Payload Release Notes

v3.89.0 (2026-09-10)

🚀 Features

• ui: add warning type to Banner (#17750) (6e5f386)

🐛 Bug Fixes

• avoid buffering large client uploads into memory (#17872) (e896688)
• "No client field found for ..." 500 error in version diff (#18001) (88f0622)
• upgrade next to 16.3.3 across core and templates (#17933) (24164d8)
• db-mongodb: avoid unnecessary aggregation when no joins are selected (#17785) (9a309af)
• drizzle: preserve omitted hasMany selects (#18085) (ee7c00c)
• drizzle: warn on truncated identifiers, throw on collisions (#17650) (52c4d70)
• email-resend: http fetch error handling swallows errors (#17798) (61d3961)
• plugin-form-builder: include autolink nodes in LinkHTMLConverter, v3 backport (#17788) (5061283)
• ui: handle unsupported preview URLs (#18136) (112f419)
• ui: add @swc/helpers direct dependency (#17893) (ec0e98e)
• ui: prevent render loop during rapid title input (#17834) (f954804)
• ui: rich text fields not read-only inside tabs on trashed and locked documents 3.x (#17791) (82f5576)

🛠 Refactors

• improve access defaults for jobs (#17867) (4379bf0)

📚 Documentation

• add UI component library (#18093) (4884195)
• clarify pagination limits (#18095) (2e4806a)
• fix invalid TypeScript examples (#17995) (79fd084)
• add guide for overriding default fields (#17926) (1c0c454)
• fix CLAUDE.md path in agent instructions (#17881) (b48a151)

⚠️ BREAKING CHANGES

• improve access defaults for jobs (#17867) (4379bf0)
• This backports the v4 jobs access changes to Payload v3.

🤝 Contributors

• Paul (@paulpopus)
• Jake Fletcher (@jacobsfletch)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Nate Lentz (@nathanlentz)
• Tyler Schwartz (@tschwartz)
• Fahad Noor (@FahadNoor)
• Anders Semb Hermansen (@andershermansen)
• Patrik (@PatrikKozak)
• Jens Becker (@jhb-dev)
• Dan Ribbens (@DanRibbens)
• Jessica Rynkar (@JessRynkar)

Payload 3.88.0 hardens multipart upload parsing, stops clipboard data from leaking across rows, and tightens access-control defaults for the MCP plugin's API keys.

Highlights

This release focuses on hardening — closing a multipart parsing edge case, stopping clipboard data from leaking between rows, and tightening access-control defaults for the MCP plugin — alongside a Next.js bump in our templates.

Also in this release:

• Uploads: multipart content-type parsing no longer backtracks, closing a potential denial-of-service vector
• Admin UI: clipboard prefix matching is tighter, preventing sibling row data from leaking during copy/paste
• MCP plugin: the API keys collection now ships with safer access-control defaults
• Templates: Next.js is bumped to 16.3.0

As always, you can review the complete changelog on GitHub.

v3.87.1 (2026-08-06)

🐛 Bug Fixes

connect to the correct Next.js dev HMR endpoint per version (#17644) (291ac66)

db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #17609) (#17608) (f039324)

deps: bump undici (#17630) (9e2c11e)

plugin-mcp: bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611) (0cb605d)

richtext-lexical: preserve link drawer form state (#17586) (90fb9e1)

templates: fix with-cloudflare-d1 build and bump dependencies (#17577) (ca3e899)

📚 Documentation

update admin panel location link in custom components docs (#17624) (57178e3)

⚙️ CI

allow changes job to check out repository (#17643) (ec4f979)

🤝 Contributors

Nate Lentz (@nathanlentz)

Jarrod Flesch (@JarrodMFlesch)

Elliot DeNolf (@denolfe)

Sean Zubrickas (@zubricks)

Patrik (@PatrikKozak)

Highlights

Payload 3.87.0 adds support for Azure client uploads over 5GB and ships a round of fixes across localization, databases, uploads, folders, and the admin UI.

Azure storage can now handle client uploads larger than 5GB when chunkLargeFiles is enabled — and this release rounds things out with a wide set of fixes across localization, databases, uploads, folders, and the admin UI.

Also in this release:

• Cloud storage: Azure client uploads with chunkLargeFiles now support files larger than 5GB, and Vercel Blob storage allows overwriting existing blob keys
• Localization: parent localization is preserved through tabs, and count/countGlobalVersions now forward the active locale
• Database: arrays and blocks handle null values correctly (with a clearer MongoDB error), and Drizzle validates companion table names against the 63-character limit and dedupes reused localized block tables
• Uploads: swapped the image-size dependency for image-dimensions when reading upload dimensions
• Access control: soft deletes in updateByID now pass the document id to delete access control
• Folders: the by-folder view prefers draft titles, and folder create drawers stay open during autosave
• Multi-tenant: the assigned tenant is now applied on confirm
• Templates: the website preview route blocks unauthenticated draft-mode access, and the website button is marked as a client component for Radix Slot context
• UI: named-tab field permissions resolve correctly in the bulk-edit field select, and undefined field admin components are handled gracefully

As always, you can review the complete changelog on GitHub.

v3.87.0 (2026-07-31)

🚀 Features

• storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#17319) (3c00a39)

🐛 Bug Fixes

• preserve parent localization through tabs 3.x (#17591) (9c8d636)
• replace image-size with image-dimensions dependency for upload dimensions (#17571) (2a99a01)
• forward locale in count and countGlobalVersions (3.x) (#17547) (e042561)
• pass id to delete access control on soft delete in updateByID (#17529) (a539f5b)
• prefer draft titles in by folder view (#17412) (ef8a6a5)
• arrays and blocks should handle null values, v3 backport (#17278) (2a69863)
• db-mongodb: error on null values in arrays and blocks (#17190) (249f8df)
• drizzle: validate companion table name length against 63-char limit (#17563) (fd629f2)
• drizzle: dedupe reused localized block tables (#17430) (3e8191c)
• plugin-multi-tenant: apply tenant on confirm (#17350) (09e01df)
• storage-vercel-blob: allow overwriting existing blob keys (#17385) (fc2572e)
• templates: prevent unauthenticated draft-mode access in website preview route (#17472) (0c2e9a8)
• templates: mark website button as client component for radix-slot context (#17474) (981b282)
• ui: resolve named-tab field permissions in bulk edit field select (3.x backport of #17523) (#17524) (2371624)
• ui: keep folder create drawers open during autosave (#17421) (bf72bda)
• ui: handle undefined field admin components (#17388) (5157c72)

📚 Documentation

• remove deprecated root endpoint property (#17570) (6402daa)
• accessibility banner fix (#17431) (29dd43c)
• fix link in live preview dynamic url section (#17340) (cc81ef0)
• document exported TypeScript type helpers for plugins (#17336) (d4d029f)
• plugin-mcp: fix broken Claude Code link (#17502) (21e24ca)

🧪 Tests

• richtext-lexical: create dev user first in seed to fix flaky e2e (3.x backport of #17507) (#17568) (0f6c1b3)

⚙️ CI

• remove --json from pnpm publish to fix release hang on pnpm v11 (#17279) (4a82c20)

🏡 Chores

• export parse params and related sanitizers (#17314) (f14722a)

🤝 Contributors

Dan Ribbens (@DanRibbens)

Paul (@paulpopus)

Patrik (@PatrikKozak)

Nate Lentz (@nathanlentz)

Kacper Zawojski (@zawoj)

Marc Maceira (@marcmaceira)

Jarrod Flesch (@JarrodMFlesch)

Sean Zubrickas (@zubricks)

Raşit Akyol (@rasitakyol)

Jessica Rynkar (@JessRynkar)

Elliot DeNolf (@denolfe)

Payload 3.86.0 patches a high-severity security vulnerability and ships a round of fixes across drafts, bulk updates, database queries, and the admin UI.

Highlights

At the center of this release is a fix for CVE-2026-46625: we've overridden the js-cookie dependency to v3.0.7 and applied additional audit fixes. Upgrading any projects on older versions of Payload is recommended.

Also in this release:

• Drafts & publishing: reordering documents no longer unpublishes ones that have a newer draft, and re-uploading a draft file no longer unpublishes its document
• Bulk updates: fixed array and block row IDs being regenerated during bulk updates
• Database: MongoDB nested relationship queries now exclude duplicate IDs, and Drizzle unique-constraint validation errors preserve the failing sub-tables
• Rich text: markdown import now preserves hard line breaks
• UI: row fields respect admin.condition, relationship cells show titles correctly for draft-only documents, and polymorphic upload relations are preserved during bulk select
• Tooling: the payload bin works with tsx on Node v23.5+, and type generation no longer hangs on storage-r2
• Localization: corrected the Burmese locale (removed stray Malay strings)
• Cloud storage: separated client and server utility exports

As always, you can review the complete changelog on GitHub.

v3.86.0 (2026-07-10)

🚀 Features

• collection-level disableBulkDelete (#17207) (ca02cdc)
• plugin-form-builder: v3 backport to support translations (#17255) (2cde8c8)
• ui: add livePreview.openByDefault config option (#17213) (f23b693)

🐛 Bug Fixes

• coerce schedulePublish doc.value to collection ID type before update (#17238) (7de11b2)
• escape regex metacharacters in isURLAllowed pathname allow-list (#17237) (2061859)
• respect disabled GraphQL config, v3 backport (#17228) (9e9c35a)
• allow access to files reuploaded on a draft (#17209) (f02d22a)
• plugin-multi-tenant: run tenant delete cleanup inside the request transaction (#17175) (d128fde)
• sdk: use qs-esm allowEmptyArrays parameter (#17208) (c7dc68e)
• ui: presentational fields skipped in form state when admin.condition is false (#17224) (f31f26d)
• ui: prevent slug field error tooltip from hiding lock button (#15885) (908fba1)

⚙️ CI

• upgrade pnpm to v11 (#17169) (ca72620)

🤝 Contributors

Jessica Rynkar (@JessRynkar)

Ævar Þór Gunnlaugsson (@aevarOrigo)

Sasha (@r1tsuu)

Herman Ciechanowiec (@ciechanowiec)

Vivek Tyagi (@darkspirit2802)

Noah Bachmann (@noahbachmann)

Jake Fletcher (@jacobsfletch)

Amelia (@LimChorngUan)

German Jablonski (@GermanJablo)

Elliot DeNolf (@denolfe)

Jarrod Flesch (@JarrodMFlesch)

Payload 3.85.2 patches a high-severity security vulnerability and ships a round of fixes across drafts, bulk updates, database queries, and the admin UI.

Highlights

This release patches a high-severity vulnerability by overriding the js-cookie dependency to v3.0.7 (CVE-2026-46625), along with additional audit fixes. Upgrading any projects on older versions of Payload is recommended.

Also in this release:

• Drafts & publishing: reordering documents no longer unpublishes ones that have a newer draft, and re-uploading a draft file no longer unpublishes its document
• Bulk updates: fixed array and block row IDs being regenerated during bulk updates
• Database: MongoDB nested relationship queries now exclude duplicate IDs, and Drizzle unique-constraint validation errors preserve the failing sub-tables
• Rich text: markdown import now preserves hard line breaks
• UI: row fields respect admin.condition, relationship cells show titles correctly for draft-only documents, and polymorphic upload relations are preserved during bulk select
• Tooling: the payload bin works with tsx on Node v23.5+, and type generation no longer hangs on storage-r2
• Localization: corrected the Burmese locale (removed stray Malay strings)
• Cloud storage: separated client and server utility exports

As always, you can review the complete changelog on GitHub.

v3.85.2 (2026-07-01)

🐛 Bug Fixes

• payload bin fails with tsx on node v23.5+ (#17081) (afb0226)
• regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88)
• prevent type generation script from hanging on storage-r2 (#17020) (b681448)
• prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0)
• db-mongodb: remove duplicate IDs in nested relationship queries (#17019) (8533dfb)
• deps: resolve high severity audit vulnerabilities (#17086) (ac000e5)
• deps: override transitive js-cookie to ^3.0.7 (CVE-2026-46625) (#17000) (ef888de)
• drizzle: preserve failing sub-table on unique-constraint ValidationError (3.x) (#17015) (6dfac53)
• plugin-cloud-storage: split client and server utility exports (#17152) (30bc3fd)
• plugin-cloud-storage: prevent draft file reupload from unpublishing the document (3.x) (#17034) (a18ae22)
• richtext-lexical: preserve hard line breaks on markdown import (#17061) (c0affcb)
• translations: replace Malay strings in Burmese (my) locale (3.x) (#17032) (c3ae01d)
• ui: preserve polymorphic upload bulk select relation (#17112) (9691e42)
• ui: list relationship cell shows (Untitled) for draft-only titles (#16979) (16152e2)
• ui: respect admin.condition on row fields (#16954) (29afa77)

⚙️ CI

• backport test service image pinning to ghcr on 3.x (#17162) (d04d47e)
• reintroduce audit script (#17122) (f76d670)

🤝 Contributors

Jarrod Flesch (@JarrodMFlesch)

Elliot DeNolf (@denolfe)

Sasha (@r1tsuu)

German Jablonski (@GermanJablo)

Amelia (@LimChorngUan)

Payload 3.85.1 shipped with a round of fixes across uploads, the import/export plugin, and the admin UI. It also includes a refresh for the Getting Started and Payload Concepts pages in the docs.

Highlights

We've restructured the "What is Payload?" and Concepts pages using new Card and CardGroup blocks, turning some of the longer walls of text into navigation grids you can scan at a glance. It's a small change, but one that should make finding your way around the docs a little quicker.

Also in this release:

• Uploads: fixed draft save and duplicate behavior on upload-enabled collections, and we now follow redirects when fetching uploaded files for MIME type detection
• plugin-import-export: fixed CSV import of arrays and richText
• UI: the entire tabs field is now hidden when admin.condition is false, plus a fix for internal SCSS import paths
• Performance: custom components hidden by admin.condition are now skipped during rendering
• Tooling: bin scripts can import dependencies without an explicit "type": "module", and added type declarations for the CSS export (TypeScript 6 compatibility)

As always, you can review the complete changelog on GitHub.

v3.85.1 (2026-06-09)

🐛 Bug Fixes

fix draft save and duplicate behaviour on upload-enabled collections (#16853) (fad992c)

bin scripts cannot import dependencies without explicit "type": "module" (backport) (#16848) (6707e85)

add type declarations for css export (TypeScript 6 compat) (#16348) (6c81355)

follow redirects when fetching uploaded files for MIME type detection (#16708) (ac46214)

plugin-import-export: fix CSV import of arrays and richText nest… (#16923) (ccbdcc2)

ui: use explicit relative paths for internal SCSS imports v3.x (#16827) (c039e55)

ui: hide entire tabs field when admin.condition is false (#16809) (79b4e4c)

⚡ Performance

ui: skip rendering custom components hidden by admin.condition (#16819) (0be11b6)

📚 Documentation

fixes 404 link to monaco editor options (#16877) (5f40868)

restructure getting started and concepts pages (#16846) (0f384f4)

⚙️ CI

restore post-release workflow on 3.x (#16748) (f1861c1)

🤝 Contributors

Paul (@paulpopus)

Habeeb (@haxllo)

Sean Zubrickas (@zubricks)

Alessio Gravili (@AlessioGr)

Jake Fletcher (@jacobsfletch)

Anders Semb Hermansen (@andershermansen)

Elliot DeNolf (@denolfe)

v3.85.0 (2026-05-26)

🚀 Features

plugin-import-export: out of beta and added support for collection-level and field-level hooks (#16556) (cf9252d)

🐛 Bug Fixes

bump uuid package to 13.0.2 (#16545) (274af06)

stop workflows retrying forever when no retries are configured (#16465) (caf9150)

db-mongodb: bump mongoose to 8.22.1 for GHSA-wpg9-53fq-2r8h (#16688) (4baba91)

plugin-cloud-storage: propagate custom hook errors during upload (#16632) (055c508)

plugin-cloud-storage: preserve user-defined prefix.defaultValue (#16529) (8d14915)

plugin-cloud-storage: dedupe filename in clientUploads signed URL (#16510) (64b2860)

plugin-multi-tenant: tenant field unselectable in bulk upload "Edit all" (#16466) (695df3c)

richtext-lexical: cursor kicked out of nested richtext while typing in a block (#16490) (931a349)

richtext-lexical: drag/drop image into rich text fails when a field name matches the collection slug (#16409) (d6f7b47)

ui: bulk upload silently counts failed files as saved (#16532) (c31f4ef)

ui: respect formatDocURL returning null in ListDrawer (#16464) (0facc44)

ui: show all listSearchableFields in ListDrawer search placeholder (#16467) (3cd4a64)

📚 Documentation

fix links in admin faq (#16711) (7e4f7af)

adds relevant videos to docs sections (#16516) (d17298f)

📝 Templates

bumps next.js to 16.2.6 (#16538) (9b36063)

⚙️ CI

use postgres 15 for content api tests (#16706) (99d4930)

🏡 Chores

deps: bump nodemailer minimum version to 8.0.5 (#16664) (efa4afe)

🤝 Contributors

Sean Zubrickas (@zubricks)

German Jablonski (@GermanJablo)

Jake Fletcher (@jacobsfletch)

Paul (@paulpopus)

Alessio Gravili (@AlessioGr)