PUT request to the URL path /users-permissions/email-templates. For CVE-2023-22894, use a regex pattern to extract all ID tokens sent to /api/auth/cognito/callback and verify each token using the public key file for your AWS Cognito user pool. The Strapi security team thanks GhostCcamm for their diligent work in discovering these vulnerabilities and assisting with responsible disclosure. They encourage anyone who believes they have discovered a security vulnerability to report it responsibly by emailing [email protected].

Last week's refine ft Strapi event introduced developers to the powerful combination of refine, a React-based framework, and Strapi, a headless Content Management System (CMS), for building customizable applications, particularly a React PDF Invoice Generator. The event featured a series of articles detailing the use of these technologies alongside Ant Design to create an application capable of handling CRUD operations, user authentication, and PDF rendering. Refine simplifies CRUD web application development and supports integrations with various back-end services like Strapi, while Strapi offers a customizable admin panel and API for content management. Both technologies provide straightforward setup processes, with refine offering built-in connectors and Strapi enabling self-hosting or cloud deployment options. The tutorials showcased the practical applications of these tools for various professionals, including small business owners and freelancers, by guiding them through architecture, setup, CRUD implementation, and the addition of user authentication and PDF rendering to create a functional invoice generator application.

npx create-strapi-app my-project` command can be used to create a new Strapi project. Next.js and SvelteKit are two popular web development frameworks that offer various benefits and drawbacks when building Strapi applications. Next.js is a free and open-source framework based on the React library, offering features like automatic code splitting, client-side and server-side rendering, and optimized performance. It provides full-stack functionality to the front-end and has an integrated development server and supports hot module replacement. However, it also has some potential drawbacks, such as requiring more control over application configuration. SvelteKit is a framework for developing web applications with Svelte, offering simplicity and ease of use. It makes creating fast, server-rendered web applications easier with minimal configuration and provides built-in support for deployment to various platforms. Both frameworks have similar deployment options, but Next.js approaches deployment differently. Ultimately, the choice between Next.js and SvelteKit depends on personal preference, project requirements, and team familiarity.

Strapi, an open-source headless CMS based on Node.js, allows developers to manage content using RESTful APIs or GraphQL, and can be easily set up with simple commands. While Strapi's built-in Cron Jobs feature is effective for single-instance applications, it presents challenges when scaling horizontally, as it triggers tasks on all instances simultaneously, leading to potential issues like race conditions. To address this, the article outlines how to set up external Cron Jobs using Linux Crontab or GitHub Actions to avoid conflicts by triggering tasks through custom routes and controllers in Strapi. The process involves creating and configuring custom routes and controllers within Strapi, and then using external services to schedule and trigger these tasks, ensuring efficient operation even when the application is scaled across multiple servers.

The text provides a detailed guide on building a meme generator application using React and Strapi. It outlines the process of setting up a React front-end and a Strapi back-end, emphasizing the synergy between React's component-based architecture for dynamic user interfaces and Strapi's headless CMS capabilities for easy data management. The tutorial includes step-by-step instructions for setting up the development environment, creating necessary directories and files, and integrating both technologies to fetch and display meme images. Strapi's media library is highlighted as a tool for uploading and managing images, while the Populate parameter is used to retrieve media assets through the Strapi API. The guide concludes with instructions on running both the React and Strapi applications, illustrating how users can generate memes by loading random images and adding customizable text.

Noémie, a Talent Acquisition Manager at Strapi, shares her journey of working remotely from Portugal after joining the company in February 2022. Initially planning to explore the US in 2020, her plans were disrupted by the COVID-19 pandemic, leading her to discover the appeal of remote work, which she found at Strapi. She was impressed by the company's openness to employees working from different countries, provided legal requirements were met, which aligned with her desire for geographical flexibility. Her fluency in Spanish and interest in Portuguese culture led her to choose Portugal as her remote work location. Strapi facilitated her move, although it did not cover relocation costs, allowing her to maintain her work routine seamlessly from Lisbon, where she continued her recruitment duties and even earned a promotion. Her experience in Lisbon, professionally unchanged yet personally enriching, underscored the value of remote work opportunities and highlighted the trust and dedication required for such arrangements. She expresses gratitude for the chance to immerse herself in a new culture while continuing to contribute to Strapi's international team.

You can create a new Strapi project by simply copying and pasting the command line `npx create-strapi-app my-project` in your terminal. The upcoming Strapi Netherlands Meetup, organized by Smartshore Ability, will cover topics such as customizing Strapi, deploying it to Strapi Cloud, and increasing ecommerce conversion rates with quizzes. Attendees will have the chance to ask questions to three Strapi experts and learn about the latest features of Strapi Cloud, a fully managed platform that can boost team velocity. The event is a must-attend for anyone interested in Strapi and its capabilities, offering valuable insights and knowledge-sharing opportunities.

You can set up an external email provider on Strapi Cloud using Sendgrid by following a series of steps including verifying your domain-specific email, creating an API key, installing the `@strapi/provider-email-sendgrid` provider, configuring it with your API key and verified email address, setting environment variables in your `.env` file, pushing the changes to Strapi Cloud, and updating the variables on Strapi Cloud. Once these steps are completed, you can use your custom SendGrid email provider to send emails through your Strapi application. The process allows for seamless integration of external email services with Strapi Cloud, enabling users to boost their team's velocity and enhance their project's functionality.