Concerns: pushword/admin, pushword/admin-block-editor, pushword/api, pushword/core
The multi-upload, inline editing, the block editor and POST/PATCH /api/media now validate the whole media, as the admin form did, and refuse an invalid one (422) instead of saving it. Sites mapping their own constraints onto Media: these now apply on those paths too — see Media rules. API clients: handle 422 {"error": "validation", "violations": […]}.
A MediaPreRemoveEvent listener can keep a media from the admin delete, the multi-upload delete, DELETE /api/media (409) and pw:media:clean-unused, which reports it under refused. Nothing to do without a listener — see Media rules.
A credit or other license value typed in the admin form, or sent in customProperties with an API upload, is now kept instead of being replaced by the file’s embedded rights. Nothing to do — see image license.