Payload Release Notes

v4.0.0-beta.2 (2026-10-16)

🚀 Features

• tanstack-start: update to stable TanStack Start (#18700) (32c06ff)

🐛 Bug Fixes

• show file sizes with one decimal by default (#18683) (81d3070)
• prevent duplicate hierarchy fields when collection config is reloaded (#18710) (3da270a)
• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18737) (50295c7)
• richtext-lexical: hide placeholders in read-only editors (#18740) (81e7e15)
• tanstack-start: support custom API routes (#18590) (1839216)
• ui: hide LLM instructions from document pickers and dashboard (#18741) (f177a26)
• ui: rename edit LLM instructions action to edit agent instructions (#18739) (2cb9aae)

⚡ Performance

• ui: build the client field schema map in linear time for rich text fields (#18698) (91bbccc)

📚 Documentation

• clarify generated index versioning policy (#18734) (92e5757)
• add TanStack Start documentation (#17226) (1d1ec1a)
• fix broken internal links and anchors (#18661) (d32259e)
• clarify framework dependency versioning policy (#18704) (a10826d)
• plugin-search: document field access responsibilities (#18711) (b9500cc)

🧪 Tests

• improve PR demo recording and annotations (#18692) (0e21f2c)

📝 Templates

• bump Next.js and React versions (#18751) (2b3d9ca)

⚙️ CI

• label PRs targeting 3.x with v3 (#18744) (f92b79b)
• tag v4-only packages with latest on beta publish (#18688) (e8cc755)
• use ubuntu-26.04 runners (#18714) (0f60028)

⚠️ BREAKING CHANGES

• show file sizes with one decimal by default (#18683) (81d3070)

• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18737) (50295c7)

  If you pass your own transport created with nodemailer 9, upgrade nodemailer to ^10 and remove @types/nodemailer. A transport typed by @types/nodemailer no longer type-checks against the adapter. Runtime behavior does not change.

• tanstack-start: update to stable TanStack Start (#18700) (32c06ff)

  Updates @tanstack/react-start to ^1.169.1 and @tanstack/react-router to ^1.170.44 across the adapter, blank template, test app, and lockfile.

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• Nate Lentz (@nathanlentz)
• Jake Fletcher (@jacobsfletch)
• Sasha (@r1tsuu)
• Satvik Mishra (@SatvikMishra08)

Original source

Payload 3.91.0 reduces MongoDB memory usage, expands MCP find tools, and fixes large Azure uploads, alongside improvements to authentication sessions and the Admin UI.

Highlights

This release focuses on performance and reliability — reducing memory usage for referenced blocks in MongoDB, speeding up rich text field schema processing, and fixing chunked Azure uploads over 256 MiB. It also expands MCP query options and updates Nodemailer to address security advisories.

Also in this release:

• MCP plugin: adds missing properties to find tools and cleans up object inputs
• Admin UI: restores image thumbnails in folder lists and renders custom block views on initial load
• Authentication: brings activity-aware sessions to v3
• Access control: checks draft read access against the latest version in findByID
• Rich text: handles pasting unsupported blocks
• Next.js: fixes development hot reloading when basePath is configured
• Jobs: saves job logs when runHooks is enabled

Before you upgrade

This release includes compatibility changes:

• Payload now requires Node.js 20.18.1 or later
• Azure storage users need Node.js 22.0.0 or later
• If you supply a custom Nodemailer 9 transport, upgrade nodemailer to ^10 and remove @types/nodemailer

As always, you can review the complete changelog on GitHub.

Original source

v3.91.0 (2026-10-15)

🚀 Features

• plugin-mcp: add missing properties to find tools, clean up object inputs (#18436) (0f6c5b0)

🐛 Bug Fixes

• return 404 for version operations when versions are disabled (#18057) (d72c669)
• prevent join field where mutation during query validation (#18511) (5060fee)
• bump minimum node version to 20.18.1 (#18467) (fe030c5)
• dev HMR reload not working when Next.js basePath is set (#18485) (f56e92e)
• prevent silent CLI exits (#18398) (1fcb220)
• backport v4 fix to render custom block views on initial load (#18188) (5eb5471)
• save job logs when runHooks is enabled (#18365) (26731e6)
• check draft read access against the latest version in findByID (#18000) (9106bf8)
• drizzle: size sqlite batch inserts by table column count (#17235) (d4c81bb)
• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)
• graphql: backport nested select projections to 3.x (#18366) (231634a)
• plugin-cloud-storage: hide storage metadata from list controls (#18356) (52fadda)
• plugin-import-export: filter disabled export fields (#18434) (b65335c)
• plugin-seo: authorize generation for manual fields (#18428) (451dd68)
• richtext-lexical: handle pasting unsupported blocks (#18368) (3cfa97b)
• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)
• ui: show image thumbnails in folder list view (#17980) (c1569dc)
• ui: preserve default block types when conditions reveal rows (#18299) (2554a34)
• ui: backport activity-aware auth sessions (#17854) (7691ba3)

⚡ Performance

• db-mongodb: reduce referenced block schema memory usage significantly (#18367) (7defbc6)
• drizzle: add _parent_id index to localized tables (#18724) (e3559cd)
• ui: build the client field schema map in linear time for rich text fields (#18697) (000093d)

📚 Documentation

• fix broken rich text link and typos (#18699) (7bf7fb5)
• catalog additional UI components (#18195) (c114379)

⚙️ CI

• add sync-mirror workflow (3.x) (#18561) (3fd91ec)

🏡 Chores

• bump undici to 7.29.1 (#18514) (c1e959f)

⚠️ BREAKING CHANGES

• bump minimum node version to 20.18.1 (#18467) (fe030c5)

  BREAKING: Raises the minimum supported Node.js version. NOTE: Node 18 already had issues, this just bumps the value to be what was functionally true.

• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)

  If you pass your own transport created with nodemailer 9, upgrade nodemailer to ^10 and remove @types/nodemailer. A transport typed by @types/nodemailer no longer type-checks against the adapter. Runtime behavior does not change.

• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)

  Breaking: this bumps the minimum node version required by @payloadcms/storage-azure from 20.18.1 to 22.0.0. Due to @azure/storage-blob bumping their min. node version to 22.0.0 in a minor release, we're not able to avoid this change.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Patrik (@PatrikKozak)
• Jake Fletcher (@jacobsfletch)
• toyeshhm (@toyeshhm)
• Apoorv Darshan (@apoorvdarshan)
• Elliot DeNolf (@denolfe)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jessica Rynkar (@JessRynkar)
• Sean Zubrickas (@zubricks)
• Paul (@paulpopus)
• Sasha (@r1tsuu)

Original source

v4.0.0-beta.1 (2026-10-13)

🐛 Bug Fixes

• codemod: default upgrade tag to beta (#18649) (8246dda)
• ui: hide required-fields info button (#18696) (028f076)

📚 Documentation

• fix topic order and title (#18648) (0cb6d0c)
• cleans up headings that contained code blocks (#18641) (b103a85)
• Add @beta to create-payload-app instruction (#18646) (ea766b6)

📝 Templates

• theme selector type error with @radix-ui/react-select 2.4 (#18689) (9bbab53)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Nate Lentz (@nathanlentz)

Original source

v4.0.0-beta.0 (2026-10-09)

More details to come next week

To try this out: npx create-payload-app@beta

Features

• Admin UI redesign
• TanStack support
• Dashboard components
• Accessibility
• Hierarchies
• Tags
• Grid View
• Improved File Uploads UI
• File upload versions
• Rewritten MCP
• Upgrade scripts (codemods)
• Foundational improvements

Documentation

Beta version documentation can be found at https://payloadcms.com/docs/beta/getting-started/what-is-payload

BREAKING CHANGES

For a full list of breaking changes from v3 to v4 visit https://payloadcms.com/docs/beta/migration-guide/v4

To run the codemod that will perform these updates on a v3 app for you:

# Agent-assisted
npx @payloadcms/codemod@beta upgrade
# Pure codemod updates
npx @payloadcms/codemod@beta

Original source

v4.0.0-canary.39 (2026-10-08)

🚀 Features

• remove deprecated APIs flagged for 4.0 (#18607) (2165d19)
• validate all locales by default (#17879) (cc74a1e)
• remove deprecated AdminContext properties and DiffMethod type (#18598) (b221c7a)
• add upload file versioning (#18548) (ec3d99e)

🐛 Bug Fixes

• return 404 for version operations when versions are disabled (#18618) (1a89873)
• replace remaining http-status imports with local httpStatus constants (#18599) (264600a)
• roll back failed job update transactions (#17979) (bcda796)
• richtext-lexical: create client HorizontalRuleNode when pasting (#18295) (bbdc2f7)
• tanstack-start: preserve multiple response cookies (#18586) (a6bbf45)
• tanstack-start: import admin styles directly from page routes (#18595) (dda24c9)
• tanstack-start: include GraphQL runtime dependencies (#18593) (8df5286)
• tanstack-start: respect graphQL.disable (#18589) (cc314e8)
• ui: hide join field add new button without create permission (#18526) (c27fe28)
• ui: match empty dashboard state height (#18620) (9f1c36e)
• ui: accessibility improvements related to keyboard shortcuts (#18544) (934870d)
• ui: remove deprecated list props (#18610) (c66a7be)
• ui: remove deprecated drawer props (#18609) (604dd3c)
• ui: remove deprecated TableColumnsProvider props (#18608) (55e11c8)
• ui: remove legacy form state sanitize flag (#18603) (a89bc16)

⚡ Performance

• replace http-status with numeric constants (#18581) (e8f4f47)
• update jose and import JWT entrypoints (#18580) (131e56c)

🛠 Refactors

• simplify original document selection (#18611) (a657d0d)
• rename diff component props to valueFrom and valueTo (#18600) (4837c62)
• richtext-lexical: use upload-specific document types in UploadData (#18606) (b955d10)
• richtext-lexical: ignore node version and remove it from the JSON schema (#18567) (2316165)

📚 Documentation

• fix broken rich text link and typos (#18605) (b18f5c2)

🧪 Tests

• make REST client framework agnostic (#18591) (51299b7)

📝 Templates

• blank template locale with labels (#18602) (f5691aa)

⚠️ BREAKING CHANGES

• remove deprecated APIs flagged for 4.0 (#18607) (2165d19)
• validate all locales by default (#17879) (cc74a1e)
• rename diff component props to valueFrom and valueTo (#18600) (4837c62)
• remove deprecated AdminContext properties and DiffMethod type (#18598) (b221c7a)
• add upload file versioning (#18548) (ec3d99e)
• richtext-lexical: use upload-specific document types in UploadData (#18606) (b955d10)
• Promotes the more precise upload type to UploadData, updates
  converters, and removes UploadDataImproved.
• richtext-lexical: ignore node version and remove it from the JSON schema (#18567) (2316165)
• tanstack-start: import admin styles directly from page routes (#18595) (dda24c9)
• ui: remove deprecated list props (#18610) (c66a7be)
• ui: remove deprecated drawer props (#18609) (604dd3c)
• ui: remove deprecated TableColumnsProvider props (#18608) (55e11c8)
• ui: remove legacy form state sanitize flag (#18603) (a89bc16)

🤝 Contributors

• Louayzouaoui1 (@Louayzouaoui1)
• AmalMon19 (@AmalMon19)
• Toyeshh Medikonda (@toyeshhm)
• Sasha (@r1tsuu)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Paul (@paulpopus)
• Dex (@Dextheking1)
• Elliot DeNolf (@denolfe)
• Nate Lentz (@nathanlentz)

Original source

v4.0.0-canary.38 (2026-10-07)

🚀 Features

bump min. next.js version to 16.4 (#18569) (9bc6cae)

add new payload.validate() operation for on-demand validation of documents (#17557) (019deca)

manage LLM instructions in the admin (#18373) (4d0796c)

include configured LLM instructions in CLI and MCP schemas (#18372) (4d7a5ba)

improve PR demo scrolling and publishing (#18542) (32b5694)

add file transformers and migrate upload sizes to variants (#17827) (ed0e138)

add database copy method (#18453) (e6cd442)

add database batch processing foundation (#18455) (401d1d8)

export batchProcessing utility (#18454) (cfad460)

accessibility improvements related to field labels (#18408) (3b91b5d)

expands type for disableLocalStrategy to boolean to allow overrides (#18417) (f64947f)

accessibility improvements related to modals and dialogs (#18353) (58e4024)

add createdBy and updatedBy authorship tracking (#17247) (c6fb4be)

accessibility improvements related to the select component (#18293) (56fd301)

codemod: add --help flag (#18412) (ba1b799)

plugin-import-export: give import/export hooks access to the triggering document (#17797) (7605e01)

plugin-mcp: update mcp sdk to 2.3.1 and add maxRequestBodySize option (#18510) (a08fbed)

richtext-lexical: add an LLM instructions editor preset (#18371) (5f651a1)

richtext-lexical: expose Markdown converters on editor adapters (#18370) (16cfeaa)

translations: localize document layout controls (#18506) (c0d708c)

ui: combine recents and pinned dashboard documents (#18359) (b52a1ad)

ui: improve hierarchy move and selection actions (#18564) (1535607)

ui: improve hierarchy field selection (#18499) (4343c13)

ui: update admin typography scale and spacing (#18468) (9f7e33d)

ui: add grid presentation infrastructure (#18414) (75e61a0)

ui: add configurable upload dropzone widget (#18360) (7ab3db2)

ui: rebuild nav and account menu (#18399) (4621b70)

ui: add Welcome to the default dashboard (#18364) (228dd61)

🐛 Bug Fixes

suppress Vite warning for dynamic config import (#18562) (d0d85ca)

enforce hierarchy collection restrictions (#18512) (049f300)

add extra padding to avoid overlapping elements in embedded mode (#18551) (56f276c)

update test upload select fields for variants (#18540) (c37a178)

prevent join field where mutation during search param validation (#18491) (#18495) (fd32ef8)

dev HMR reload not working when Next.js basePath is set (#18484) (63315aa)

memory leak on version and draft operations with mongodb (#18445) (d5ba54e)

check draft read access against the latest version in findByID (#17999) (5448061)

codemod: load ${configDir} tsconfigs and stop toolchain downgrades (#18376) (e2d1684)

codemod: harden field component type migration (#18363) (34e3211)

graphql: resolve nested select projections locally (#18307) (2d528bb)

next: disable dev indicators by default (#18466) (15d051b)

plugin-cloud-storage: hide prefix from list controls (#18357) (91f68b2)

plugin-import-export: filter disabled export fields (#18433) (907ce8d)

plugin-import-export: export relationship fields natively for JSON format (#17512) (1d45314)

plugin-seo: authorize generation for manual fields (#18427) (68ad110)

richtext-lexical: preserve block data on remount (#17957) (aab865b)

richtext-lexical: upgrade lexical to 0.52.0 and tsx to 4.23.15 (#18397) (96725e3)

richtext-lexical: skip form state for unsupported blocks (#18369) (be76bb6)

tanstack-start: redact client config for unauthenticated requests (#18513) (e2bb708)

tanstack-start: require @tanstack/react-start >=1.168.60 (CVE-2026-102989) (#18532) (e98b654)

tanstack-start: exclude plugin client components from dep optimizer (#17620) (d2d4e00)

tanstack-start: restore config hot reloading (#18282) (01f44da)

tanstack-start: keep database adapters out of the client dep optimizer (#18313) (d1a2aab)

translations: translate hierarchy allowed types label (#18543) (dca3520)

translations: correct zh-TW UI wording (#17744) (282140b)

ui: move hierarchy edit action to the list title (#18535) (f15737c)

ui: cache client schema maps per language (#18585) (629fbae)

ui: accessibility improvements related to breadcrumbs (#18545) (d2e68cb)

ui: accessibility fixes for misc button labels (#18492) (8cefa95)

ui: accessibility improvements related to date pickers (#18493) (1ced6a1)

ui: accessibility improvements related to checkbox-radio (#18546) (6cfee9c)

ui: accessibility improvements related to search fields (#18541) (ef1e3c1)

ui: do not queue a schedulePublish job when deleting a scheduled event (#18488) (ed6a954)

ui: render locale labels in Localizer (#18566) (4e1206a)

ui: update breadcrumbs while browsing hierarchy folders (#18559) (78c18e6)

ui: allow sidebar tabs to scroll horizontally (#18519) (b30086a)

ui: update @faceless-ui/modal to 3.0.2 (#18533) (6046722)

ui: accessibility improvements related to toast announcements (#18460) (8001944)

ui: accessibility improvements related to toggles and switches (#18459) (e2381af)

ui: accessibility improvements related to navigation and skip links (#18435) (288b133)

ui: use hover submenus in UserMenu (#18439) (68f7ed2)

ui: persist sidebar open preference (#18441) (b54a919)

ui: prevent UI field cells from rendering in edit views (#18424) (1145384)

ui: resolve theme when client hints are unavailable (#18422) (b9491b6)

ui: align hierarchy checkbox styles (#18395) (eb242a7)

ui: accessibility improvements related to tables (#18405) (cb69780)

ui: accessibility improvements related to focus order / behaviour (#18381) (d2b5206)

ui: remove deprecated DocumentInfo aliases (#18319) (d52735f)

ui: preserve default block types when conditions reveal rows (#18305) (3386366)

⚡ Performance

keep zod out of the browser (#18576) (9e2681b)

db-mongodb: faster queries when collection has join fields (#18443) (508665f)

db-mongodb: reduce referenced block schema memory usage significantly (#18267) (377b878)

richtext-lexical: load the editor stylesheet from one file (#18575) (16ffc4a)

tanstack-start: load the admin UI only on admin routes (#18554) (ea6a103)

translations: filter the client translations in one pass (#18574) (df2dfac)

translations: bundle each date-fns locale into a single file (#18556) (cd10740)

ui: restore client barrel prebundling (#18553) (141ae44)

ui: bump react-datepicker to 9.1.0 (#18520) (02c4773)

🛠 Refactors

move batch processing export to internal (#18538) (53d888a)

replace field component types with props types (#18321) (5884842)

consolidate request creation APIs (#18287) (3eb7b9f)

tanstack-start: align adapter structure with next (#18507) (6ad3d3f)

ui: consolidate root layout across frameworks (#18442) (5cb7b31)

📚 Documentation

add versioning and breaking changes policy (#18505) (1f329cb)

🎨 Styles

ui: align collection cards with dashboard tiles (#18358) (b063a4a)

🧪 Tests

close column selector before sorting list view (#18558) (4ac7761)

fail fast on e2e server crash, fix throttle leak, drop 1s fixture delays (#18444) (b753f9e)

cover config hot reloading across frameworks (#18400) (31ba7ee)

update all generated types (#18308) (0578022)

cover empty select fields in draft relationship sorting (#18304) (2abfb9e)

ui: refine popup fixture menu items (#18419) (40e22ae)

📝 Templates

bump next to 16.4.0 in templates and monorepo (#18568) (40324ae)

bump next to 16.3.8 (#18440) (d5a6bb8)

⚙️ CI

add sync-mirror workflow (#18560) (8ce5c12)

enable beta npm releases from main (#18508) (ecd6c51)

adjust release-ci release notes generation (#18301) (ed9181a)

🏡 Chores

ignore *.code-workspace files (#18587) (90f9efc)

add PR demo recording skill (#18537) (65fd2fa)

change modification warning in generated app files (#18320) (124b55a)

eslint: add diff and markdown to code block languages (#18550) (dd932b4)

tanstack-start: mark generated app files (#18423) (f827465)

⚠️ BREAKING CHANGES

bump min. next.js version to 16.4 (#18569) (9bc6cae)

This bumps the min. Next.js version supported by Payload from 19.2.6 to 19.4.0.

add new payload.validate() operation for on-demand validation of documents (#17557) (019deca)

add file transformers and migrate upload sizes to variants (#17827) (ed0e138)

This PR adds a general file transformer API, moves Sharp processing into
a separate package, and renames generated upload sizes to variants.

add database copy method (#18453) (e6cd442)

Adds a low-level database adapter method for copying one stored collection document.

replace field component types with props types (#18321) (5884842)

Removes all field-related React.ComponentType<Props> aliases in favor
of standalone props types. Using standalone props types gives you more
flexibility in how you define components:

add createdBy and updatedBy authorship tracking (#17247) (c6fb4be)

Adds automatic createdBy and updatedBy fields to collections and
globals — the authorship counterpart to the existing createdAt /
updatedAt timestamps.

consolidate request creation APIs (#18287) (3eb7b9f)

richtext-lexical: upgrade lexical to 0.52.0 and tsx to 4.23.15 (#18397) (96725e3)

ui: consolidate root layout across frameworks (#18442) (5cb7b31)

Consolidates the Next.js and TanStack root layouts around shared document rendering, providers, and data initialization.

ui: remove deprecated DocumentInfo aliases (#18319) (d52735f)

Removes savedDocumentData and updateSavedDocumentData from useDocumentInfo and updates the docs to reference setData.

🤝 Contributors

German Jablonski (@GermanJablo)

Jarrod Flesch (@JarrodMFlesch)

Alessio Gravili (@AlessioGr)

Paul (@paulpopus)

Kaan Çelebi (@kaanisthatyou)

Elliot DeNolf (@denolfe)

Jake Fletcher (@jacobsfletch)

Jessica Rynkar (@JessRynkar)

Marius K (@Kloggzer)

Tylan Davis (@tylandavis)

Sean Zubrickas (@zubricks)

Sasha (@r1tsuu)

PINYO PATTANAWASANPORN (@PINYOPATTANAWASANPORN)

Ting-An Chen (@nrps9909)

Nate Lentz (@nathanlentz)

Krishnendu Samanta (@krishnendu-2003)

Dan Ribbens (@DanRibbens)

Patrik (@PatrikKozak)

Helen Li (@helenli-figma)

Original source

v4.0.0-canary.37 (2026-09-24)

🚀 Features

• default overrideAccess to false in the Local API (#17869) (744bfcf)
• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)
• codemod: add agent-assisted upgrade command (#17825) (c44404c)
• tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50)

🐛 Bug Fixes

• update deprecated mongodb new option (#18277) (9c63438)
• inherit read access for collection versions (#17634) (b0e85ef)
• drizzle: size sqlite batch inserts by widest row (#17234) (9001b93)
• plugin-multi-tenant: avoid refreshing without stale tenant cookie (#18252) (3826748)
• tanstack-start: avoid broad imports in route graph (#18254) (213356c)

🛠 Refactors

• consolidate initReq across framework adapters (#17690) (d1deb35)

📚 Documentation

• adds first batch of v4 ui component docs (#18147) (f35c2b6)

🧪 Tests

• fix vs code run test buttons not working on first try (#18244) (322ccb9)

⚙️ CI

• seed canary and disable canary publishing (#18259) (ba73526)

🏡 Chores

• make overrideAccess explicit in first-party call sites (#17861) (c698135)
• make overrideAccess explicit in tests (#17859) (a8c8bb0)
• migrate AI skills to .agents directory (#18256) (ed96e79)
• migrate to AGENTS.md (#18247) (b2c0b11)
• release: v4.0.0-canary.37 (f88f502)

⚠️ BREAKING CHANGES

• default overrideAccess to false in the Local API (#17869) (744bfcf)

  This changes the Local API default for overrideAccess from true to false, including payload.jobs.* operations. An omitted option now enforces access control.

• consolidate initReq across framework adapters (#17690) (d1deb35)

  Consolidates initReq in payload core so every framework adapter uses the same request initialization behavior.

• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)

• inherit read access for collection versions (#17634) (b0e85ef)

  Inherits a collection or global's existing read access for version operations when readVersions is not configured. Explicit readVersions access remains authoritative.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)

Original source

Payload 3.90.2 fixes Next.js trailing slash support, prevents unnecessary upload handler rerenders, and resolves an MCP endpoint crash under TypeScript 6.

Highlights

This release focuses on compatibility and reliability — respecting your Next.js trailing slash configuration, fixing MCP create/update tools under TypeScript 6, and reducing unnecessary rerenders and form refreshes. It also includes fixes for async slug generation and cloud storage configuration.

Also in this release:

• Next.js: supports trailingSlash in your Next.js config and removes an invalid libSQL tracing include
• Admin UI: prevents unnecessary client upload handler rerenders
• MCP plugin: fixes create/update tools crashing the MCP endpoint under TypeScript 6
• Multi-tenancy: avoids refreshing forms when the tenant cookie isn’t stale
• Cloud storage: correctly forwards alwaysInsertFields when the plugin is enabled
• Slugs: properly awaits async slugify functions

As always, you can review the complete changelog on GitHub.

Original source

v3.90.2 (2026-09-23)

🐛 Bug Fixes

await slugify func to match type (#18181) (3fad98e)
next: remove invalid libsql tracing include (#18238) (972a4fb)
next: support next.config trailingSlash (#18207) (05e49da)
plugin-cloud-storage: forward alwaysInsertFields when the plugin is enabled (#18222) (f5d261d)
plugin-mcp: create/update tools crash the MCP endpoint under TypeScript 6 ("use strict" prologue) (#17109) (e6efd70)
plugin-multi-tenant: avoid refreshing forms without stale tenant cookie (#18245) (a815140)
ui: prevent client upload handler rerenders (#18184) (b382576)

⚙️ CI

tune runner memory and scope job token permissions (#18216) (d58f8fb)

🤝 Contributors

Cody Swartz (@ctsstc)
Jarrod Flesch (@JarrodMFlesch)
Lazizbek Ergashev (@lazerg)
Paul (@paulpopus)
Jessica Rynkar (@JessRynkar)
Elliot DeNolf (@denolfe)

Original source

Payload 3.90.1 fixes read-access filtering in nested relationship queries, updates our templates, and brings telemetry updates to v3.

Highlights

This release focuses on a fix for nested relationship queries: related fields now use their own collection’s read-access constraints, preventing filters from the parent collection from being incorrectly applied. It also includes template and telemetry updates.

Also in this release:

• Relationships: nested queries now apply the related collection’s read-access where constraints instead of carrying over the parent collection’s filters
• Templates: Payload dependencies are bumped to 3.90.0
• Telemetry: updates are backported to v3

As always, you can review the complete changelog on GitHub.

Original source

v3.90.0 (2026-09-18)

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

• Regenerate your payload types: pnpm payload generate:types
• If you are using a relational database, you will need to create and run a migration:
  • pnpm payload migrate:create <migration-name>
  • pnpm payload migrate

Password changes now revoke other sessions

No action needed.

Password reset now clears lockouts; forgot-password is throttled

Adds new resetPasswordRequestedAt field to user collections

Action required:

• Regenerate types: pnpm payload generate:types
• If using a relational database, perform migration:
  • pnpm payload migrate:create add-reset-password-requested-at
  • pnpm payload migrate

Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

• Have publish or unpublish events queued when upgrading.
• Use multiple admin-capable auth collections.
• Queue schedulePublish jobs directly or depend on its generated task types.

Action required:

• Re-create pending scheduled publish and unpublish events after upgrading.
• Update custom queue code to pass user: { relationTo, value } (value is user ID).
• Regenerate committed Payload types if applicable.
• No database migration is required.

Stricter validation for SVG and XML uploads

Affected if you:

• Upload SVG, XHTML, or XML-family files.
• Use direct client uploads, particularly with Azure or a custom integration.
• Depend on path components being retained in new filenames.

Action required:

• Verify affected upload and XML-delivery workflows.
• Ensure custom upload clients send the required metadata and returned headers.
• Set allowRestrictedFileTypes: true in the collections upload property if the previous behavior is explicitly required.

Client uploads hardened across all adapters

Affected if you:

• Use any client upload adapters with clientUploads: true (S3, GCS, Azure, or custom).

Action required:

• If using GCS adapter, add x-goog-if-generation-match header to GCS CORS allowed headers.

Azure containers default to private

Affected if you:

• Use the @payloadcms/storage-azure adapter with allowContainerCreate: true

Action required:

• If you wish to retain the previous behavior, set containerAccess: 'blob' in your Azure storage config.

disablePayloadAccessControl no longer disables safe outbound fetch

Affected if you:

• Set disableAccessControl: true in your Payload config.

Action required:

• Configure a narrow upload.skipSafeFetch allowlist for trusted destinations
• Use skipSafeFetch: true only when every URL accepted by the collection is trusted.
• No action is required when files are retrieved from ordinary public endpoints.

External file fetches require a trusted origin

Affected if you:

• Use upload.disableLocalStorage: true and rely on Payload fetching relative URLs whose endpoint requires a Payload session cookie.
• Implement externalFileHeaderFilter, particularly if it assumes it runs only once.
• Use non-HTTP(S) external-file URLs.

Action required:

• Configure serverURL or add the exact application origin to your CORS or CSRF configuration.
• Replace non-HTTP(S) external-file URLs with HTTP(S) URLs.
• Review externalFileHeaderFilter and use the optional context when headers need to vary by destination.

upload: {
  externalFileHeaderFilter: (headers, context) => {
+ if (!context?.isSameOrigin) {
+ delete headers.cookie
+ delete headers.authorization
+ }
+
return headers
},
}

Uploaded filename hardening

Affected if you:

• Use a custom top-level prefix field on an upload collection as ordinary application data.
• Change an upload’s storage prefix without also replacing its file.

Action required:

• Rename a custom, non-storage prefix field or update it through trusted server-side code.
• Submit storage-prefix changes as part of a file replacement. Adapter-managed prefix fields do not require migration.

Multipart uploads are now capped at 50MB by default

Affected if you:

• Use multipart uploads and rely on uploads being larger than 50MB

Action required:

• Raise the multipart cap if your application requires support for larger uploads for requests. Adjust the requestSizeLimit in your Payload config:

upload {
+ requestSizeLimit: 75 * 1024 * 1024, // Example 75 MiB for the complete multipart request
}

Form Builder defaults form submission read access to the admin collection

Affected if you:

• Have more than one auth enabled where the secondary auth collections are expected to be able to read either:
  • form-submission docs
  • forms.emails array field

Action required:

• Supply an explicit formSubmissionOverrides.access or formOverrides.access to override the new defaults. If you already have overrides configured, they will continue to be respected.

Stricter where validation for polymorphic joins

Polymorphic joins now apply complete where constraints and throw a QueryError when a filter is unsupported.

Unsupported filters include:

• Localized fields.
• Fields nested inside arrays or blocks.
• Paths traversing relationship, upload, or JSON fields, such as owner.email.
• The near, within, intersects, and all operators.
• The same field path having incompatible definitions across joined collections, such as number in one collection and text in another.

Affected if you:

• Use a join whose collection references multiple collections, and
• Apply an unsupported filter through:
  • A target collection's read access rule.
  • A join where constraint.
  • An Admin baseFilter or baseListFilter used by folder browsing.
• Use folders with folder-enabled collections whose read access or base filters contain one of these unsupported shapes.

Action required:

• Review where constraints and read access rules for every collection referenced by a polymorphic join.
• If using folders, review every folder-enabled collection's read access rules and Admin base filters.
• Rewrite unsupported filters to use direct, compatible fields while preserving the intended access restrictions.

API keys are no longer readable after initial generation through UI or within Payload operations

If you wish to retain old behavior, set the following in your config:

auth: {
- useAPIKey: true,
+ useAPIKey: {
+ reveal: true,
+ },
}

Lexical version bump

Full Details

No application changes or data migration are needed when using Payload's built-in rich text features.

If you maintain custom rich text features, check that they still compile and that custom content loads, copies, and pastes correctly. Lexical removed some older APIs, tightened TypeScript types, and changed how custom nodes are loaded and copied. Tests that inspect the editor's HTML may also need updated selectors or snapshots because Lexical adds some internal markup.

Do not install lexical or @lexical/* yourself for use with Payload. Remove any direct dependencies you added for the editor and use Payload's re-exports from @payloadcms/richtext-lexical/lexical and @payloadcms/richtext-lexical/lexical/*. Payload supplies the matching versions; mixing versions can break the editor. This is the existing custom feature requirement.

Original source

v3.89.0 (2026-09-10)

🚀 Features

• ui: add warning type to Banner (#17750) (6e5f386)

🐛 Bug Fixes

• avoid buffering large client uploads into memory (#17872) (e896688)
• "No client field found for ..." 500 error in version diff (#18001) (88f0622)
• upgrade next to 16.3.3 across core and templates (#17933) (24164d8)
• db-mongodb: avoid unnecessary aggregation when no joins are selected (#17785) (9a309af)
• drizzle: preserve omitted hasMany selects (#18085) (ee7c00c)
• drizzle: warn on truncated identifiers, throw on collisions (#17650) (52c4d70)
• email-resend: http fetch error handling swallows errors (#17798) (61d3961)
• plugin-form-builder: include autolink nodes in LinkHTMLConverter, v3 backport (#17788) (5061283)
• ui: handle unsupported preview URLs (#18136) (112f419)
• ui: add @swc/helpers direct dependency (#17893) (ec0e98e)
• ui: prevent render loop during rapid title input (#17834) (f954804)
• ui: rich text fields not read-only inside tabs on trashed and locked documents 3.x (#17791) (82f5576)

🛠 Refactors

• improve access defaults for jobs (#17867) (4379bf0)

📚 Documentation

• add UI component library (#18093) (4884195)
• clarify pagination limits (#18095) (2e4806a)
• fix invalid TypeScript examples (#17995) (79fd084)
• add guide for overriding default fields (#17926) (1c0c454)
• fix CLAUDE.md path in agent instructions (#17881) (b48a151)

⚠️ BREAKING CHANGES

• improve access defaults for jobs (#17867) (4379bf0)
• This backports the v4 jobs access changes to Payload v3.

🤝 Contributors

• Paul (@paulpopus)
• Jake Fletcher (@jacobsfletch)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Nate Lentz (@nathanlentz)
• Tyler Schwartz (@tschwartz)
• Fahad Noor (@FahadNoor)
• Anders Semb Hermansen (@andershermansen)
• Patrik (@PatrikKozak)
• Jens Becker (@jhb-dev)
• Dan Ribbens (@DanRibbens)
• Jessica Rynkar (@JessRynkar)

Original source

Payload 3.88.0 hardens multipart upload parsing, stops clipboard data from leaking across rows, and tightens access-control defaults for the MCP plugin's API keys.

Highlights

This release focuses on hardening — closing a multipart parsing edge case, stopping clipboard data from leaking between rows, and tightening access-control defaults for the MCP plugin — alongside a Next.js bump in our templates.

Also in this release:

• Uploads: multipart content-type parsing no longer backtracks, closing a potential denial-of-service vector
• Admin UI: clipboard prefix matching is tighter, preventing sibling row data from leaking during copy/paste
• MCP plugin: the API keys collection now ships with safer access-control defaults
• Templates: Next.js is bumped to 16.3.0

As always, you can review the complete changelog on GitHub.

Original source