Payload Release Notes

v4.0.0-beta.6 (2026-10-29)

🚀 Features

• support custom CLI error exit codes (#19079) (4bb6ed2)
• ui: always restore versions as drafts (#18892) (7d76f23)

🐛 Bug Fixes

• cpa: generate v4-compatible storage and sharp config (#19120) (e3ef5b2)
• db-d1-sqlite: register findDistinct on sqliteD1Adapter (#19128) (3784f7e)
• deps: bump sharp to 0.35.5 (#19117) (c17d081)
• drizzle: lazily load drizzle kit tooling (#17656) (33c7b83)
• plugin-multi-tenant: avoid duplicate tenant menu actions (#19174) (d704e1b)
• ui: resolve admin accessibility workflow failures (#19005) (9f31a13)

🛠 Refactors

• richtext-lexical: upgrade lexical to 0.53.0 (#19176) (84c49b1)

📚 Documentation

• clarify enhanced contrast checks in accessibility guidance (#19143) (ce7019a)

🧪 Tests

• make --no-turbo use webpack and remove no-op noturbo e2e scripts (#18701) (062fb8c)
• fix hierarchy join assertions for UUID ordering (#19084) (374b178)
• ui: cover autosave behavior with virtual fields (#18144) (278e629)

📝 Templates

• move dashboard onboarding into a widget (#19149) (b9827b6)

⚙️ CI

• update outdated script name (#19178) (ab23c49)
• audit dependencies daily on main and 3.x (#19119) (ca1189f)
• harden audit action against tool failures and invalid specs (#19121) (a6e8cd0)

🏡 Chores

• extend accessibility skill for new UI changes (#19147) (8fe1a0f)
• a11y test cleanup (#18845) (13cd09d)
• plugin-mcp: bump mcp sdk to 2.4.0 (#19038) (ae600cf)

⚠️ BREAKING CHANGES

• richtext-lexical: upgrade lexical to 0.53.0 (#19176) (84c49b1)

Review your Lexical usage on notes from the PR

🤝 Contributors

• Sasha (@r1tsuu)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jared McDonald (@jared-figma)
• Elliot DeNolf (@denolfe)
• Jessica Rynkar (@JessRynkar)
• Mohd Irshad (@siddiqueirshad)
• Nate Lentz (@nathanlentz)
• Jake Fletcher (@jacobsfletch)
• Dan Ribbens (@DanRibbens)

Original source

v4.0.0-beta.5 (2026-10-27)

🐛 Bug Fixes

• pass extra uploadReference fields as clientData (#19033) (cdb8ec4)
• public upload receipts with signed adapterData (#19032) (3355177)
• let plugins replace another plugin's options (#18762) (aebbf75)
• run the password field's validation on reset password (#19006) (0c74c77)
• graphql: exclude hidden fields from mutation inputs (#18862) (e442a3f)
• ui: preserve diagonal pointer travel into popup submenus (#18857) (786dffb)

📚 Documentation

• clarify development environment security expectations (#18829) (c787686)
• adds new batch of ui-component docs for v4 (#18786) (9098890)

🧪 Tests

• richtext-lexical: use accessible link field selectors (#19013) (4bc505c)

📝 Templates

• fix non-existent dependency versions (#18988) (57f3909)

⚙️ CI

• approve templates bump PR so auto-merge completes (#18990) (9301020)
• attach per-package SBOMs to beta releases (#18887) (fe81635)
• use the release environment for the templates PR (#18951) (de9bfa5)

⚠️ BREAKING CHANGES

• pass extra uploadReference fields as clientData (#19033) (cdb8ec4)

With receipts off, Payload used to pass uploadReference to handlers unchanged. Adapters that read extra fields from the top level must now read them from uploadReference.clientData. No first-party adapter is affected; they all use receipts.

🤝 Contributors

• Jake Fletcher (@jacobsfletch)
• Nate Lentz (@nathanlentz)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Dan Ribbens (@DanRibbens)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)

Original source

v3.92.1 (2026-10-27)

🐛 Bug Fixes

• localizeStatus PG migration db.execute signature (#16889) (05f4000)
• upload processed client files from temp file for upload-thing storage (#19010) (ea3778b)
• run the password field's validation on reset password (3.x) (#18980) (779f06f)
• graphql: port virtual fields should be nullable in GraphQL schema (#17256) (1a028cb)
• plugin-cloud-storage: store processed bytes for cropped and mislabeled client uploads (#18913) (6fc83d7)
• storage-vercel-blob: keep the receipt key for processed client uploads with addRandomSuffix (#18921) (f2cbc85)
• storage-vercel-blob: keep image-size filenames separate with addRandomSuffix (#18920) (8282414)
• storage-vercel-blob: upload processed client files from temp file (#18388) (210de57)

📚 Documentation

• clarify development environment security expectations (#18835) (dd19aae)
• update topic order for ui components (#18784) (bd538aa)

🧪 Tests

• email-nodemailer: use a local transport in integration tests (#19022) (5aceaec)

⚙️ CI

• upgrade playwright for ubuntu 26.04 on 3.x (#19071) (12f1d80)
• preview release notes on bump dry run (3.x) (#18981) (8bebfde)
• attach per-package SBOMs to releases (3.x) (#19014) (c42b3f1)
• use ubuntu-26.04 runners (3.x) (#19015) (fd11385)
• approve templates bump PR so auto-merge completes (3.x) (#18992) (8b31ddf)
• reduce releaser log noise (3.x) (#18982) (a574750)
• start only Supabase Postgres for 3.x integration tests (#18976) (ef1b739)

🏡 Chores

• configure coderabbit reviews (3.x) (#18985) (51fd560)
• skills: sync record-pr-demo with main (#19037) (33b9740)

🤝 Contributors

• Sasha (@r1tsuu)
• Jake Fletcher (@jacobsfletch)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Nate Lentz (@nathanlentz)
• Patrik (@PatrikKozak)

Original source

Payload 3.92.0 fixes validation across locales, improves join queries, and resolves a bulk upload callback issue, alongside an updated Node.js requirement.

Highlights

This release focuses on correctness across localized content and relationships. Writes using locale: 'all' now validate each locale, field access functions receive the document ID, and database fixes address joins across multiple collections and localized polymorphic relationships.

Also in this release:

• Localization: validates each locale when writing localized fields with locale: 'all'
• Access control: passes the document ID to field access functions
• MongoDB: supports limit: 0 in joins across multiple collections
• Drizzle: fixes filtering for localized polymorphic joins
• Admin UI: registers the bulk upload success callback each time the drawer opens
• Errors: preserves error names when application code is minified
• Dependencies: updates Undici to 7.30.1

Before you upgrade

This release raises the minimum supported Node.js version to 22.23.4. Node.js 24.22.1 and newer remain supported. Check your local, CI, and deployment environments before upgrading.

As always, you can review the complete changelog on GitHub.

Original source

v4.0.0-beta.4 (2026-10-22)

🚀 Features

• accessibility improvements related to contrast (#18354) (f597932)
• ui: open recents widget on recently viewed when nothing is pinned (#18747) (133be0f)

🐛 Bug Fixes

• bump undici to 7.30.1 (#18949) (20aa089)
• bump minimum node version to 24.22.1 (#18946) (26f56ad)
• cancel unused file transformer streams (#18952) (494de46)
• align global version restoration with collections (#18928) (d2ae5e6)
• pass document id to field access (#18270) (6df5547)
• preserve native detail in PR demo recordings (#18853) (9f7781e)
• db-mongodb: support limit 0 in joins across multiple collections (#18813) (2c7056e)
• drizzle: support localized filters in polymorphic joins (#18847) (debd218)
• richtext-lexical: preserve link drawer form state (#18858) (5bc6c58)
• ui: address remaining accessibility audit findings (#18631) (d597d57)
• ui: accessibility improvements related to names / labels (#18634) (77d2cbd)
• ui: preserve published content when restoring drafts (#18394) (4859c0b)
• ui: activity widget tab focus outline is clipped (#18918) (13041e7)
• ui: accessibility improvements related to tabs (#18619) (400c446)
• ui: accessibility improvements related to headings and labels (#18621) (bb87f54)
• ui: prevent column toggles from flickering during navigation (#18830) (c4ad7a1)
• ui: align tabs field labels with content (#18685) (b020b7f)
• ui: server-render the dashboard activity widget (#18721) (9c39e43)
• ui: accessibility improvements related to drag-reorder (#18624) (74e6f52)

⚡ Performance

• richtext-lexical: find lexical feature sub-fields without scanning the client field schema map (#18719) (582c25b)
• tanstack-start: up to 3x faster initial loads in dev (#18848) (7d60563)

🛠 Refactors

• consolidate server external package lists (#18911) (23c72cd)
• ui: rename the recents widget to activity widget (#18790) (7a747f6)

📚 Documentation

• explain admin text direction in i18n docs (#18832) (495c14a)

🎨 Styles

• replace eslint-plugin-react-compiler with oxlint's React Compiler rules (#18893) (bb658b0)
• replace eslint with oxlint (#18809) (dde9664)

🧪 Tests

• enable title column before opening a11y fixtures (#18942) (c4131e9)
• split a11y suite up into 3 shards (#18934) (44c67f5)
• ignore aborted TanStack server function streams in console error check (#18890) (b8c0b57)

🔨 Build

• bump babel-plugin-react-compiler to 1.0.0 (#18906) (238ed86)

⚙️ CI

• preserve integration test heap settings (#18923) (c990f18)
• grant cache lookup jobs actions read permission (#18865) (a4141d4)
• retry apt downloads in the visual regression job (#18889) (de2416c)
• back off with jitter when pulling service images (#18888) (e166848)
• upgrade pnpm to 11.28.6 (#18867) (aafb429)
• only dismiss stale approvals on pushes from contributors without write access (#18850) (962de78)
• reduce releaser log noise (#18842) (54d1331)
• bump templates to the released version on every release (#18728) (8bb893f)
• pick the release bump from the commits, require a reason to override (#18729) (103939e)
• preview release notes on bump dry run and harden release flow (#18796) (c2c9143)

🏡 Chores

• fix React Compiler lint errors (#18894) (d0d0a17)
• add lint commit to .git-blame-ignore-revs (#18841) (0801a43)
• lint everything using oxlint (#18811) (f564d02)
• rename eslint-config and eslint-plugin to oxlint-config and oxlint-plugin (#18808) (ea03555)
• richtext-lexical: re-enable @lexical/eslint-plugin (#18807) (d43175d)
• ui: remove unused widget card styles (#18922) (d0d407b)
• ui: refine activity widget card and pin styling (#18791) (7a4de76)
• ui: mark built-in dashboard widget exports as internal (#18799) (a2d26c5)

⚠️ BREAKING CHANGES

• bump minimum node version to 24.22.1 (#18946) (26f56ad)

  Raises the minimum supported Node.js version to 24.22.1.

• align global version restoration with collections (#18928) (d2ae5e6)

  Continuation of #13333.

• tanstack-start: up to 3x faster initial loads in dev (#18848) (7d60563)

  Speeds up initial API and admin loads in development by up to 3x with four optimizations:

• ui: prevent column toggles from flickering during navigation (#18830) (c4ad7a1)

  Fixes the visible flicker when toggling columns on or off in the TanStack dev server. This is not an issue in production builds.

🤝 Contributors

• German Jablonski (@GermanJablo)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Jessica Rynkar (@JessRynkar)
• PINYO PATTANAWASANPORN (@PINYOPATTANAWASANPORN)
• Elliot DeNolf (@denolfe)
• Nate Lentz (@nathanlentz)
• Lazizbek Ergashev (@lazerg)
• Tylan Davis (@tylandavis)

Original source

v3.92.0 (2026-10-22)

🐛 Bug Fixes

• bump minimum node version to 22.23.4 (#18957) (7440041)
• bump undici to 7.30.1 (3.x) (#18950) (e091098)
• pass document id to field access (#18269) (3165b35)
• set error names explicitly to survive minification (3.x) (#18775) (4173db9)
• validate each locale when writing localized fields with locale all (3.x) (#18500) (8ef7658)
• db-mongodb: support limit 0 in joins across multiple collections (3.x) (#18855) (84483a1)
• drizzle: backport localized polymorphic join filters to 3.x (#18860) (c0bc6f2)
• ui: register the bulk upload success callback every time the drawer opens (#18742) (4a45e3e)

📚 Documentation

• backport internal link and anchor fixes to 3.x (#18849) (4f58ea6)
• explain admin text direction in i18n docs (#18834) (5cd5c51)
• add rewards and recognition section to security policy (3.x) (#18780) (f711f46)

⚙️ CI

• bump templates to the released version on every release (3.x) (#18925) (bf744df)
• pick the release bump from the commits, require a reason to override (3.x) (#18919) (288afc1)
• preserve integration test heap settings (3.x) (#18924) (362748d)
• upgrade pnpm to 11.28.6 (3.x) (#18871) (07afd7f)
• grant cache lookup jobs actions read permission (3.x) (#18866) (6a38177)
• add one-click release flow (3.x) (#18717) (6964415)

🏡 Chores

• skills: backport PR demo recording to 3.x (#18772) (428d26c)

⚠️ BREAKING CHANGES

• bump minimum node version to 22.23.4 (#18957) (7440041)

Raises the minimum supported Node.js version to 22.23.4, retaining support for Node.js 24.22.1 and newer.

🤝 Contributors

• German Jablonski (@GermanJablo)
• Jake Fletcher (@jacobsfletch)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• Jarrod Flesch (@JarrodMFlesch)
• Sean Zubrickas (@zubricks)
• Nate Lentz (@nathanlentz)

Original source

v4.0.0-beta.3 (2026-10-19)

🚀 Features

• support cache components (#18702) (4d05bcd)

🐛 Bug Fixes

• stabilize a11y flaky e2e tests (#18632) (edb4335)
• validate each locale when writing localized fields with locale all (#18502) (e10d8a6)
• next: render admin at request time with cache components (#18694) (401f12e)
• tanstack-start: prevent subtree remounts on router refresh (#18806) (d5b01b4)
• ui: hide fields in expanded live preview (#18773) (8cf4e1e)
• ui: register the bulk upload success callback every time the drawer opens (#18654) (f6b767f)
• ui: widen date picker calendar (#18752) (c7c6db6)

⚡ Performance

• drizzle: lead locale table unique index with _parent_id (#18723) (1fc6fda)
• next: externalize more server-only packages in dev (#18691) (5b66069)

🛠 Refactors

• tanstack-start: replace layout serialization with React Flight (#18793) (e1e4cca)
• tanstack-start: use React Flight for RSC responses (#18787) (b7f9d56)
• ui: normalize form state before request serialization (#18801) (9daea2f)

📚 Documentation

• add rewards and recognition section to security policy (#18781) (339d1fc)

🎨 Styles

• format repo with oxfmt (#18755) (734d711)

📝 Templates

• replace prettier with oxfmt (#18754) (629359d)

⚙️ CI

• reduce CODEOWNERS to release files (#18782) (76abf10)

🏡 Chores

• use browser gestures for PR demo recordings (#18803) (1f6c959)
• disable turbo agent guidance (#18798) (dc223f7)
• add format commit to .git-blame-ignore-revs (#18779) (b8c6689)
• configure coderabbit reviews (#18771) (4341bad)

⚠️ BREAKING CHANGES

• tanstack-start: use React Flight for RSC responses (#18787) (b7f9d56)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Jake Fletcher (@jacobsfletch)
• Alessio Gravili (@AlessioGr)
• Jessica Rynkar (@JessRynkar)
• Nate Lentz (@nathanlentz)
• Elliot DeNolf (@denolfe)
• Patrik (@PatrikKozak)
• Metehan Biçer (@Metehan-Bicer)
• Dan Ribbens (@DanRibbens)

Original source

v4.0.0-beta.2 (2026-10-16)

🚀 Features

• tanstack-start: update to stable TanStack Start (#18700) (32c06ff)

🐛 Bug Fixes

• show file sizes with one decimal by default (#18683) (81d3070)
• prevent duplicate hierarchy fields when collection config is reloaded (#18710) (3da270a)
• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18737) (50295c7)
• richtext-lexical: hide placeholders in read-only editors (#18740) (81e7e15)
• tanstack-start: support custom API routes (#18590) (1839216)
• ui: hide LLM instructions from document pickers and dashboard (#18741) (f177a26)
• ui: rename edit LLM instructions action to edit agent instructions (#18739) (2cb9aae)

⚡ Performance

• ui: build the client field schema map in linear time for rich text fields (#18698) (91bbccc)

📚 Documentation

• clarify generated index versioning policy (#18734) (92e5757)
• add TanStack Start documentation (#17226) (1d1ec1a)
• fix broken internal links and anchors (#18661) (d32259e)
• clarify framework dependency versioning policy (#18704) (a10826d)
• plugin-search: document field access responsibilities (#18711) (b9500cc)

🧪 Tests

• improve PR demo recording and annotations (#18692) (0e21f2c)

📝 Templates

• bump Next.js and React versions (#18751) (2b3d9ca)

⚙️ CI

• label PRs targeting 3.x with v3 (#18744) (f92b79b)
• tag v4-only packages with latest on beta publish (#18688) (e8cc755)
• use ubuntu-26.04 runners (#18714) (0f60028)

⚠️ BREAKING CHANGES

• show file sizes with one decimal by default (#18683) (81d3070)

• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18737) (50295c7)

  If you pass your own transport created with nodemailer 9, upgrade nodemailer to ^10 and remove @types/nodemailer. A transport typed by @types/nodemailer no longer type-checks against the adapter. Runtime behavior does not change.

• tanstack-start: update to stable TanStack Start (#18700) (32c06ff)

  Updates @tanstack/react-start to ^1.169.1 and @tanstack/react-router to ^1.170.44 across the adapter, blank template, test app, and lockfile.

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• Nate Lentz (@nathanlentz)
• Jake Fletcher (@jacobsfletch)
• Sasha (@r1tsuu)
• Satvik Mishra (@SatvikMishra08)

Original source

Payload 3.91.0 reduces MongoDB memory usage, expands MCP find tools, and fixes large Azure uploads, alongside improvements to authentication sessions and the Admin UI.

Highlights

This release focuses on performance and reliability — reducing memory usage for referenced blocks in MongoDB, speeding up rich text field schema processing, and fixing chunked Azure uploads over 256 MiB. It also expands MCP query options and updates Nodemailer to address security advisories.

Also in this release:

• MCP plugin: adds missing properties to find tools and cleans up object inputs
• Admin UI: restores image thumbnails in folder lists and renders custom block views on initial load
• Authentication: brings activity-aware sessions to v3
• Access control: checks draft read access against the latest version in findByID
• Rich text: handles pasting unsupported blocks
• Next.js: fixes development hot reloading when basePath is configured
• Jobs: saves job logs when runHooks is enabled

Before you upgrade

This release includes compatibility changes:

• Payload now requires Node.js 20.18.1 or later
• Azure storage users need Node.js 22.0.0 or later
• If you supply a custom Nodemailer 9 transport, upgrade nodemailer to ^10 and remove @types/nodemailer

As always, you can review the complete changelog on GitHub.

Original source

v3.91.0 (2026-10-15)

🚀 Features

• plugin-mcp: add missing properties to find tools, clean up object inputs (#18436) (0f6c5b0)

🐛 Bug Fixes

• return 404 for version operations when versions are disabled (#18057) (d72c669)
• prevent join field where mutation during query validation (#18511) (5060fee)
• bump minimum node version to 20.18.1 (#18467) (fe030c5)
• dev HMR reload not working when Next.js basePath is set (#18485) (f56e92e)
• prevent silent CLI exits (#18398) (1fcb220)
• backport v4 fix to render custom block views on initial load (#18188) (5eb5471)
• save job logs when runHooks is enabled (#18365) (26731e6)
• check draft read access against the latest version in findByID (#18000) (9106bf8)
• drizzle: size sqlite batch inserts by table column count (#17235) (d4c81bb)
• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)
• graphql: backport nested select projections to 3.x (#18366) (231634a)
• plugin-cloud-storage: hide storage metadata from list controls (#18356) (52fadda)
• plugin-import-export: filter disabled export fields (#18434) (b65335c)
• plugin-seo: authorize generation for manual fields (#18428) (451dd68)
• richtext-lexical: handle pasting unsupported blocks (#18368) (3cfa97b)
• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)
• ui: show image thumbnails in folder list view (#17980) (c1569dc)
• ui: preserve default block types when conditions reveal rows (#18299) (2554a34)
• ui: backport activity-aware auth sessions (#17854) (7691ba3)

⚡ Performance

• db-mongodb: reduce referenced block schema memory usage significantly (#18367) (7defbc6)
• drizzle: add _parent_id index to localized tables (#18724) (e3559cd)
• ui: build the client field schema map in linear time for rich text fields (#18697) (000093d)

📚 Documentation

• fix broken rich text link and typos (#18699) (7bf7fb5)
• catalog additional UI components (#18195) (c114379)

⚙️ CI

• add sync-mirror workflow (3.x) (#18561) (3fd91ec)

🏡 Chores

• bump undici to 7.29.1 (#18514) (c1e959f)

⚠️ BREAKING CHANGES

• bump minimum node version to 20.18.1 (#18467) (fe030c5)

  BREAKING: Raises the minimum supported Node.js version. NOTE: Node 18 already had issues, this just bumps the value to be what was functionally true.

• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)

  If you pass your own transport created with nodemailer 9, upgrade nodemailer to ^10 and remove @types/nodemailer. A transport typed by @types/nodemailer no longer type-checks against the adapter. Runtime behavior does not change.

• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)

  Breaking: this bumps the minimum node version required by @payloadcms/storage-azure from 20.18.1 to 22.0.0. Due to @azure/storage-blob bumping their min. node version to 22.0.0 in a minor release, we're not able to avoid this change.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Patrik (@PatrikKozak)
• Jake Fletcher (@jacobsfletch)
• toyeshhm (@toyeshhm)
• Apoorv Darshan (@apoorvdarshan)
• Elliot DeNolf (@denolfe)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jessica Rynkar (@JessRynkar)
• Sean Zubrickas (@zubricks)
• Paul (@paulpopus)
• Sasha (@r1tsuu)

Original source

v4.0.0-beta.1 (2026-10-13)

🐛 Bug Fixes

• codemod: default upgrade tag to beta (#18649) (8246dda)
• ui: hide required-fields info button (#18696) (028f076)

📚 Documentation

• fix topic order and title (#18648) (0cb6d0c)
• cleans up headings that contained code blocks (#18641) (b103a85)
• Add @beta to create-payload-app instruction (#18646) (ea766b6)

📝 Templates

• theme selector type error with @radix-ui/react-select 2.4 (#18689) (9bbab53)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Nate Lentz (@nathanlentz)

Original source

v4.0.0-beta.0 (2026-10-09)

More details to come next week

To try this out: npx create-payload-app@beta

Features

• Admin UI redesign
• TanStack support
• Dashboard components
• Accessibility
• Hierarchies
• Tags
• Grid View
• Improved File Uploads UI
• File upload versions
• Rewritten MCP
• Upgrade scripts (codemods)
• Foundational improvements

Documentation

Beta version documentation can be found at https://payloadcms.com/docs/beta/getting-started/what-is-payload

BREAKING CHANGES

For a full list of breaking changes from v3 to v4 visit https://payloadcms.com/docs/beta/migration-guide/v4

To run the codemod that will perform these updates on a v3 app for you:

# Agent-assisted
npx @payloadcms/codemod@beta upgrade
# Pure codemod updates
npx @payloadcms/codemod@beta

Original source

v4.0.0-canary.39 (2026-10-08)

🚀 Features

• remove deprecated APIs flagged for 4.0 (#18607) (2165d19)
• validate all locales by default (#17879) (cc74a1e)
• remove deprecated AdminContext properties and DiffMethod type (#18598) (b221c7a)
• add upload file versioning (#18548) (ec3d99e)

🐛 Bug Fixes

• return 404 for version operations when versions are disabled (#18618) (1a89873)
• replace remaining http-status imports with local httpStatus constants (#18599) (264600a)
• roll back failed job update transactions (#17979) (bcda796)
• richtext-lexical: create client HorizontalRuleNode when pasting (#18295) (bbdc2f7)
• tanstack-start: preserve multiple response cookies (#18586) (a6bbf45)
• tanstack-start: import admin styles directly from page routes (#18595) (dda24c9)
• tanstack-start: include GraphQL runtime dependencies (#18593) (8df5286)
• tanstack-start: respect graphQL.disable (#18589) (cc314e8)
• ui: hide join field add new button without create permission (#18526) (c27fe28)
• ui: match empty dashboard state height (#18620) (9f1c36e)
• ui: accessibility improvements related to keyboard shortcuts (#18544) (934870d)
• ui: remove deprecated list props (#18610) (c66a7be)
• ui: remove deprecated drawer props (#18609) (604dd3c)
• ui: remove deprecated TableColumnsProvider props (#18608) (55e11c8)
• ui: remove legacy form state sanitize flag (#18603) (a89bc16)

⚡ Performance

• replace http-status with numeric constants (#18581) (e8f4f47)
• update jose and import JWT entrypoints (#18580) (131e56c)

🛠 Refactors

• simplify original document selection (#18611) (a657d0d)
• rename diff component props to valueFrom and valueTo (#18600) (4837c62)
• richtext-lexical: use upload-specific document types in UploadData (#18606) (b955d10)
• richtext-lexical: ignore node version and remove it from the JSON schema (#18567) (2316165)

📚 Documentation

• fix broken rich text link and typos (#18605) (b18f5c2)

🧪 Tests

• make REST client framework agnostic (#18591) (51299b7)

📝 Templates

• blank template locale with labels (#18602) (f5691aa)

⚠️ BREAKING CHANGES

• remove deprecated APIs flagged for 4.0 (#18607) (2165d19)
• validate all locales by default (#17879) (cc74a1e)
• rename diff component props to valueFrom and valueTo (#18600) (4837c62)
• remove deprecated AdminContext properties and DiffMethod type (#18598) (b221c7a)
• add upload file versioning (#18548) (ec3d99e)
• richtext-lexical: use upload-specific document types in UploadData (#18606) (b955d10)
• Promotes the more precise upload type to UploadData, updates
  converters, and removes UploadDataImproved.
• richtext-lexical: ignore node version and remove it from the JSON schema (#18567) (2316165)
• tanstack-start: import admin styles directly from page routes (#18595) (dda24c9)
• ui: remove deprecated list props (#18610) (c66a7be)
• ui: remove deprecated drawer props (#18609) (604dd3c)
• ui: remove deprecated TableColumnsProvider props (#18608) (55e11c8)
• ui: remove legacy form state sanitize flag (#18603) (a89bc16)

🤝 Contributors

• Louayzouaoui1 (@Louayzouaoui1)
• AmalMon19 (@AmalMon19)
• Toyeshh Medikonda (@toyeshhm)
• Sasha (@r1tsuu)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Paul (@paulpopus)
• Dex (@Dextheking1)
• Elliot DeNolf (@denolfe)
• Nate Lentz (@nathanlentz)

Original source

v4.0.0-canary.38 (2026-10-07)

🚀 Features

bump min. next.js version to 16.4 (#18569) (9bc6cae)

add new payload.validate() operation for on-demand validation of documents (#17557) (019deca)

manage LLM instructions in the admin (#18373) (4d0796c)

include configured LLM instructions in CLI and MCP schemas (#18372) (4d7a5ba)

improve PR demo scrolling and publishing (#18542) (32b5694)

add file transformers and migrate upload sizes to variants (#17827) (ed0e138)

add database copy method (#18453) (e6cd442)

add database batch processing foundation (#18455) (401d1d8)

export batchProcessing utility (#18454) (cfad460)

accessibility improvements related to field labels (#18408) (3b91b5d)

expands type for disableLocalStrategy to boolean to allow overrides (#18417) (f64947f)

accessibility improvements related to modals and dialogs (#18353) (58e4024)

add createdBy and updatedBy authorship tracking (#17247) (c6fb4be)

accessibility improvements related to the select component (#18293) (56fd301)

codemod: add --help flag (#18412) (ba1b799)

plugin-import-export: give import/export hooks access to the triggering document (#17797) (7605e01)

plugin-mcp: update mcp sdk to 2.3.1 and add maxRequestBodySize option (#18510) (a08fbed)

richtext-lexical: add an LLM instructions editor preset (#18371) (5f651a1)

richtext-lexical: expose Markdown converters on editor adapters (#18370) (16cfeaa)

translations: localize document layout controls (#18506) (c0d708c)

ui: combine recents and pinned dashboard documents (#18359) (b52a1ad)

ui: improve hierarchy move and selection actions (#18564) (1535607)

ui: improve hierarchy field selection (#18499) (4343c13)

ui: update admin typography scale and spacing (#18468) (9f7e33d)

ui: add grid presentation infrastructure (#18414) (75e61a0)

ui: add configurable upload dropzone widget (#18360) (7ab3db2)

ui: rebuild nav and account menu (#18399) (4621b70)

ui: add Welcome to the default dashboard (#18364) (228dd61)

🐛 Bug Fixes

suppress Vite warning for dynamic config import (#18562) (d0d85ca)

enforce hierarchy collection restrictions (#18512) (049f300)

add extra padding to avoid overlapping elements in embedded mode (#18551) (56f276c)

update test upload select fields for variants (#18540) (c37a178)

prevent join field where mutation during search param validation (#18491) (#18495) (fd32ef8)

dev HMR reload not working when Next.js basePath is set (#18484) (63315aa)

memory leak on version and draft operations with mongodb (#18445) (d5ba54e)

check draft read access against the latest version in findByID (#17999) (5448061)

codemod: load ${configDir} tsconfigs and stop toolchain downgrades (#18376) (e2d1684)

codemod: harden field component type migration (#18363) (34e3211)

graphql: resolve nested select projections locally (#18307) (2d528bb)

next: disable dev indicators by default (#18466) (15d051b)

plugin-cloud-storage: hide prefix from list controls (#18357) (91f68b2)

plugin-import-export: filter disabled export fields (#18433) (907ce8d)

plugin-import-export: export relationship fields natively for JSON format (#17512) (1d45314)

plugin-seo: authorize generation for manual fields (#18427) (68ad110)

richtext-lexical: preserve block data on remount (#17957) (aab865b)

richtext-lexical: upgrade lexical to 0.52.0 and tsx to 4.23.15 (#18397) (96725e3)

richtext-lexical: skip form state for unsupported blocks (#18369) (be76bb6)

tanstack-start: redact client config for unauthenticated requests (#18513) (e2bb708)

tanstack-start: require @tanstack/react-start >=1.168.60 (CVE-2026-102989) (#18532) (e98b654)

tanstack-start: exclude plugin client components from dep optimizer (#17620) (d2d4e00)

tanstack-start: restore config hot reloading (#18282) (01f44da)

tanstack-start: keep database adapters out of the client dep optimizer (#18313) (d1a2aab)

translations: translate hierarchy allowed types label (#18543) (dca3520)

translations: correct zh-TW UI wording (#17744) (282140b)

ui: move hierarchy edit action to the list title (#18535) (f15737c)

ui: cache client schema maps per language (#18585) (629fbae)

ui: accessibility improvements related to breadcrumbs (#18545) (d2e68cb)

ui: accessibility fixes for misc button labels (#18492) (8cefa95)

ui: accessibility improvements related to date pickers (#18493) (1ced6a1)

ui: accessibility improvements related to checkbox-radio (#18546) (6cfee9c)

ui: accessibility improvements related to search fields (#18541) (ef1e3c1)

ui: do not queue a schedulePublish job when deleting a scheduled event (#18488) (ed6a954)

ui: render locale labels in Localizer (#18566) (4e1206a)

ui: update breadcrumbs while browsing hierarchy folders (#18559) (78c18e6)

ui: allow sidebar tabs to scroll horizontally (#18519) (b30086a)

ui: update @faceless-ui/modal to 3.0.2 (#18533) (6046722)

ui: accessibility improvements related to toast announcements (#18460) (8001944)

ui: accessibility improvements related to toggles and switches (#18459) (e2381af)

ui: accessibility improvements related to navigation and skip links (#18435) (288b133)

ui: use hover submenus in UserMenu (#18439) (68f7ed2)

ui: persist sidebar open preference (#18441) (b54a919)

ui: prevent UI field cells from rendering in edit views (#18424) (1145384)

ui: resolve theme when client hints are unavailable (#18422) (b9491b6)

ui: align hierarchy checkbox styles (#18395) (eb242a7)

ui: accessibility improvements related to tables (#18405) (cb69780)

ui: accessibility improvements related to focus order / behaviour (#18381) (d2b5206)

ui: remove deprecated DocumentInfo aliases (#18319) (d52735f)

ui: preserve default block types when conditions reveal rows (#18305) (3386366)

⚡ Performance

keep zod out of the browser (#18576) (9e2681b)

db-mongodb: faster queries when collection has join fields (#18443) (508665f)

db-mongodb: reduce referenced block schema memory usage significantly (#18267) (377b878)

richtext-lexical: load the editor stylesheet from one file (#18575) (16ffc4a)

tanstack-start: load the admin UI only on admin routes (#18554) (ea6a103)

translations: filter the client translations in one pass (#18574) (df2dfac)

translations: bundle each date-fns locale into a single file (#18556) (cd10740)

ui: restore client barrel prebundling (#18553) (141ae44)

ui: bump react-datepicker to 9.1.0 (#18520) (02c4773)

🛠 Refactors

move batch processing export to internal (#18538) (53d888a)

replace field component types with props types (#18321) (5884842)

consolidate request creation APIs (#18287) (3eb7b9f)

tanstack-start: align adapter structure with next (#18507) (6ad3d3f)

ui: consolidate root layout across frameworks (#18442) (5cb7b31)

📚 Documentation

add versioning and breaking changes policy (#18505) (1f329cb)

🎨 Styles

ui: align collection cards with dashboard tiles (#18358) (b063a4a)

🧪 Tests

close column selector before sorting list view (#18558) (4ac7761)

fail fast on e2e server crash, fix throttle leak, drop 1s fixture delays (#18444) (b753f9e)

cover config hot reloading across frameworks (#18400) (31ba7ee)

update all generated types (#18308) (0578022)

cover empty select fields in draft relationship sorting (#18304) (2abfb9e)

ui: refine popup fixture menu items (#18419) (40e22ae)

📝 Templates

bump next to 16.4.0 in templates and monorepo (#18568) (40324ae)

bump next to 16.3.8 (#18440) (d5a6bb8)

⚙️ CI

add sync-mirror workflow (#18560) (8ce5c12)

enable beta npm releases from main (#18508) (ecd6c51)

adjust release-ci release notes generation (#18301) (ed9181a)

🏡 Chores

ignore *.code-workspace files (#18587) (90f9efc)

add PR demo recording skill (#18537) (65fd2fa)

change modification warning in generated app files (#18320) (124b55a)

eslint: add diff and markdown to code block languages (#18550) (dd932b4)

tanstack-start: mark generated app files (#18423) (f827465)

⚠️ BREAKING CHANGES

bump min. next.js version to 16.4 (#18569) (9bc6cae)

This bumps the min. Next.js version supported by Payload from 19.2.6 to 19.4.0.

add new payload.validate() operation for on-demand validation of documents (#17557) (019deca)

add file transformers and migrate upload sizes to variants (#17827) (ed0e138)

This PR adds a general file transformer API, moves Sharp processing into
a separate package, and renames generated upload sizes to variants.

add database copy method (#18453) (e6cd442)

Adds a low-level database adapter method for copying one stored collection document.

replace field component types with props types (#18321) (5884842)

Removes all field-related React.ComponentType<Props> aliases in favor
of standalone props types. Using standalone props types gives you more
flexibility in how you define components:

add createdBy and updatedBy authorship tracking (#17247) (c6fb4be)

Adds automatic createdBy and updatedBy fields to collections and
globals — the authorship counterpart to the existing createdAt /
updatedAt timestamps.

consolidate request creation APIs (#18287) (3eb7b9f)

richtext-lexical: upgrade lexical to 0.52.0 and tsx to 4.23.15 (#18397) (96725e3)

ui: consolidate root layout across frameworks (#18442) (5cb7b31)

Consolidates the Next.js and TanStack root layouts around shared document rendering, providers, and data initialization.

ui: remove deprecated DocumentInfo aliases (#18319) (d52735f)

Removes savedDocumentData and updateSavedDocumentData from useDocumentInfo and updates the docs to reference setData.

🤝 Contributors

German Jablonski (@GermanJablo)

Jarrod Flesch (@JarrodMFlesch)

Alessio Gravili (@AlessioGr)

Paul (@paulpopus)

Kaan Çelebi (@kaanisthatyou)

Elliot DeNolf (@denolfe)

Jake Fletcher (@jacobsfletch)

Jessica Rynkar (@JessRynkar)

Marius K (@Kloggzer)

Tylan Davis (@tylandavis)

Sean Zubrickas (@zubricks)

Sasha (@r1tsuu)

PINYO PATTANAWASANPORN (@PINYOPATTANAWASANPORN)

Ting-An Chen (@nrps9909)

Nate Lentz (@nathanlentz)

Krishnendu Samanta (@krishnendu-2003)

Dan Ribbens (@DanRibbens)

Patrik (@PatrikKozak)

Helen Li (@helenli-figma)

Original source

v4.0.0-canary.37 (2026-09-24)

🚀 Features

• default overrideAccess to false in the Local API (#17869) (744bfcf)
• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)
• codemod: add agent-assisted upgrade command (#17825) (c44404c)
• tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50)

🐛 Bug Fixes

• update deprecated mongodb new option (#18277) (9c63438)
• inherit read access for collection versions (#17634) (b0e85ef)
• drizzle: size sqlite batch inserts by widest row (#17234) (9001b93)
• plugin-multi-tenant: avoid refreshing without stale tenant cookie (#18252) (3826748)
• tanstack-start: avoid broad imports in route graph (#18254) (213356c)

🛠 Refactors

• consolidate initReq across framework adapters (#17690) (d1deb35)

📚 Documentation

• adds first batch of v4 ui component docs (#18147) (f35c2b6)

🧪 Tests

• fix vs code run test buttons not working on first try (#18244) (322ccb9)

⚙️ CI

• seed canary and disable canary publishing (#18259) (ba73526)

🏡 Chores

• make overrideAccess explicit in first-party call sites (#17861) (c698135)
• make overrideAccess explicit in tests (#17859) (a8c8bb0)
• migrate AI skills to .agents directory (#18256) (ed96e79)
• migrate to AGENTS.md (#18247) (b2c0b11)
• release: v4.0.0-canary.37 (f88f502)

⚠️ BREAKING CHANGES

• default overrideAccess to false in the Local API (#17869) (744bfcf)

  This changes the Local API default for overrideAccess from true to false, including payload.jobs.* operations. An omitted option now enforces access control.

• consolidate initReq across framework adapters (#17690) (d1deb35)

  Consolidates initReq in payload core so every framework adapter uses the same request initialization behavior.

• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)

• inherit read access for collection versions (#17634) (b0e85ef)

  Inherits a collection or global's existing read access for version operations when readVersions is not configured. Explicit readVersions access remains authoritative.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)

Original source