PayloadCMS releases filter

v3.69.0 (2025-12-19)

🚀 Features

• modular dashboards - widgets (#13683) (f111624)
• adds cursor rules and AGENTS.md to templates (#14889) (19fcf99)

---

Modular Dashboards with Widgets

Introduces customizable admin dashboards with draggable, resizable widgets. Build personalized dashboard layouts with full keyboard accessibility for reordering and resizing. Future updates will add widget fields (props) for configurable widgets and dashboard presets for sharing layouts. #13683

https://github.com/user-attachments/assets/6c08d8d6-c989-4845-b56f-6d3fbd30b1af

See the RFC discussion for background and roadmap.

AI Development Resources (templates)

All templates now ship with AGENTS.md and .cursor/rules/ directory for improved AI-assisted development with tools like Copilot and Cursor. #14889

See more about AGENTS.md

🐛 Bug Fixes

• basePath not working properly with admin routes (#14967) (fa6b503)
• get field by path for blocks (#14984) (519a3c6)
• improves upload security for PDFs and SVGs (#14929) (61298c6)
• missing range headers (#14887) (ec7c192)
• next: status component incorrectly shows as published status on new documents saved as drafts when readVersions permissions are false (#14950) (394c024)
• plugin-mcp: adds collection and strategy to user (#14981) (042d7eb)
• plugin-multi-tenant: relationTo arrays inflating filterOptions where query size (#14944) (98b6791)
• richtext-lexical: blocksFeature with relationship exposes other tenants (#14985) (3025377)
• storage-s3: encode filename in generated URL (#14438) (86855e1)
• ui: use portals for popup to prevent clipping, improve keyboard navigation (#14910) (af09932)

🛠 Refactors

• replace deprecated url.parse api usage (#14980) (446cbb1)

📚 Documentation

• fix duplicate anchor links (#14976) (4c91d04)
• update screenshot for fields/rich-text (#14979) (2117dbf)

🧪 Tests

• migrate to vitest (#14337) (4e45432)
• move mongodb to different port to avoid port conflicts (#14993) (b4abd04)
• improve database test setup (#14982) (e3c512a)
• multi-tenant login tiles (#14940) (47f63fa)

🏡 Chores

• storage-s3: add int tests for filename encoding (#14970) (ef710e3)

🤝 Contributors

• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Kendell (@kendelljoseph)
• Jake (@jacobsfletch)
• Jessica Rynkar (@jessrynkar)
• Paul (@paulpopus)
• Jens Becker (@jhb-dev)
• Patrik (@PatrikKozak)

v3.68.5 (2025-12-15)

🐛 Bug Fixes

• next: omit server url from route matching (#14919) (38c2f89)

🛠 Refactors

• add relative flag to formatAdminURL util (#14925) (4f12bee)

🤝 Contributors

• Jake (@jacobsfletch)

v3.68.4 (2025-12-14)

🐛 Bug Fixes

• previousValue from hooks should be populated within lexical blocks (#14856) (bb1501e)
• deps: enforce Next.js 15.4.10 (#14908) (7c675fa)
• next: properly construct local req url (#14907) (471cd1b)
• ui: show localized locale name for publish specific locale button (#14906) (848ea65)
• ui: relationship add button unsafe permissions property access (#14903) (127e41a)

📚 Documentation

• remove unused variable from custom field label translation (#14911) (77f96a4)
• update collection access control reference link on collection config page (#14905) (3a1eb77)

⚠️ BREAKING CHANGES

• deps: enforce Next.js 15.4.10 (#14908) (7c675fa)

  Address CVE-2025-67779.

🤝 Contributors

• Jake (@jacobsfletch)
• Riley Langbein (@rilrom)
• Jeffery To (@jefferyto)
• Aaron Claes (@AaronClaes)
• kat (@puzzlesremixed)
• Jessica Rynkar (@jessrynkar)

v3.68.3 (2025-12-11)

⚠️ Security Issue

• deps: bump minimum next version to 15.4.9 (#14898) (2ba4ee0)

A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) affect React 19 and frameworks that use it, like Next.js.

Full details here: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn you of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Resolution

You are strongly encouraged to upgrade your own apps to the nearest patched versions of Next.js and deploy immediately.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add next@15.4.9

For a full breakdown of the vulnerable packages and their patched releases, see https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app.

🐛 Bug Fixes

• passes serverURL through to all formatAdminURL calls (#14869) (b82356b)

🤝 Contributors

• Jake (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)

v3.68.2 (2025-12-10)

🐛 Bug Fixes

• next: use fileURLToPath for cross-platform path resolution (#14877) (e86098d)

Fixes Windows users getting ENOENT errors on dev startup.

• next: unhandled error in renderListView server function when no user present (#14878) (10a8f0f)
• next: merge user serverExternalPackages in withPayload (#14881) (dcecc46)

🛠 Refactors

• replace generic Error('Unauthorized') with UnauthorizedError (#14879) (c9a8aa0)
• next: remove unnecessary react hooks from DefaultTemplate rsc (#14876) (7a94cc1)

🏡 Chores

• translations: improve Vietnamese translations (#14886) (25ef7d1)

🤝 Contributors

• Rot4tion (@Rot4tion)
• Alessio Gravili (@AlessioGr)
• Maxim Seshuk (@maximseshuk)

v3.68.1 (2025-12-09)

🏡 Chores

• do not suggest vulnerable Next.js release in turbopack build error message (#14873) (9e0f593)

🤝 Contributors

• Alessio Gravili (@AlessioGr)

v3.68.0 (2025-12-09)

🚀 Features

• support turbopack build on Next.js canaries (#14845) (5ad4ebd)

---

Turbopack Build Support (next) - Automatically enables Turbopack Build compatibility when using Next.js ≥ 16.1.0-canary.3. The withPayload wrapper now detects supported versions and enables transitive dependency externalization, unlocking significantly faster production builds with Turbopack. #14845

---

🐛 Bug Fixes

• adds read and readDistinct to hook mapping (#14853) (0da0da8)
• undefined drafts error in collections with join fields (#14855) (3a29cec)
• use hasDraftsEnabled utility instead of direct check (#14843) (9c9c7c5)
• file objects being serialized to plain objects in upload form state (#14818) (d86c174)
• db-mongodb: correctly pass through collation config in the adapter to be applied in queries via locales (#11242) (db59cb4)
• plugin-multi-tenant: simplified getTenantOptions function and added access control for regular users (#14620) (f7cc078)
• storage-*: upload filename respects prefix (#14566) (ccfaee0)
• ui: component AddNewRelation saves relationTo as first collection instead of selected collection (#14836) (8c5c1fb)
• ui: list drawer per-page dropdown resets to 10 instead of showing saved limit (#14830) (db13a60)

📚 Documentation

• add note about returning a query from a readVersions access control (#14822) (0860837)

🧪 Tests

• speed up mongo test resets by preserving indexes (#14861) (d97a822)

🔨 Build

• add build:all:force to clean all then build all (d90bccb)
• bump swc-related dependencies (#14834) (617311a)

⚙️ CI

• remove prepack and prepublishonly scripts (#14832) (20914cc)
• add internal-debug release mode (#14820) (ce934b4)

🏡 Chores

• claude: create triage command (#14791) (d50b60e)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Alessio Gravili (@AlessioGr)
• Riley Langbein (@rilrom)
• Jarrod Flesch (@JarrodMFlesch)
• Adrian Maj (@AdrianMaj)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jeffery To (@jefferyto)
• Rot4tion (@Rot4tion)

v3.67.0 (2025-12-05)

🚀 Features

• add groupBy support to query presets (#14808) (2b7aa7a)
• plugin-ecommerce: add ability to enable guest carts with reworked access config (#14565) (90c92f4)

---

GroupBy Support for Query Presets - Query presets now save and restore groupBy state when switching between presets. Previously, groupBy settings would persist across preset switches and weren't saved as part of the preset configuration. #14808

<img width="711" height="684" alt="Preset creation with group-by added" src="https://github.com/user-attachments/assets/5fe6ee88-6ed7-40f6-b190-df6b2e89460c" />

---

Guest Carts (plugin-ecommerce) - Enable guest users to create and manage carts without authentication. Carts created by guests are secured with a generated secret stored in local storage. Configure with allowGuestCarts (enabled by default). Also adds isLoading status to all hooks for conditional UI state. #14565

// Before
ecommercePlugin({
  access: {
    adminOnly,
    adminOnlyFieldAccess,
    adminOrCustomerOwner,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
  }
})

// After
ecommercePlugin({
  access: {
    adminOnlyFieldAccess,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
    isAdmin,
    isDocumentOwner,
  }
})

🐛 Bug Fixes

• add missing beforeInput and afterInput properties to UploadAdmin type (https://github.com/payloadcms/payload/issues/14775) (https://github.com/payloadcms/payload/commit/22a0255)
• add missing afterOperation and beforeOperation hook calls (https://github.com/payloadcms/payload/issues/14778) (https://github.com/payloadcms/payload/commit/e9cd2a5)
• sanitized versions type was incorrect (https://github.com/payloadcms/payload/issues/14810) (https://github.com/payloadcms/payload/commit/51c951f)
• plugin-multi-tenant: moves getGlobalViewRedirect from utilities to rsc exports (https://github.com/payloadcms/payload/issues/14817) (https://github.com/payloadcms/payload/commit/1340818)
• ui: autosave not queued while background process is in flight (https://github.com/payloadcms/payload/issues/14805) (https://github.com/payloadcms/payload/commit/14f042f)
• ui: ensure block error css only gets applied to the affected block (https://github.com/payloadcms/payload/issues/14826) (https://github.com/payloadcms/payload/commit/7520140)
• ui: missing translation support in SelectMany component (https://github.com/payloadcms/payload/issues/14819) (https://github.com/payloadcms/payload/commit/8fa91a5)

⚡ Performance

• cpa: use AST for templates (https://github.com/payloadcms/payload/issues/14648) (https://github.com/payloadcms/payload/commit/bad6680)

⚙️ CI

• clean up bug report template for auto-labeling (https://github.com/payloadcms/payload/commit/ebee8e1)

🏡 Chores

• claude: add coding patterns and best practices section (https://github.com/payloadcms/payload/issues/14829) (https://github.com/payloadcms/payload/commit/c5d8e68)
• deps: bump @types/react and @types/react-dom to 19.2.1 (https://github.com/payloadcms/payload/issues/14815) (https://github.com/payloadcms/payload/commit/d56796b)
• deps: bump next to 15.4.8 in root and test dirs (https://github.com/payloadcms/payload/issues/14811) (https://github.com/payloadcms/payload/commit/1c3417d)

⚠️ BREAKING CHANGES

• plugin-ecommerce: add ability to enable guest carts with reworked access config (https://github.com/payloadcms/payload/issues/14565) (https://github.com/payloadcms/payload/commit/90c92f4)

This PR introduce a breaking change into the plugin as it was necessary in order to provide more secure guest carts.

🤝 Contributors

• Paul (@paulpopus)
• Jake (@jacobsfletch)
• Jessica Rynkar (@jessrynkar)
• Elliot DeNolf (@denolfe)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Jens Becker (@jhb-dev)

v3.66.0 (2025-12-03)

⚠️ Security Issue

A critical-severity vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks that use it, including Next.js (CVE-2025-66478).

You are strongly encouraged to immediately upgrade your own apps to the nearest patched versions of React and Next.js.

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of React or Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add react@19.2.1 next@15.4.8

To do this manually:

1. In your package.json:
   • Bump react to 19.2.1
   • Bump next to 15.4.8
2. Reinstall node modules, e.g. pnpm i
3. Redeploy your app

Here's a full breakdown of the vulnerable packages and their patched releases:

| Vulnerable package | Patched release | | ------------- | ------------- | | React | 19.0, 19.1, 19.2 19.0.1, 19.1.2, and 19.2.1 | | Next.js | 14.3.0-canary, 15.x, and 16.x (App Router) 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |

See https://github.com/payloadcms/payload/issues/14807 for more details.

🚀 Features

• support custom slugify functions (#14117) (59a1607)
• accessibility testing and improvements (#14454) (42cbd70)
• support external JSON schema file references in type generation (#14749) (cb3a078)
• cpa: assume adapter for with-cloudflare-d1 template (#14799) (4f03016)
• richtext-lexical: add align support to upload nodes (#14720) (a21c47b)

Feature Details

Custom Slugify Functions - Override the default slug field behavior with your own slugify function. Useful for special character encoding, additional language support, or custom slug formatting. Also deprecates fieldToUse in favor of useAsSlug for consistency with useAsTitle. #14117

import type { CollectionConfig } from 'payload'
import { slugField } from 'payload'
import slugify from 'slugify';

export const MyCollection: CollectionConfig = {
  // ...
  fields: [
    // ...
    slugField({
      slugify: ({ valueToSlugify }) => slugify(valueToSlugify, {
        // ...additional `slugify` options here
      })
    })
  ]
}

Accessibility Testing and Improvements - Adds automated accessibility testing infrastructure including axe a11y scans, focus indicator checks, and horizontal scroll overflow detection. Covers all fields, major views, components, plugins, and Lexical editor. See the a11y report discussion for tracked issues. #14454

External JSON Schema References in Type Generation - Enables $ref pointers to external .json schema files in typescriptSchema field config. External references are resolved relative to process.cwd(). #14749

// payload.config.ts
{
  typescript: {
    schema: [
      ({ jsonSchema }) => {
        jsonSchema.definitions.MyType = {
          $ref: './schemas/my-type.json'
        }
        return jsonSchema
      },
    ]
  }
}

Auto-detect D1 Adapter (cpa) - The with-cloudflare-d1 template now automatically assumes the D1 database adapter, eliminating the database selection prompt during project creation. #14799

Upload Node Alignment (richtext-lexical) - Adds alignment support to upload nodes in the Lexical editor. Upload/media blocks can now be aligned left, center, or right using the FORMAT_ELEMENT_COMMAND. #14720

🐛 Bug Fixes

• remove "all" from JSDoc comment on supported http methods in endpoints (#14777) (8c8def9)
• should exclude svg files from file buffer mime validation (#14751) (015b363)
• deps: bump minimum react and next versions (#14807) (2dfe464)
• plugin-import-export: incorrect user type in Export causing runtime type mismatch (#14790) (61f5aee)
• plugin-multi-tenant: tenant modal not appearing when autosave is off (#14806) (b96e928)
• plugin-multi-tenant: auto assign tenant when autosave is enabled (#14745) (b0674fa)
• richtext-lexical: copying and pasting a single block in Lexical results in an error due to duplicate ID (#14738) (cd9addf)
• richtext-lexical: export serverInlineBlock modules (#14739) (becceb7)
• translations: translate slug field actions (#14784) (5542e56)
• ui: prevent NaN page parameter in polymorphic relationship pagination (#14795) (bbdfdb8)
• ui: reduce spacing between checkbox and first column when few columns shown (#14776) (6ae1bc8)

📚 Documentation

• documents block field image aspect ratio (#14679) (b6a336e)
• document default password reset URL (#14688) (a68423b)
• adds strongly typed examples (#14513) (abe8563)

🧪 Tests

• deflake sort e2e (#14746) (a07cf47)

📝 Templates

• update with-cloudflare-d1 to the latest OpenNext and wrangler (#14509) (5150388)

⚙️ CI

• auto-label issues (#14792) (ee632d4)

🏡 Chores

• claude: enable obra/superpowers plugin (#14789) (32df641)

⚠️ BREAKING CHANGES

• deps: bump minimum react and next versions (#14807) (2dfe464)e

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Jake (@jacobsfletch)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jessica Rynkar (@jessrynkar)
• Tobias Odendahl (@tak-amboss)
• Ricardo Tavares (@rjgtav)

v3.65.0 (2025-11-25)

❗️Breaking Change

This release disables Turbopack Build support. Please use Webpack to build your app for now. You can do so by using pnpm build on Next.js 15 and pnpm build --webpack on Next.js 16.

🚀 Features

• add augmentable interfaces for collection and global custom properties (#14729) (850c252)
• allow to specify payload instance cache key in handleEndpoints (#14675) (efa2fd2)
• db-mongodb: add afterCreateConnection and afterOpenConnection hooks (#14649) (af6ba86)
• plugin-mcp: add localization support to MCP resource operations (#14334) (a3f490b)
• plugin-mcp: adds a PayloadRequest to custom tool, prompt, and resource handlers (#14644) (0d14b06)
• ui: extract block selector from blocks drawer (#14697) (b9b11f0)

Type-Safe Custom Properties - Add augmentable interfaces for collection and global custom properties: CollectionCustom, CollectionAdminCustom, GlobalCustom, and GlobalAdminCustom. Enables type-safe plugin configuration at the collection/global level with full autocomplete support, matching the existing FieldCustom pattern. #14729

// Augment interfaces in your plugin or project
declare module 'payload' {
  export interface CollectionAdminCustom {
    disabledFields?: string[]
  }

  export interface CollectionCustom {
    myPluginConfig?: {
      enabled: boolean
      settings: Record<string, any>
    }
  }
}

// Now get full type safety in collections
export const Posts: CollectionConfig = {
  slug: 'posts',
  admin: {
    custom: {
      disabledFields: ['status'] // ✅ Type-safe!
    }
  },
  custom: {
    myPluginConfig: {
      enabled: true,
      settings: {}
    }
  }
}

Payload Instance Cache Key - Specify payloadInstanceCacheKey in handleEndpoints and createPayloadRequest to control which cached Payload instance is used for custom endpoints. Useful for multi-tenant scenarios or when managing multiple Payload instances. #14675

MongoDB Connection Lifecycle Hooks (db-mongodb) - Add afterCreateConnection and afterOpenConnection hooks to the MongoDB adapter for performing setup logic after connection/pool initialization. Enables use cases like connection pooling in serverless environments. #14649

export const databaseAdapter = mongooseAdapter({
  // ...
  afterOpenConnection: async (adapter) => {
    const client = adapter.connection.getClient()
    attachDatabasePool(client);
  },
})

MCP Localization Support (plugin-mcp) - Add full localization support to MCP resource operations (create, update, find, delete). All MCP tools now accept locale and fallbackLocale parameters, bringing feature parity with Payload's REST API for multilingual content management. #14334

// Create content in English
{ "name": "createPosts", "arguments": { "title": "Hello", "locale": "en" }}

// Add Spanish translation
{ "name": "updatePosts", "arguments": { "id": "123", "title": "Hola", "locale": "es" }}

// Retrieve all translations
{ "name": "findPosts", "arguments": { "id": "123", "locale": "all" }}

PayloadRequest in MCP Handlers (plugin-mcp) - Custom tool, prompt, and resource handlers now receive a PayloadRequest object, enabling access to the Payload instance and consistent access control patterns without additional lookups. #14644

// Previously
handler: async (args: Record<string, unknown>) => {}

// Now with req parameter
handler: async (args: Record<string, unknown>, req: PayloadRequest, _extra) => {
  // Access payload instance, user, locale, etc.
  const { payload, user, locale } = req
}

Reusable Block Selector Component (ui) - Extract BlockSelector component from BlocksDrawer and export for external use. Includes new onSelect callback for custom side effects when blocks are selected. #14697

🐛 Bug Fixes

• trigger login hooks after reset password (#14711) (32560e9)
• ensure restoreAsDraft only updates the published doc when draft is false (#14658) (3f3f5db)
• remove init of transaction for global doc access (#14693) (c455f58)
• count versions should allow querying on localized fields (#14695) (e1168a0)
• prevent upload mimeType error when useTempFiles is true (#14689) (fe8a3e8)
• autoRefresh not working due to stale closure and missing in client config (#14612) (8a3c6dc)
• type TypeWithVersion missing latest property (#14676) (9b6e1a3)
• graphql version error in production (#14622) (cd5b344)
• corrects outgoing localized data from afterRead (#14603) (87137fe)
• relationships should not fallback if fallbackLocale is false (#14641) (9f55254)
• hide turbopack warnings (#14640) (03f19bc)
• logout-inactivity route gets stuck on loading indicator when inactivity and isLoggedIn are true (#14596) (7a31c02)
• tighten up error visibility handling (#14606) (c74a40f)
• claude: properly structure claude plugin (#14432) (3198bbe)
• db-*: do not exit process on error during connect (#14647) (ab03163)
• db-mongodb,drizzle: prevent race condition in transaction session cleanup (#14651) (a7cf30d)
• drizzle: postgres 18 support (#14700) (294ebf5)
• next: remove turbopack build support to fix bundle size regression (#14696) (c484a05)
• next: prevent transaction race condition in renderDocument parallel operations (#14652) (802a21a)
• plugin-multi-tenant: fix infinite sync tenant network calls (#14604) (8901c7b)
• richtext-lexical: block names were not loaded (#14698) (c7a87c0)
• ui: ensures modal closes on route change (#14718) (a044a08)
• ui: query preset crash with empty filters in postgres/sqlite (#14722) (42a4384)
• ui: app header overflow on mobile (#14704) (91d3e04)
• ui: shows minRowsProp instead of minRows (#14681) (e40a4b7)
• ui: publish label regression from 14690 (#14692) (ba5834b)
• ui: publish button shows locale-specific text without localized fields (#14690) (caf68e4)
• ui: equals filter shows no results when value is cleared (#14673) (220a18f)
• ui: select/relationship field values have no tooltip on hover (#14662) (bc23084)
• ui: bulk uploads silently skips files without filenames (#14621) (8f14359)
• ui: relationship field label not updated when document is updated from other drawer (#14609) (0cc06a1)
• ui: duplicate should duplicate as draft by default (#14619) (fb05840)

⚡ Performance

• up to 5000% faster permissions calculation (#14631) (0d9ec91)
• plugin-mcp: removes 'override' config (#14598) (89ab526)

🛠 Refactors

• db-mongodb,drizzle: reduce race condition window between retrieving and using a session (#14653) (bd9f15f)
• ui: strongly type render-list server action (#14611) (337409b)

📚 Documentation

• clarify draft parameter and _status field interaction (#14723) (00d9156)
• add info about imports and ui best practices (#14702) (38f370a)
• adds examples for sending email attachments (#14665) (61547f9)
• updates node version in docker file (#14664) (276685d)

🧪 Tests

• deflakes localization e2e suite (#14639) (6e364fa)
• fix auth e2e test suite flakiness (#14655) (78d5be6)
• adjust test targeting to wait for input (#14614) (36f3cad)
• fix flaky toast assertions in draft validation tests (#14615) (62508ca)

🏡 Chores

• getLocalizedPaths should filter fields with locale-like names (#14661) (fd7c94c)
• updates MCP docs (#14625) (61c61fe)
• claude: further improve payload skill (#14705) (89be107)
• db-mongodb: export transform function (#14677) (51898f5)

⚠️ BREAKING CHANGES

• plugin-mcp: removes 'override' config (#14598) (89ab526)

  • Removes override from the plugin config
  • Updates documentation

🤝 Contributors

• Patrik (@PatrikKozak)
• MrLijan (@MrLijan)
• Jessica Rynkar (@jessrynkar)
• Alessio Gravili (@AlessioGr)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)
• Elliot DeNolf (@denolfe)
• Jacob Fletcher (@jacobsfletch)
• Violet Rosenzweig (@6TELOIV)
• Kendell (@kendelljoseph)
• Dan Ribbens (@DanRibbens)
• Steven Ceuppens (@stevenceuppens)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Zvonimir Bušić (@ZvonimirBusic)

v3.64.0 (2025-11-13)

🚀 Features

• add support for UTC timezone in date fields (#14586) (8b34e40)
• next: turbopack build support, fix incorrect handling of external packages (#14475) (3a975d7)
• plugin-mcp: adds MCP context to req.payloadAPI (#14595) (860bdf2)
• plugin-mcp: adds custom auth config (#14538) (73a18dc)
• plugin-redirects: support translations (#14548) (ad8f0b2)

UTC Timezone Support - Add support for 'UTC' as a timezone value in date fields. Previously unsupported due to validation against Intl API runtime values. Also fixes issue where having only one timezone would make it selected by default. #14586

import { buildConfig } from 'payload'

const config = buildConfig({
  admin: {
    timezones: {
      supportedTimezones: [
        {
          label: 'UTC',
          value: 'UTC',
        },
      ],
      defaultTimezone: 'UTC',
    },
  },
})

Turbopack Build Support - Full support for Turbopack builds (now default in Next.js 16). Properly externalizes database adapter entry points to prevent production failures. Resolves issues with direct dependency externalization causing runtime errors. #14475

MCP Context Detection - Detect when Payload API calls originate from MCP context using req.payloadAPI === 'MCP'. Enables conditional logic in hooks based on MCP usage. #14595

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeRead: [
      ({ doc, req }) => {
        if (req.payloadAPI === 'MCP') {
          doc.title = `${doc.title} (MCP Hook Override)`
        }
        return doc
      },
    ],
  },
}

Custom Auth Configuration - Override default API key authentication with custom authorization logic using overrideAuth. Provides granular control over MCP access permissions. #14538

import { type MCPAccessSettings, mcpPlugin } from '@payloadcms/plugin-mcp'

plugins: [
  mcpPlugin({
    overrideAuth: (req) => {
      return {
        posts: { find: true },
        products: { find: true, update: true },
      } as MCPAccessSettings
    },
  })
]

Redirect Plugin Translation Support - Enable translations for plugin fields, eliminating need for verbose field overrides configuration. Configure field labels in multiple languages directly through i18n config. #14548

export default buildConfig({
  i18n: {
    translations: {
      en: {
        'plugin-redirects': {
          fromUrl: 'Source URL (Custom)',
        },
      },
      de: {
        'plugin-redirects': {
          fromUrl: 'Quell-URL',
          internalLink: 'Interner Link',
        },
      },
    },
  },
  plugins: [redirectsPlugin({ collections: ['pages'] })],
})

🐛 Bug Fixes

• previous value undefined for nested fields in afterChange (#14582) (d60ea6e)
• default values inconsistent between Local and REST APIs (#14556) (8f7ef35)
• findGlobalVersionByID id type (#14534) (99ed0e5)
• localized block fields (#14587) (2295c89)
• add secondary PDF mimeType validation and tests (#14529) (ce479ab)
• unlock access not being correctly denied when using a where query (#14585) (f63e34e)
• error when calling jobs.handleSchedules when there are no schedules defined (#14519) (072cb97)
• changing the language of the admin panel does not work for "radio" and "select" fields. (#14569) (bb520d6)
• inject custom translations into supportedLanguages in sanitization (#14549) (d7f1ea2)
• db-mongodb: localization transforms on nested localized fields (#14600) (6070d8d)
• db-mongodb: findVersions/findGlobalVersions not respecting limit of 0 (#14573) (43dcf84)
• graphql: avoid errors with sort as empty string (#14594) (fad476d)
• next: turbopack error when using db-d1-sqlite package (#14558) (bd6decf)
• next, ui: show status "changed" in List View (#14555) (565680d)
• plugin-form-builder: expose formSubmissionID as a variable to be used in emails (#14429) (ad74386)
• plugin-mcp: correctly uses local access controls (#14457) (fc2becf)
• richtext-lexical: urls being wrongly encoded by incomplete URL validation (#14557) (2cb0c59)
• storage-r2: respect data.prefix in handleUpload path construction (#14485) (454d0d3)
• ui: error on inserting new documents on uploads with hasMany (#14567) (fd44d2b)
• ui: save button becomes disabled after failed save with draft validation (#14584) (6fda71a)
• ui: invalid req.locale shows incorrect data (#14537) (f29a07f)

⚡ Performance

• ui: don't return full documents on bulk UI operations (#14145) (4430739)

🛠 Refactors

• richtext-slate: deprecate slate editor (#14536) (1a4ce44)

📚 Documentation

• updates Jobs queue docs (#14552) (dff3d1b)

🧪 Tests

• move draft validation tests from form-state to field error states test suite (#14599) (e1f07ff)
• run cpa against create-next-app latest and canary (#14583) (cca97c6)
• 21x faster versions int suite (#14510) (844f99f)

📝 Templates

• update next.js 15.4.4 to 15.4.7 (#14533) (d3b934c)

⚙️ CI

• fix ERR_PNPM_ADDING_TO_ROOT in create-payload-app int (#14581) (6789939)

🏡 Chores

• add .worktrees to .gitignore (87f2bd9)
• fix serverExternalPackages errors in monorepo (#14535) (e76da3f)

🤝 Contributors

• Kendell (@kendelljoseph)
• Jarrod Flesch (@JarrodMFlesch)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• Sasha (@r1tsuu)
• Sam (@damnsamn)
• Alessio Gravili (@AlessioGr)
• Tobias Odendahl (@tak-amboss)
• Elliot DeNolf (@denolfe)
• Jens Becker (@jhb-dev)
• Sean Zubrickas (@zubricks)

v3.63.0 (2025-11-07)

🚀 Features

• add support for polymorphic uploads (#14363) (df40d0e)
• adds new UI option Duplicate In [Select Locales] (#13803) (53d8557)

Polymorphic Uploads

Upload fields can now reference multiple upload collections, similar to polymorphic relationships. This enables more flexible media management where a single field can accept different types of files from various collections. Works seamlessly with bulk upload and hasMany options. #14363

import type { CollectionConfig } from 'payload'

export const ExampleCollection: CollectionConfig = {
  slug: 'example-collection',
  fields: [
    {
      name: 'media',
      type: 'upload',
      relationTo: ['images', 'documents', 'videos'], // references multiple upload collections
    },
  ],
}

Can also be combined with hasMany:

import type { CollectionConfig } from 'payload'

export const ExampleCollection: CollectionConfig = {
  slug: 'example-collection',
  fields: [
    {
      name: 'media',
      type: 'upload',
      relationTo: ['images', 'documents', 'videos'], // references multiple upload collections
      hasMany: true, // allows multiple uploads
    },
  ],
}

🐛 Bug Fixes

• use TSiblingData for previousSiblingDoc in FieldHook (#14503) (339a0c3)
• support generic types for kv.get (#14494) (f6194c6)
• group-by sticky pagination not rendering for virtual relationship fields (#14470) (648021c)
• ensure importMap is reliably generated during HMR (fixes Next.js 16 issue) (#14474) (61a7095)
• hmr not working in next.js 16 (#14462) (0231a8d)
• disable lockedDocuments if the kv adapter uses a collection (#14453) (827c9a1)
• drizzle: postgesql where in jsonb (#13742) (207295b)
• graphql: sort by multiple fields (#14486) (b925d34)
• next: withPayload wrapper next.js 16 support (#14473) (c0de75e)
• next: version._status field queried/returned for entities without drafts (#14423) (a22dff3)
• plugin-cloud-storage: file sizes use correct mime type (#11633) (2410296)
• richtext-lexical: prevent unnecessary requests for inline blocks (#14522) (69408f0)
• richtext-lexical: bulk upload drawer rendered at the wrong depth if already in a drawer (#14472) (4fd8d03)
• ui: virtual fields disappearing from filter/groupBy dropdowns with access control (#14514) (a3c0e84)
• ui: safely access fieldPermissions (#14458) (2393721)
• ui: simplify UI orderable collections table by allowing only ascending order (#14433) (eba6cfc)

⚡ Performance

• ui: avoid unnecessary remounting of DraggableSortable (#14463) (91e64b3)

🛠 Refactors

• use formatNames utility for interface name generation (#14481) (39bead7)

📚 Documentation

• hooks terminology update (#13847) (245576b)
• plugin-mcp: clarify example (#14325) (c8d6cf0)

🧪 Tests

• use new chromium headless browser for playwright, bump playwright (#14464) (2bb5535)
• multi-tenant flake (#14447) (80d7781)

📝 Templates

• remove payload cloud template, remove cloud plugin from templates (#14479) (76ba2df)
• remove outdated cloning and payload cloud information (#14484) (d4d9622)

🔨 Build

• add kv-redis to publishList (#14416) (6420927)

⚙️ CI

• speed up workflow reruns, remove run_number from build cache key (#14448) (f67d031)
• add kv and plugin-mcp to valid PR scopes (be0943a)

🏡 Chores

• standardize query param parsing (#14498) (3c9f56e)
• enables folders on website template (#14116) (219fba2)
• bump kv-redis version (ff670c0)
• claude: update claude PostToolUse hook to only format on write (9f2adeb)
• claude: set some sane defaults (#14445) (aa14d86)
• claude: add analyze-issue command (#14435) (f1456a0)

🤝 Contributors

• Sasha (@r1tsuu)
• Elliot DeNolf (@denolfe)
• Chris Rieckmann (@c-riq)
• Sam Wheeler (@swheeler7)
• Alessio Gravili (@AlessioGr)
• Slava Nossar (@slavanossar)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Tobias Odendahl (@tak-amboss)
• Kendell (@kendelljoseph)
• Jessica Rynkar (@jessrynkar)
• German Jablonski (@GermanJablo)
• Sean Zubrickas (@zubricks)
• Violet Rosenzweig (@6TELOIV)

v3.62.1 (2025-11-03)

🐛 Bug Fixes

The KV implementation was requiring all postgres users to have to create a new migration. The following fix prevents that.

• disable lockedDocuments if the kv adapter uses a collection (#14453) (6930aaf)

v3.62.0 (2025-10-30)

🚀 Features

Jobs Access Control

Adds role-based access control for job queue and cancel operations, allowing you to restrict who can manage background jobs in your application. Both operations now support overrideAccess parameter and respect custom access control functions defined in your jobs configuration. #14404

// Configure access control
jobs: {
  access: {
    queue: ({ req }) => req.user?.roles?.includes('admin'),
    cancel: ({ req }) => req.user?.roles?.includes('admin'),
  }
}

// Use in Local API
await payload.jobs.cancel({
  where: { workflowSlug: { equals: 'sync' } },
  overrideAccess: false,
  req,
})

Per-Field Timezone Configuration

Date fields can now have individual timezone settings, allowing different date fields to support their own list of supported timezones with custom default values. This enables more flexible date handling across your application. #14410

{
  name: 'date',
  type: 'date',
  timezone: {
    defaultTimezone: 'America/New_York',
    supportedTimezones: [
      { label: 'New York', value: 'America/New_York' },
      { label: 'Los Angeles', value: 'America/Los_Angeles' },
      { label: 'London', value: 'Europe/London' },
    ],
  },
}

You can also enforce a specific timezone by specifying just one with a default value:

{
  name: 'date',
  type: 'date',
  timezone: {
    defaultTimezone: 'Europe/London',
    supportedTimezones: [
      { label: 'London', value: 'Europe/London' },
    ],
  },
}

KV Storage Adapters

Introduces a new key-value storage system with multiple adapter options (Database, In-Memory, Redis) for enhanced data persistence and performance. This provides the foundation for the upcoming Realtime API and other features requiring fast key-value access. #9913

Access the KV store via payload.kv with the following interface:

interface KVAdapter {
  /**
   * Clears all entries in the store.
   * @returns A promise that resolves once the store is cleared.
   */
  clear(): Promise<void>

  /**
   * Deletes a value from the store by its key.
   * @param key - The key to delete.
   * @returns A promise that resolves once the key is deleted.
   */
  delete(key: string): Promise<void>

  /**
   * Retrieves a value from the store by its key.
   * @param key - The key to look up.
   * @returns A promise that resolves to the value, or `null` if not found.
   */
  get(key: string): Promise<KVStoreValue | null>

  /**
   * Checks if a key exists in the store.
   * @param key - The key to check.
   * @returns A promise that resolves to `true` if the key exists, otherwise `false`.
   */
  has(key: string): Promise<boolean>

  /**
   * Retrieves all the keys in the store.
   * @returns A promise that resolves to an array of keys.
   */
  keys(): Promise<string[]>

  /**
   * Sets a value in the store with the given key.
   * @param key - The key to associate with the value.
   * @param value - The value to store.
   * @returns A promise that resolves once the value is stored.
   */
  set(key: string, value: KVStoreValue): Promise<void>
}

Configure the adapter using the kv property:

buildConfig({
  kv: adapter()
})

Database KV adapter (default) - Uses your existing database with a hidden payload-kv collection:

import { databaseKVAdapter } from 'payload'

buildConfig({
  kv: databaseKVAdapter({
    kvCollectionOverrides: {
      slug: 'custom-kv',
      ...(process.env.DEBUG === 'true' && {
        admin: { hidden: false },
        access: {},
      }),
    },
  }),
})

In Memory KV adapter - Fast memory-based storage for development:

import { inMemoryKVAdapter } from 'payload'

buildConfig({
  kv: inMemoryKVAdapter(),
})

Redis KV Adapter - Production-ready Redis integration:

pnpm add @payloadcms/kv-redis

import { redisKVAdapter } from '@payloadcms/kv-redis'

buildConfig({
  kv: redisKVAdapter({
    keyPrefix: "custom-prefix:", // defaults to 'payload-kv:'
    redisURL: "redis://127.0.0.1:6379" // defaults to process.env.REDIS_URL
  }),
})

Configurable Toast Position

Toast notifications can now be positioned anywhere on the screen (top-left, top-center, top-right, bottom-left, bottom-center, bottom-right), giving you control over where important messages appear to your users. This is particularly useful for applications with large screens or specific UI layouts. #14405

The position configuration is a direct pass-through of the Sonner library's position options, with 'bottom-right' remaining the default.

Feature PRs

• add access control for jobs queue and cancel operations (#14404) (0a37edb)
• timezone config can now be added on a per field basis (#14410) (a3df837)
• add KV storage adapters (#9913) (ffb9a2e)
• make toast position configurable (#14405) (d5fab43)
• ui: export useQueue React hook (#14396) (612880d)

🐛 Bug Fixes

• globals with versions return _status field when access denied (#14406) (b766ae6)
• custom dashboard component causes runtime error on create-first-user and account views (#14393) (d5f4e72)
• claude: remove invalid frontmatter fields (#14411) (118d005)
• db-*: findMigrationDir in projects without src folder (#14381) (059185f)
• db-mongodb: migration fails for cosmosDB (#14401) (10a640c)
• db-mongodb: type error with prodMigrations (#14394) (8e5e23a)
• db-mongodb: duplicate ids in sanitizeQueryValue (#11905) (36bb188)
• db-postgres: hasMany relationship/number/text fields inside blocks are incorrectly returned when using select (#14399) (850cc38)
• drizzle: number fields in generated schema with defaultValue (#14365) (8996b35)
• plugin-multi-tenant: remove unused syncTenants from useEffect deps (#14362) (906a3dc)
• richtext-lexical: do not run json.parse if value is undefined or null (#14385) (09a6140)
• richtext-lexical: prevent TS CodeBlocks from sharing Monaco model (useId) (#14351) (5caebd1)
• storage-*: update the client cache to use a map instead with cache keys per bucket config (#14267) (38f2e1f)
• ui: where builder crashing with invalid queries (#14342) (6c83046)

🛠 Refactors

• deprecate job queue depth property (#14402) (1341f69)
• ui: simplify ConfigProvider, improve useControllableState types and defaultValue fallback (#14409) (255320e)

⚙️ CI

• add claude as valid scope (560f2f3)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Alessio Gravili (@AlessioGr)
• Paul (@paulpopus)
• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Ossaid Qadri (@imossaidqadri)
• Philipp Schneider (@philipp-tailor)
• Kholiavko Roman (@kholiavko-roman)
• Jacob Fletcher (@jacobsfletch)
• Séalan Cronin (@sealan)
• Jarrod Flesch (@JarrodMFlesch)
• Justus Blönnigen (@technicaldirector)

v3.61.1 (2025-10-24)

🐛 Bug Fixes

• ui: ask before closing doc drawer with edits (#14324) (c1d017a)
• filteredLocales in the client config are stale (#14326) (5a37909)
• db-*: querying joins with $exists on mongodb and improve performance when querying multiple times on postgres (#14315) (1f166ba)
• db-postgres: regression in migrations in the _rels table (#14341) (a2b1c9b)
• plugin-search: add locale to key in syncedDocsSet (#14289) (c29e1f0)
• ui: account for array values in transformWhereToNaturalLanguage (#14339) (f2cabe7)
• ui: preview button not responding to conditional URL (#14277) (ad0e7b2)
• ui: use depth: 0 for publish specific locale request (#14313) (b68715e)

📚 Documentation

• various grammar and typo fixes (#14170) (c96d50d)
• adds example for name or label on groups field (#14323) (6d88f7d)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Boyan Bratvanov (@bratvanov)
• Sasha (@r1tsuu)
• Sean Zubrickas (@zubricks)
• Said Akhrarov (@akhrarovsaid)
• Paul (@paulpopus)

v3.61.0 (2025-10-23)

🚀 Features

• @payloadcms/plugin-mcp Released (BETA) - New plugin that enables Payload to function as an MCP server, allowing AI models to interact with your collections through a standardized protocol. The plugin provides built-in tools for CRUD operations on collections and supports custom tools. #13674
  • MCP Documentation
  • GitHub Discussion for feedback

🐛 Bug Fixes

• user updatedAt modified during session operations (#14269) (a1671ec)
• document header text clipping (#14291) (db973e9)
• typescript requires fields when draft: true despite passing draft: true (#14271) (1016cd0)
• blocks access control not respecting update access whether on collection or on a per field basis (#14226) (88cb687)
• allow slugField to accept localized argument and fixed slug generation with custom field names (#14234) (2ced43d)
• db-postgres: limit index and foreign key names length (#14236) (a63b4d9)
• drizzle: folders with trash enabled don't display documents in polymorphic joins (#14223) (6d3aaaf)
• plugin-form-builder: display full textarea content in form submissions (#14161) (24dad01)
• plugin-multi-tenant: block references issue (#14320) (4f8b7d2)
• plugin-search: exclude skipped drafts in reindex handler (#14224) (0dc782c)
• richtext-lexical: ensure block node form displays up-to-date value when editor remounts (#14295) (f8e6b65)
• richtext-lexical: node replacements ignored for block, inline block, upload, unknown and relationship nodes (#14249) (1561853)
• richtext-lexical, ui: ui errors with Slash Menu in Lexical and SearchBar component in RTL (#14231) (fed3bba)
• ui: document locked modal blocks interaction after clicking Go Back (#14287) (5782a41)
• ui: change password button being hidden and unlock button being shown incorrectly on account page (#14220) (bcb4d8e)

⚡ Performance

• richtext-lexical: decrease size of field schema, minor perf optimizations (#14248) (e25ce1c)
• richtext-lexical: do not return i18n from editor adapter (#14228) (54224c3)

🛠 Refactors

• richtext-lexical: ensure classNames of all nodes can be customized (#14294) (e1ef1d2)

📚 Documentation

• improve slate to lexical migration docs (#14309) (6838c56)
• db indexes - code example missing const (#14171) (3b37f4a)
• add explanation about re-renders in useFormFields (#14288) (8cdb5dc)
• add jsdocs to RichText adapter (#14246) (8b0ac01)
• clarify admin.timezones list configuration with example (#14238) (de5f3db)
• fix link to slug-overrides in text.mdx (#14211) (8136a84)
• add mention of the useUploadHandlers error and steps to remedy it with a mention to monorepos (#14233) (8663024)

🔨 Build

• add plugin-mcp to publishList (#14319) (894cf0c)
• add README sync for top-level -> packages/payload (#14316) (2aba827)

🏡 Chores

• extract snapshot logic, correct types in version ops (#14290) (c2dcd12)
• bump pino to v9.14.0 and pino-pretty (#14283) (b252658)
• refresh CLAUDE.md (#14268) (05a869d)
• cleanup, short-circuit .split calls (#14245) (d57be12)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Kendell (@kendelljoseph)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Boyan Bratvanov (@bratvanov)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Bogdan Covrig (@bogdaaamn)
• Romain Pironneau (@romainpi)
• Sasha (@r1tsuu)
• Ahmed Abdellahi Abdat (@ahmed-abdat)
• Said Akhrarov (@akhrarovsaid)

v3.60.0 (2025-10-16)

🚀 Features

• accept multiple locales in fallbackLocale (#13822) (623a1b8)
• adds settingsMenu to admin navigation sidebar (#14139) (ee8b3cf)
• plugin-multi-tenant: allow collection access to be overridden via callback (#14127) (c40eec2)
• plugin-multi-tenant: allow hasMany on tenant field overrides (#14120) (fb93cd1)
• plugin-multi-tenant: user collection access overrides (#14119) (38b7a60)
• richtext-lexical: add collection filtering to UploadFeature, refactor relationship hooks (#14111) (6defba9)
• richtext-lexical: client-side block markdown shortcuts, code block (#13813) (07a1eff)

Localization

• Multiple fallback locales - fallbackLocale now accepts an array of locales for queries and locale configs. Payload will check each locale in order until finding a value, eliminating the need for manual fallback handling. #13822

  /** Local API **/
    await payload.findByID({
      id,
      collection,
      locale: 'en',
      fallbackLocale: ['fr', 'es'],
    })
  
  /** REST API **/
    await fetch(`${baseURL}/api/${collectionSlug}?locale=en&fallbackLocale[]=fr&fallbackLocale[]=es`)
  
  /** GraphQL **/
    await restClient.GRAPHQL_POST({
      body,
      query: { locale: 'en', fallbackLocale: ['fr', 'es']},
    })
  
  /** Locale Configs **/
    locales: [
      {
        code: 'en',
        label: 'English',
        fallbackLocale: ['fr', 'es'],
      },
    ]
  

Admin UI

• Settings menu in navigation - New admin.components.settingsMenu config option adds a gear icon above the logout button. Click to open a popup menu with custom admin-level utilities and actions that don't fit into collection or global navigation. #14139

  <img width="174" height="239" alt="Screenshot 2025-10-14 at 11 43 37 AM" src="https://github.com/user-attachments/assets/5dca8ea7-ed99-4bc1-89c2-bc6da7d8f323" />

Multi-Tenant Plugin

• Collection access overrides - New accessResultOverride callback allows modifying multi-tenant access control results per operation (read, create, update, delete, readVersions, unlock). Enables custom logic like allowing shared content across tenants. #14127

  multiTenantPlugin<ConfigType>({
    collections: {
      posts: {
        accessResultOverride: async ({ accessResult, accessKey, req }) => {
          // here is where you can change the access result or return something entirely different
          if (accessKey === 'read') {
            return {
              or: [
                {
                  isShared: {
                    equals: true,
                  }
                },
                accessResult
              ]
            }
          } else {
            return accessResult
          }
        }
      }
    }
  })
  

• Multiple tenants per document - Tenant field overrides now support hasMany relationships, allowing documents to belong to multiple tenants. #14120

• User collection access overrides - New usersAccessResultOverride callback enables customizing access control on the users collection, overriding default tenant privacy when needed. #14119

  usersAccessResultOverride: ({
    accessKey: 'read', // 'create', 'read', 'update', 'delete', 'readVersions', 'unlock'
    accessResult: AccessResult, // the `AccessResult` type
    ...args, // AccessArgs
  }) => {
    // this is where you could adjust what gets returned here.
    if (accessKey === 'read') {
      return true // over simplified example
    }
  
    // default to returning the result from the plugin
    return accessResult
  }
  

Lexical Rich Text

• Upload collection filtering - UploadFeature now supports disabledCollections and enabledCollections to control which collections appear in the upload drawer. Also refactors enabled relationships logic with cleaner useEnabledRelationships hook. #14111

• Client-side markdown shortcuts & code blocks - Blocks with admin.jsx now support markdown shortcuts on the client (previously server-only). Includes pre-made CodeBlock component for use in BlocksFeature. Also fixes readOnly handling across nested fields. #13813

  https://github.com/user-attachments/assets/cfc0d2a8-ffb3-4926-b097-ad9c2b133586

🐛 Bug Fixes

• findDistinct by explicit ID paths in relationships and virtual fields (#14215) (2b1b6ee)
• hasMany / polymorphic relationships to custom number IDs (#14201) (a3b3865)
• hide fields with read: false in list view columns, filters, and groupBy (#14118) (bcd40b6)
• validate Point Field to -180 to 180 for longitude and -90 to 90 for latitude (#14206) (13a1d90)
• urls in upload sizes are not encoded (#14205) (747a049)
• restoring trashed drafts with empty required fields fails validation (#14186) (3317207)
• db-d1-sqlite: add missing blocksAsJSON property (#14103) (f14a38e)
• db-mongodb: documents not showing in folders with useJoinAggregations: false (#14155) (e613a78)
• db-mongodb: improve check for ObjectId (#14131) (32e2be1)
• graphql: bump tsx version to get around esbuild vulnerability (#14207) (d7ec48f)
• next: custom views not overriding built-in single-segment routes (#14066) (691f810)
• plugin-multi-tenant: object reference mutations in addFilterOptionsToFields (#14150) (e62f1fe)
• richtext-lexical: state key collisions when multiple TextStateFeatures are registered (#14194) (f01a6ed)
• richtext-lexical: editor throws an error if OrderedList is registered but not UnorderedList or CheckList (#14149) (1fe75e0)
• richtext-lexical: editing a copied inline block also modifies the original (#14137) (5bacb38)
• richtext-lexical: correctly type field property of RenderLexical (#14141) (cd94f8e)
• richtext-lexical: improve type autocomplete and assignability for lexical nodes (#14112) (a46faf1)
• sdk: pagination is not passed to search params (#14126) (ee9f160)
• storage-gcs: bump @google-cloud/storage for vulnerability (#14199) (1077aa7)
• storage-r2: uploads with prefix don't work, add test/storage-r2 (#14132) (4fd4cb0)
• templates: encoding and decoding slugs in website template (#14216) (cacf523)
• templates: ecommerce seeding issue (#14196) (d65b8c6)

🛠 Refactors

• richtext-lexical: add jsdoc to deprecated HTMLConverterFeature (#14193) (0b718bd)

📚 Documentation

• revert sentry docs change (#14113) (8844eaf)
• incorrect pg driver injection example in Sentry integration docs (#14088) (95dbaed)

🧪 Tests

• allows running Jest tests through Test Explorer in VSCode and other improvements (#13751) (0d92a43)

⚙️ CI

• notify website repo on release [skip ci] (#14140) (a36e5d2)
• add website dispatch event, testing for releases [skip ci] (#14138) (b0d31ba)
• add missing labels to bug report template [skip ci] (#14134) (3069e5b)
• update generate-template-variations script to cover cloudflare template (#14105) (e78057b)

🏡 Chores

• better audit dependencies script (#14189) (f9e75a4)
• ignore agent local files [skip ci] (#14184) (7ecb5a0)
• drizzle: bump drizzle-orm and drizzle-kit for vulnerabilities (#14200) (4afa286)
• email-nodemailer: bump nodemailer dependencies to latest (#14121) (077c6f5)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jessica Rynkar (@jessrynkar)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Elliott W (@elliott-w)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Diogo Gaspar (@shadowoff09)

v3.59.1 (2025-10-07)

🐛 Bug Fixes

• revert drizzle-orm (#14108) (ee78eb2)
• plugin-multi-tenant: not setting cookie properly on login (#14107) (5590535)
• ui: update memory user when autoLogin enabled (#14018) (c2fa629)

⚙️ CI

• update activity notification channels (72be9d3)

🏡 Chores

• update lock (7e12880)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)

v3.59.0 (2025-10-07)

🚀 Features

• slug field (#14007) (b09ae67)
• support any depth for relationships in findDistinct (#14090) (e4f8478)
• adds disableGroupBy to fields admin props (#14017) (537f58b)
• allow findDistinct on fields nested to relationships and on virtual fields (#14026) (9d6cae0)
• bundle types (#14020) (9bcb7b0)
• cpa: add cloudflare template to create-payload-app command (#14091) (e8140ed)
• db-*: adds support for readReplicas in D1 adapter config (#14040) (5a6f361)
• db-mongodb,drizzle: add atomic array operations for relationship fields (#13891) (7eacd39)
• next: export views, pass all props to custom dashboard view (#14094) (abebd24)
• plugin-nested-docs: pass collection config as an arg to generateURL and generateLabel (#14086) (db6ec30)
• ui: add support for disabling join field row types (#12738) (cd546b3)
• ui: live preview conditions (#14012) (2be6bb3)

🐛 Bug Fixes

• add detection for --experimental-https flag (#14085) (3cf3f93)
• missing cross-env in deploy:database (#14076) (709ee58)
• support USE_HTTPS for local hmr (#14053) (feaa395)
• update packages list for pnpm payload info (#14030) (4b6b0c5)
• autosave: true doesn't work on payload.update with where (#14001) (5d86d5c)
• db-d1-sqlite: avoid bound parameter limit when querying relationships and inserting rows (#14099) (444ca0f)
• db-mongodb: localized blocks with fallback and versions (#13974) (1e654c0)
• db-postgres: drizzle doesn't recognize types from the generated types (#14058) (ef84b20)
• db-postgres: querying multiple hasMany text or number fields (#14028) (95bdffd)
• db-postgres: joins count with hasMany relationships (#14008) (1510e12)
• drizzle: generate DB schema syntax is deprecated (#14031) (ef57d24)
• graphql: error querying hasMany relationships when some document was deleted (#14002) (48e9576)
• next: force inactive live preview after passing conditions (#14048) (ca3f054)
• next: prevent locale upsert when not authenticated (#13621) (ece5a95)
• plugin-ecommerce: variants validateOptions errors with SQLite when creating a new variant (#14054) (3b9e759)
• plugin-multi-tenant: rm chalk dep (#14003) (d017499)
• plugin-search: handle trashed documents in search plugin sync (#13836) (de352a6)
• richtext-lexical: field.admin overrides were ignored in RenderLexical helper (#14024) (810da54)
• richtext-lexical: slash menu arrows keys not respected when block nearby (#14015) (54b6f15)
• sdk: incorrect fetch initialization on cloudflare (#14009) (a5c8b5b)
• storage-r2: upload with the correct contentType (#13988) (066997d)
• storage-uploadthing: hide key field from filters and columns (#14004) (2ce6e13)
• templates: ignore wrangler when bundling to fix template styles (#14067) (c135bf0)
• templates: added missing CLOUDFLARE_ENV in cloudflare template when optimizing database (#14064) (9fcd1fa)
• templates: don't use remote bindings in cloudflare template when developing locally (#14063) (9d3e540)
• templates: ecommerce wrong links in readme and docs and issue with missing graphql dependency (#14045) (e4f90a2)
• templates: correct typo in footer text (#14021) (a938ad6)
• translations: refine Persian (fa) translations for clarity and natural tone (#14082) (990603c)
• translations: fixes to Icelandic translations (#14038) (7088d25)
• translations: fixes to Swedish translation (#13994) (4b193da)
• ui: phantom fields when duplicating rows with rows (#14068) (08f6d99)
• ui: invalid time value error when document locking with autosave enabled (#14062) (394000d)
• ui: undefined access with polymorphic joins and fix joins test config (#14057) (cb7a24a)
• ui: popup list controls overlap with table in list view (#13967) (1e23882)
• ui: upload dropzone error when collectionConfig is undefined (#14043) (62fcf18)
• ui: saving empty code editor throw error (#14019) (bffb9ef)
• ui: add support back for custom live preview components (#14037) (d826159)
• ui: array fields not respecting width styles in row layouts (#13986) (accd95e)

⚡ Performance

• graphql: select only the requested columns (#13711) (c819083)
• templates: added cloudflare cache headers for static files (#14069) (c59df45)

📚 Documentation

• readme changes - add one-click deployment options and improve templates section (#14092) (a88e3c5)
• update README.md (#11297) (c8661da)
• adds comprehensive virtual field configuration documentation (#13942) (10e5042)
• db-mongodb: fix note on indexing localized fields (#14071) (9c08fb8)

📓 Examples

• fix revalidation hook in localization example (#14014) (267ea9e)

⚙️ CI

• update pr-title commit scopes (#14055) (fa28dca)
• add linked PRs to new issue notifications (#14059) (bbff65c)

🏡 Chores

• ci changes to add compatibility for mongodb alternates (#13898) (9ceee8e)
• update d1 cloudflare template package versions (#13977) (7601835)
• eslint: set reportUnusedDisableDirectives to error (#14011) (209b1f1)
• templates: bump sharp version in ecommerce template (#14089) (836e0f7)

🤝 Contributors

• Jacob Fletcher (@jacobsfletch)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Alessio Gravili (@AlessioGr)
• Dan Ribbens (@DanRibbens)
• Nate Caminata (@ncaming)
• Marwin Hormiz (@marwinhormiz)
• rfwn࿐ (@rfwn)
• Jeffery To (@jefferyto)
• Ricardo Tavares (@rjgtav)
• Patrik (@PatrikKozak)
• Kamal (@kamal0620040)
• Elliot DeNolf (@denolfe)
• gursh (@gurshdev)
• Said Akhrarov (@akhrarovsaid)
• Jarrod Flesch (@JarrodMFlesch)
• Riley Langbein (@rilrom)
• Valur Sverrisson (@Valur)
• Marcus Forsberg (@marcusforsberg)
• Aurimar Lopes (@AurimarL)
• Jan Beck (@jancbeck)
• Tobias Odendahl (@tak-amboss)

v3.58.0 (2025-09-30)

🚀 Features

Ecommerce plugin and template (#8297) (ef4874b)

The Ecommerce Template and Plugin is now ready in beta, you can get started by running the Payload CPA command below

pnpx create-payload-app my-project -t ecommerce

Full docs are available on our website

Payload SDK package (#9463) (92a5f07)

Allows querying Payload REST API in a fully type safe way. Has support for all necessary operations, including auth, type safe select, populate, joins properties and simplified file uploading. Its interface is very similar to the Local API.

import { PayloadSDK } from '@payloadcms/sdk'
import type { Config } from './payload-types'

// Pass your config from generated types as generic
const sdk = new PayloadSDK<Config>({
  baseURL: 'https://example.com/api',
})

// Find operation
const posts = await sdk.find({
  collection: 'posts',
  draft: true,
  limit: 10,
  locale: 'en',
  page: 1,
  where: { _status: { equals: 'published' } },
})

New Cloudflare D1 SQLite adapter, R2 storage adapter and Cloudflare template (#12537) (99043ee)

You can now deploy directly to Cloudflare using our 1-click template or click the deployment button below

🐛 Bug Fixes

• ensure blocks filterOptions are awaited (#13960) (41aa201)
• sanitize collection labels to inherit defaults when only a partial config is provided (#13944) (1752043)
• avoid relying on Function.prototype.name to detect react components (#13931) (4652bd0)
• next: static live preview url corrupt after save (#13949) (3c4f8a3)
• plugin-multi-tenant: properly localize labels (#13943) (2cc34d1)
• richtext-lexical: editor re-mounting on save due to json key order not being preserved in postgres (#13962) (6a2e814)
• ui: query preset where field not displaying array values (#13961) (9248fc4)
• ui: move collection description below title in document view (#13946) (ae34b6d)

⚙️ CI

• add @payloadcms/sdk to publish list (#13964) (f9743b4)
• add cron to activity notifications [skip ci] (#13959) (6d995ff)
• proper path for activity notifications [skip ci] (2514e4d)
• activity-notifications debug inputs (ba33f2f)
• github activity slack notifications (#13955) (4562df7)

🏡 Chores

• update templates and docs links (#13971) (d7888df)
• rename activity notifications workflow (f7b1b7b)
• sdk: add README (#13975) (2e1fb57)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)
• Luke Sandberg (@lukesandberg)

v3.57.0 (2025-09-25)

🚀 Features

• adds admin.formatDocURL function to control list view linking (#13773) (1d1240f)
• conditional blocks (#13801) (d8dace6)
• support hasMany virtual relationship fields (#13879) (1072171)
• next: regenerate live preview url on save (#13631) (00a673e)
• plugin-form-builder: allow creating form submissions from the admin panel (#11222) (104a5fc)
• plugin-multi-tenant: improves tenant assignment flow (#13881) (fcb8b5a)
• richtext-lexical: support copy & pasting and drag & dopping files/images into the editor (#13868) (59414bd)
• richtext-lexical: utility render lexical field on-demand (#13657) (1c89291)
• translations: add Tamil translations (#13788) (7975fe3)

🐛 Bug Fixes

• server component readonly state issues with document locking (#13878) (512a8fa)
• make input/output encoding explicit in auth/crypto's encrypt/decrypt (#13710) (7f35213)
• pagination returning duplicate results when timestamps: false (#13920) (062c1d7)
• add missing translation key (#13902) (39143c9)
• findDistinct with polymorphic relationships (#13875) (e99e054)
• admin.hidden not respected for RSCs, render-field server function not respecting field-overrides client-side (#13869) (228e8f2)
• exits handlers loop if response is returned (#13866) (425172c)
• support hasMany: true relationships in findDistinct (#13840) (d0543a4)
• removes select argument from create operation db calls (#13841) (a26d8d9)
• db-postgres: localized relationships inside blocks (#13760) (22ae9fa)
• db-sqlite: exists operator in createJSONQuery (#13907) (f980a86)
• graphql: graphql tab schema not handling tabs correctly (#13850) (83b6e37)
• next: clear bfcache on forward/back (#13913) (f868ed9)
• next: groupBy for polymorphic relationships (#13781) (9c20eb3)
• plugin-import-export: collectionSlug field regression from hidden field changes (#13917) (96c6612)
• plugin-multi-tenant: ensure relationship filter filters based on doc.tenant (#13925) (cbbf98e)
• plugin-multi-tenant: improve Norwegian translation for "tenant" (#13923) (dea91f3)
• plugin-search: transaction state errors in parallel reindex operations (#13915) (79b2557)
• plugin-search: returns doc instead of empty return (#13916) (68882aa)
• plugin-seo: allow number ids & resolved relations for image auto-generation (#13906) (abbe38f)
• richtext-lexical: remove unexpected spaces in link html converter (#13924) (c230005)
• richtext-lexical: richtext field duplicates description custom component (#13880) (66f5d14)
• richtext-lexical: prevent disallowed headings to be pasted (#13765) (207caa5)
• translations: adjust some zh translations (#13867) (ae7b75a)
• translations: correct Ukrainian language translations (#13639) (5b5eaeb)
• translations: missing noLabelGroup translation key for Tamil translations (#13896) (cb23aaf)
• ui: opening relationship field with appearance: "drawer" inside rich text inline block closes drawer (#13830) (7bbd07c)
• ui: corrects url for publish specific url (#13922) (662bab2)
• ui: array field state to return empty array instead of 0 (#11283) (3f5c989)
• ui: folder filters hidden behind results (#13908) (5c81342)
• ui: custom folder slug in browse-by (#13909) (4975b8d)
• ui: query folder children with depth and select (#13910) (984f1b3)
• ui: revert-to-published button showing on new drafts (#13897) (82d98ab)
• ui: bulk upload with locale param (#13865) (667c4f1)
• ui: ensures visible list view thumbnails with enableListViewSelectAPI (#13864) (82aade2)
• ui: respect editorOptions, prevent field from flashing on save (#13848) (5241113)
• ui: set prefetch false on Link buttons (#13846) (33228d9)

⚡ Performance

• graphql: use depth 0 in auth/apiKey for graphQL requests (#13895) (9a59562)
• ui: use select API in RelationshipProvider to speed up load times in RelationshipCell (#13832) (77cac30)

🛠 Refactors

• richtext-lexical: new upload node design (#13901) (bea77f2)
• translations: correct i18n translation for Norwegian (#13854) (b7f6e3c)

📚 Documentation

• corrects link for experimental features topic (#13862) (b1e5bd9)
• clarify JWT token encryption / decryption in configuration docs (#13816) (0a5b7b0)

⚙️ CI

• remove v2 issue template (f39c7bf)

🏡 Chores

• revert docs label change (c33c037)
• update documentation issue template (ae95d58)
• consolidate canAccessAdmin logic (#13849) (42b5935)
• deps: bump @faceless-ui/modal to v3.0.0 (#13842) (9a8e3f8)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• roboin (@Robot-Inventor)
• Jacob Fletcher (@jacobsfletch)
• Anders Semb Hermansen (@andershermansen)
• Jie Wang (@escwxyz)
• aptt (@apttx)
• Ricardo Tavares (@rjgtav)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Jessica Rynkar (@jessrynkar)
• Паламар Роман (@VeiaG)
• Anil Shebin S J (@AnilShebin)
• German Jablonski (@GermanJablo)
• Jens Becker (@jhb-dev)
• Sean Zubrickas (@zubricks)
• Kwan Jun Wen (@junwen-k)

v3.56.0 (2025-09-17)

🚀 Features

• pass args to task onSuccess and onFail callbacks (#13269) (3acdbf6)
• crons for all bin scripts, new jobs:handle-schedules script, more reliable job system crons (#13564) (cdeb828)
• expose multipart/form-data parsing options (#13766) (8282031)
• global beforeOperation hook (#13768) (3af546e)
• ui: export FieldPathContext (#13806) (a3acfeb)

🐛 Bug Fixes

• add missed pagination property to findVersions and findGlobalVersions and handle it properly (#13763) (a955392)
• skip validation when trashing documents with empty required fields (#13807) (3b13867)
• versions created with incomplete data when using select parameter (#13809) (faed3aa)
• error accessing sanitizedPermissions during docAccess operation: "Cannot read properties of undefined" (#13800) (c7795fa)
• typo in the description of the isTemp field of query presets (#13728) (e75bfb0)
• fully sanitize unauthenticated client config (#13785) (e2632c8)
• client config context inheritance (#13790) (dfb0021)
• db-mongodb: support 2x and more relationship sorting (#13819) (24ace70)
• db-mongodb: localized arrays inside blocks with versions (#13804) (09dec43)
• examples: secure mt example users collection (#13810) (9a841df)
• live-preview: client-side live preview failed to populate localized fields (#13794) (b34e5ea)
• live-preview: reset cache per subscription and ignore invalid preview messages (#13793) (b62a30a)
• next: unnamed, unlabeled groups displayed without label in version view (#13831) (8d3b146)
• next: sparse block and arrays diffs were not rendered correctly (#13829) (433c513)
• next: exclude permissions from page response when unauthenticated (#13796) (8113d3b)
• next: richtext field is read-only for expired lock (#13789) (4278e72)
• next: login redirect crashes page (#13786) (13af91f)
• next: resolve filterOptions by path (#13779) (8a7124a)
• translations: use correct Dutch terms for "clear" and "close" (#13748) (fce94d6)
• ui: pass locale arg in query params for folder operations (#13837) (c0684e3)
• ui: correct field path in inline create drawer for auth fields (#13815) (91e7f0c)
• ui: populate nested fields for enableListViewSelectAPI (#13827) (dc732b8)
• ui: cross-domain server-side live preview throws postMessage error (#13825) (731c4fb)
• ui: undefined operators for virtual field with unsupported field types (#13820) (5c02d17)
• ui: prevent form validation after draft submit error (#12918) (a2c31fa)
• ui: show loading state in relationship field during search and pagination (#13805) (555228b)
• ui: safely access preferences when loading list view (#13771) (4482eaf)

📚 Documentation

• improvements and fixes to blocks documentation (#13782) (3c5aa1b)

📝 Templates

• fix experimental-build-mode compile generating invalid code (#13828) (ba2ab2f)

⚙️ CI

• adjust audit-dependencies cron time (898e937)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jonathan Elmgren (@jonathanelmgren)
• Sasha (@r1tsuu)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Slava Nossar (@slavanossar)
• Philipp Schneider (@philipp-tailor)
• Elliot DeNolf (@denolfe)
• Amelia (@LimChorngUan)
• BrannanKovachev (@BrannanKovachev)
• Robbe Vaes (@Robbe95)
• Robbert Stevens (@robbertstevens)
• Anders Semb Hermansen (@andershermansen)
• German Jablonski (@GermanJablo)

v3.55.1 (2025-09-10)

🐛 Bug Fixes

• presentational-field types incorrectly exposing hooks (#11514) (285fc8c)
• graphql: pass collectionSlug to nested join fields in tabs, collapsible and group resolvers (#13752) (e52b757)
• next: error after logging in and navigating to different page in production (#13758) (e40c821)
• ui: listSearchableFields can resolve to multiple fields with the same name when using tabs (#13668) (ffed540)

📝 Templates

• ensure blank template installs matching react-dom version (#13757) (15e462b)

🤝 Contributors

• Dallas Opelt (@DallasO)
• Alessio Gravili (@AlessioGr)
• German Jablonski (@GermanJablo)
• timeo-schmidt (@timeo-schmidt)
• Elliot DeNolf (@denolfe)

v3.55.0 (2025-09-09)

🚀 Features

• adds disableListColumn and disableListFilter to imageSize admin props (#13699) (e1ea074)
• unauthenticated client config (#13714) (e49005f)
• adds new experimental.localizeStatus option (#13207) (0f6d748)
• live-preview: client-side live preview: simplify population, support hooks and lexical block population (#13619) (6e203db)
• richtext-lexical: upgrade lexical from 0.34.0 to 0.35.0 (#13715) (7a8bcdf)
• richtext-lexical: upgrade lexical from 0.28.0 to 0.34.0 (#13622) (1a1696d)
• richtext-lexical: add options to hide block handles (#13647) (fdab271)
• ui: save collection folder tab preferences (#13702) (6a0637e)
• ui: adds admin.autoRefresh root config property (#13682) (f288cf6)

🐛 Bug Fixes

• ensure client-side live preview correctly updates for globals (#13718) (03f7102)
• set X-Payload-HTTP-Method-Override as allowed cross origin header (#13717) (a4a0298)
• update user session on reset (#13667) (d9e1832)
• prevent enabling trash on folders (#13675) (be47f65)
• db-sqlite: convert Date to ISO 8601 string in queries (#11694) (917c66f)
• next: version diff view not handling all field permissions correctly (#13721) (911f17a)
• next: display deleted relations and uploads in version diff views (#12955) (bbcdea5)
• next: version diff view shows correct document title in step nav (#13713) (794bf82)
• plugin-multi-tenant: hide watchTenant column field (#13740) (a0112d7)
• plugin-multi-tenant: skip baseFilter if user has access to all tenants (#13633) (65b3845)
• plugin-nested-docs: prevent phantom breadcrumb row (#13628) (a231a05)
• plugin-nested-docs: crumbs not syncing on non-versioned collections (#13629) (4600c94)
• plugin-search: update with db adapter on create (#13670) (1293019)
• richtext-lexical: fix picture closing tag in html converter (#13100) (24e436b)
• richtext-lexical: add internationalization support for default style label in textStateFeature (#13662) (0c44c3b)
• storage-vercel-blob: filename is incorrectly stored encoded when addRandomSuffix is true (#13746) (b2f9d4e)
• templates: URI encode the cacheTag in getMediaUrl utility - Website template (#13558) (008a52d)
• ui: consistent searchbar across folders and lists (#13712) (09e3174)
• ui: cannot filter by virtual relationship fields in WhereBuilder (#13686) (7e98fbf)
• ui: undefined permissions passed in create-first-user view (#13671) (5146fc8)
• ui: don't populate on auto save (#13649) (7794541)
• ui: use consistent row ids when duplicating array and block rows (#13679) (b8d7ccb)
• ui: field.admin.condition data attribute missing document ID when document is being edited (#13676) (a115868)
• ui: await for publish success to update the UI (#13673) (9b10933)
• ui: sidebar missing sticky top offset (#13652) (1c68ed5)
• ui: should not show publish specific locale button when no localized fields exist (#13459) (ac691b6)
• ui: json field type ignoring editorOptions (#13630) (426f99c)

⚡ Performance

• plugin-search: reindex collections in parallel, up to 80% faster (#13608) (b99c324)
• ui: opt-in to the select api in the list view (#13697) (d2d2df4)

📚 Documentation

• missing comma in custom-strategies example (#13701) (27cfe77)
• plugin-form-builder: add RadioField documentation (#13529) (4e972c3)

🧪 Tests

• increase timeout in uploads cors test (#13743) (a528a55)

⚙️ CI

• deps: bump the github_actions group across 3 directories with 4 updates (#13654) (cfb70f0)

🏡 Chores

• add AGENTS.md (#13688) (d109b44)
• ui: prevent loading orphaned documents when viewing root collection folders (#13684) (9f0573d)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Ilham Saputrajati (@ilhamsj)
• Cedric Delacombaz (@cdelacombaz)
• Said Akhrarov (@akhrarovsaid)
• Aapo Laakkio (@ApsiV11)
• Anders Semb Hermansen (@andershermansen)
• German Jablonski (@GermanJablo)
• Yazal Ulloa (@yazalulloa)
• Elliot DeNolf (@denolfe)
• Jessica Rynkar (@jessrynkar)
• reiv (@reiv)
• Riley Langbein (@rilrom)

v3.54.0 (2025-08-28)

🚀 Features

• support parallel job queue tasks, speed up task running (#13614) (e0ffada)
• configurable toast notifications (#13609) (0a18306)
• allow multiple, different payload instances using getPayload in same process (#13603) (13c24af)
• db-*: support atomic array $push db updates (#13453) (5ded64e)
• plugin-multi-tenant: allow custom tenant field per collection (#13553) (6db07f0)
• plugin-multi-tenant: re-enable global selector on all views (#13575) (f260d0a)

🐛 Bug Fixes

• restore as draft function was passing a published status (#13599) (a670438)
• hide jobs stats global by default (#13566) (a92c251)
• deeply merge array and block rows from server form state (#13551) (1e13474)
• ensure updates to createdAt and updatedAt are respected (#13335) (5c16443)
• db-*: add delete version id for non-mongodb (#10613) (ddb8ca4)
• graphql: invalid enum names when values include brackets (#13597) (1dc346a)
• next: richtext fields not read-only for locked documents (#13579) (344ad69)
• next: update rest route handler types for Next.js 15.5 compatibility (#13521) (763cb61)
• plugin-multi-tenant: prevent duplicate filters on referenced blocks (#13607) (03a00ca)
• plugin-multi-tenant: autosave global documents not rendering (#13552) (409dd56)
• richtext-lexical: toolbar dropdown items are disabled when selecting via double-click (#13544) (3bc1d08)
• ui: prevent infinite redirect if no user (#13615) (303381e)
• ui: bulk edit overwriting fields within named tabs (#13600) (138938e)
• ui: autosave in document drawer overwrites local changes (#13587) (bd81936)
• ui: multiple logout requests being made in parallel (#13595) (cf37433)
• ui: auth-fields container renders despite no visible auth/API key/verify content (#13554) (8101842)
• ui: correctly pass query params to locked document requests (#10802) (598ff4c)

🛠 Refactors

• deprecate job queue runHooks property (#13617) (97c41ce)

📚 Documentation

• adds default populate video (#13586) (ded8ec4)
• blank-template-url-fix (#13580) (45c3be2)
• fix small typo in documentation (#13545) (3408d7b)

⚙️ CI

• remove run-e2e-turbo flow (#13611) (5c41966)
• ignore template bump commits in release notes [skip ci] (60cfc31)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Jacob Fletcher (@jacobsfletch)
• Jessica Rynkar (@jessrynkar)
• Sean Zubrickas (@zubricks)
• Elliot DeNolf (@denolfe)
• Patrik (@PatrikKozak)
• Rodrigo Solís (@sorodrigo)
• Logan Stellway (@lstellway)
• Yunsup Sim (@SimYunSup)
• Vincent Vu (@rubixvi)

v3.53.0 (2025-08-21)

🚀 Features

• add icelandic translations (#13423) (2bdd669)
• plugin-import-export: use groupBy as SortBy when present and sort is unset (#13491) (a7ed88b)
• plugin-import-export: adds sort order control and sync with sort-by field (#13478) (efdf002)
• plugin-multi-tenant: visible tenant field on documents (#13379) (5cf215d)

🐛 Bug Fixes

• server edit view components don't receive document id prop (#13526) (9607453)
• uploads update unnecessarily resizing with sharp (#13528) (a94cd95)
• accept computed array and block rows from server form state (#13501) (f382c39)
• 'front-end' spelling typo in JSDocs for overrideAccess (#13515) (f44e276)
• imports (part 2/2) (#13520) (cf427e5)
• select field component value prop type does not support array values (#13510) (4f6d0d8)
• unable to query versions on latest key (#13512) (73ba4d1)
• avoid re-uploading the file unless changed (#13500) (92d459e)
• copy to locale with localized fields inside tabs (#13456) (ec5b673)
• omit trashed documents from appearing in folder results (#13492) (1909063)
• update docker base image in templates (#13020) (64f4b0a)
• db-mongodb: disable join aggregations in DocumentDB compatibility mode (#13270) (c7b9f0f)
• db-postgres: camelCase point fields (#13519) (aa90271)
• next: no client field found error when accessing version view in some configurations (#13339) (393b4a0)
• next: add missing translations to version view (c8ef924)
• plugin-form-builder: export radio field type (#11908) (fea6742)
• richtext-lexical: use thumbnail component for uploads (#12540) (7699d02)
• storage-s3: validate Content-Length before appending header (#13472) (9d08f50)
• templates: plugin template correct paths for exports (#13427) (b714e6b)
• translations: stale version.versionCreatedOn key in translation (#13530) (a04bc9a)
• ui: thread id through instead of from routeParams (#13539) (b65ca68)
• ui: logout type error when user is null during locale switch (#13514) (b3e48f8)
• ui: replace deprecated document.execCommand('copy') API with navigator (#13431) (368cd90)
• ui: local image src changing when title changes (#13442) (406a09f)
• ui: double ? in gravatar url (#13511) (332b2a9)
• ui: nested fields with admin.disableListColumn still appear as columns in list view (#13504) (9f7d8c6)
• ui: blocks field not respecting width styles in row layouts (#13502) (30ea8e1)
• ui: cannot replace the file if the user does not have delete access (#13484) (3dd142c)
• ui: bulk upload action bar buttons wrapping (#13486) (b7243b1)

⚡ Performance

• storage-s3: stream files and abort s3 request from static handler (#13430) (36fd6e9)
• ui: do not fetch doc permissions on autosave (#13477) (c67ceca)
• ui: reduce number of field renders on submit (#13524) (5e433aa)

📚 Documentation

• fix typo in custom views (#13522) (a840fc9)
• clarify pagination and improve cross-referencing (#13503) (f9bbca8)
• db-mongodb: note on indexing localized fields & per-locale growth (#13469) (379ef87)

🧪 Tests

• add array field helpers (#13493) (adb83b1)
• fix link imports (#13513) (9e7bb24)

🏡 Chores

• plugin-multi-tenant: missing collections warning (#13538) (76741eb)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Jónas G. Sigurðsson (@jonnigs)
• Patrik (@PatrikKozak)
• Alessio Gravili (@AlessioGr)
• Dan Ribbens (@DanRibbens)
• Anders Semb Hermansen (@andershermansen)
• Jacob Fletcher (@jacobsfletch)
• Said Akhrarov (@akhrarovsaid)
• Sasha (@r1tsuu)
• Gregor Billing (@gregorbg)
• Bob Bass (@robertjbass)
• Boyan Bratvanov (@bratvanov)
• German Jablonski (@GermanJablo)
• Jan Huenges (@jhuenges)
• Паламар Роман (@VeiaG)
• chenxi-debugger (@chenxi-debugger)
• id3er0 (@id3er0)
• Anatoly Kopyl (@anatolykopyl)
• Elliot DeNolf (@denolfe)

v3.52.0 (2025-08-15)

🚀 Features

• plugin-import-export: adds limit and page fields to export options (#13380) (c1c68fb)

🐛 Bug Fixes

• filter payload- cookies in getExternalFile only if the URL is external (#13475) (8d4e7f5)
• db-postgres: ensure index names are not too long (#13428) (047519f)
• plugin-import-export: csv export & preview showing full documents for hasMany monomorphic relationships instead of just ID (#13465) (3e65111)
• ui: significantly more predictable autosave form state (#13460) (0b60bf2)

📚 Documentation

• updates image paths to new screenshots (#13461) (cdd90f9)

🧪 Tests

• skip cookies filter for internal URLs in getExternalFile (#13476) (46699ec)
• fix import-export plugin int (#13474) (b426052)

📝 Templates

• bump for v3.51.0 (#13457) (0e8a6c0)

🤝 Contributors

• jacobsfletch (@jacobsfletch)
• Sasha (@r1tsuu)
• Sean Zubrickas (@zubricks)
• Dan Ribbens (@DanRibbens)
• Patrik (@PatrikKozak)
• Elliot DeNolf (@denolfe)

v3.51.0 (2025-08-13)

🚀 Features

• plugin-multi-tenant: allow tenant field overrides (#13316) (995f96b)
• ui: update query presets ux (#13095) (255bba9)

🐛 Bug Fixes

• upload with no filename gives vague error (#13414) (5a99d8c)
• version view breaks when tab field has function for label (#13415) (35ca98e)
• ensure scheduling by default only handles default queue, add allQueues config to autoRun (#13395) (ad2564e)
• use thumbnailUrl for upload documents in folder view (#13368) (2211f3d)
• next: group by boolean values (#13382) (d4f1986)
• next: group by dates with null values (#13381) (7344d64)
• richtext-lexical, plugin-multi-tenant: text editor exposes documents from other tenants (#13229) (9c8f320)
• templates: only generate slug from title on demand (#12956) (2bc9a2d)
• translations: update traditional chinese (zh-TW) localization (#13370) (5d8f8dc)
• ui: autosave form state discards local changes (#13438) (8173180)
• ui: misalignment of nested toggles on document API tab (#13424) (306b7f6)
• ui: field elements showing over the top of Preview content (#13148) (72f5763)
• ui: bulk upload issues (#13413) (a374aab)
• ui: autosave hooks are not reflected in form state (#13416) (1d81b0c)
• ui: search in select fields with filterOptions (#13397) (c9a1590)

📚 Documentation

• add dependency troubleshooting docs (#13385) (e870be0)

🧪 Tests

• group-by reset and navigation tests in trash view (#13401) (3258e78)

⚙️ CI

• update release-commenter permissions (#13373) (ac40185)

🏡 Chores

• templates: fix typo in e2e tests (headging -> heading) (#13391) (161769e)

🤝 Contributors

• Jessica Rynkar (@jessrynkar)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Paul (@paulpopus)
• Marcus Michaels (@marcusmichaels)
• Luke Bennett (@lukebennett)
• German Jablonski (@GermanJablo)
• Rodrigo Antunes (@rodrigoant)
• Sasha (@r1tsuu)
• Yi Chi (@chiyi4488)
• Sam (@damnsamn)
• Elliot DeNolf (@denolfe)

v3.50.0 (2025-08-05)

🚀 Features

• add hooks to restoreVersion collection operation (#13333) (9031f3b)
• adds trash support to the count operation (#13304) (1175508)
• graphql: allow to pass count: true to a join query (#13351) (f432cc1)
• translations: add Indonesian translations (#13323) (df91321)

🐛 Bug Fixes

• deletedAt in TypeWithID not accepting null from generated types (#13363) (8401b21)
• svg uploads allowed when glob (#13356) (43b4b22)
• querying hasMany: true select fields inside polymorphic joins (#13334) (b26a73b)
• next: version view did not properly handle field-level permissions (#13336) (1d70d4d)
• next: incorrect version view stepnav value (#13305) (8a48941)
• next: safely access relationTo value from relationship field (#13337) (095e7d9)
• next: incorrect doc link in trash view with groupBy enabled (#13332) (c48b57f)
• next: cannot filter trash (#13320) (e7124f6)
• plugin-multi-tenant: constrain results to assigned tenants when present (#13365) (20b4de9)
• richtext-lexical: recursively unwrap generic Slate nodes in Lexical migration converter (#13202) (227a20e)
• ui: fallback to default locale checkbox passes wrong value (#12396) (b74f4fb)
• ui: group/array error paths persisting when valid (#13347) (2903486)
• ui: add hidden sidebar fields css specificity (#13344) (b965db8)
• ui: hide sidebar when no fields rendered (#13340) (1b93c4b)
• ui: incorrect padding when using rtl (#13338) (f2d4004)

⚡ Performance

• 23% faster job queue system on postgres/sqlite (#13187) (3114b89)
• ui: only select the useAsTitle field when fetching the document data of a relationship value (#13228) (1b31c74)

🧪 Tests

• adds e2e tests for auth enabled collections with trash enabled (#13317) (a8b6983)
• stabilize frequent fails (#13318) (a22f27d)

🏡 Chores

• adds session helper exports (#13367) (3b9dba8)

🤝 Contributors

• Jessica Rynkar (@jessrynkar)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jens Becker (@jhb-dev)
• Sasha (@r1tsuu)
• Muhammad Nizar (@mnizarzr)
• Evelyn Hathaway (@evelynhathaway)

v3.49.1 (2025-07-29)

🐛 Bug Fixes

• support next.js 15.4.4 (#13280) (5c94d2d)
• keep apiKey encrypted in refresh operation (#13063) (#13177) (b1fa76e)
• filters cookies with the payload- prefix in getExternalFile by default (#13215) (0894249)
• use atomic operation for incrementing login attempts (#13204) (4fde0f2)
• refactors toast error rendering (#13252) (d093bb1)
• serve svg+xml as svg (#13277) (bc80284)
• svg+xml file detection (#13276) (e8f6cb5)
• drizzle: respect join.type config (#13258) (8518141)
• next: group by null relationship crashes list view (#13315) (e502203)
• next: catch list filter errors, prevent list view crash (#13297) (8d84352)
• next: pass req through document tab conditions and custom server components (#13302) (c5c8c13)
• next: unable to view trashed documents when group-by is enabled (#13300) (aff2ce1)
• plugin-multi-tenant: prefer assigned tenants for selector population (#13213) (e29d1d9)
• richtext-lexical: unify indent between different converters and make paragraphs and lists match without CSS (#13274) (7cd4a8a)
• translations: improve swedish translations (#13272) (da8bf69)
• translations: missing closing brace in rs latin translation for lastSavedAgo (#13172) (26d9dae)
• ui: autosave-enabled document drawers close unexpectedly within the join field (#13298) (61ee8fa)

⚡ Performance

• drizzle: 2x faster db.deleteMany (#13255) (6d6c9eb)

📚 Documentation

• remove asterisk from optional url property in live preview docs (#13108) (fc59448)
• typo in vercel-content-link.mdx (#13170) (9e04dbb)
• fixes typo in ternary operator for live preview docs (#13163) (72954ce)
• remove obsolete scheduler property (#13278) (2e9ba10)

🧪 Tests

• fix flaky sorting test (#13303) (7234924)

📝 Templates

• bump for v3.49.0 (#13273) (23bd675)

⚙️ CI

• show path value in audit-dependencies script [skip ci] (#13314) (4beb27b)

🏡 Chores

• next: cleanup unused code (#13292) (b1aac19)
• ui: var name typo in relationship field (#13295) (a888d5c)

🤝 Contributors

• contip (@contip)
• German Jablonski (@GermanJablo)
• Adebayo Ajayi (@Braggedtooth)
• brutumfulmen97 (@brutumfulmen97)
• Alejandro Martinez (@ja-martinez)
• Aayush Rajagopalan (@aayushxr)
• Sean Zubrickas (@zubricks)
• Jacob Fletcher (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)

v3.49.0 (2025-07-25)

🚀 Features

• adds trash support (soft deletes) (#12656) (f63dc2a)
• group by (#13138) (bccf6ab)
• scheduling jobs (#12863) (c08b2ae)
• ui: expose refresh method to list drawer context (#13173) (e48427e)

🐛 Bug Fixes

• filtering by polymorphic relationships inside other fields (#13265) (75385de)
• text field validation for minLength: 1, required: false (#13124) (af2ddff)
• empty folderType arrays break relational dbs (#13219) (7f9de6d)
• handle undefined values in afterChange hooks when read:false and create:true on the field level access for parents and siblings (#12664) (46d8a26)
• exit payload jobs:run process after completion (#13211) (4ae503d)
• db-mongodb: handle duplicate unique index error for DocumentDB (#13239) (c1cfceb)
• db-postgres: search is broken when useAsTitle is not specified (#13232) (a83ed5e)
• next: prevent base list filters from being injected into the url (#13253) (0eac58e)
• plugin-import-export: json preview and downloads preserve nesting and exclude disabled fields (#13210) (8f85da8)
• ui: preserve localized blocks and arrays when using CopyToLocale (#13216) (4a712b3)
• ui: incorrect blocks label sizing (#13264) (fa7d209)
• ui: ensure document unlocks when logging out from edit view of a locked document (#13142) (7e81d30)
• ui: monomorphic relationship fields should not show relationTo option labels (#13245) (29fb9ee)
• ui: select all should reset when params change, page, filter, etc (#12612) (412bf4f)
• ui: ensure publishSpecificLocale works during create operation (#13129) (dce898d)
• ui: properly sync search params to user preferences (#13200) (d7a3faa)

⚡ Performance

• db-postgres: avoid including prettier to the bundle (#13251) (380ce04)
• drizzle: single-roundtrip db updates for simple collections (#13186) (94f5e79)

🛠 Refactors

• drizzle: use getTableName utility (#13257) (1ad7b55)

📚 Documentation

• add status to forbidden field names when using Postgres and drafts are enabled (#13233) (7ae4f8c)
• remove payload cloud (#13240) (77f279e)
• fix typo, example was not valid JSON (#13224) (0eb8f75)
• shorten line length in code snippet comments to avoid horizontal scrolling (#13217) (d6e21ad)
• plugin-import-export: document plugin-import-export (#13243) (14322a7)

🔨 Build

• suppress pnpm update notification (#13241) (e7a652f)

⚙️ CI

• default audit-dependencies script to high severity (#13244) (3f8fb67)

🏡 Chores

• add new int test verifying that select improves performance of new optimization (#13254) (aeee070)
• plugin-import-export: use debug-level logging for createExport process (#13242) (246a42b)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• German Jablonski (@GermanJablo)
• Jarrod Flesch (@JarrodMFlesch)
• Jacob Fletcher (@jacobsfletch)
• Dan Ribbens (@DanRibbens)
• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)
• fgrsource (@fgrsource)
• Chandler Gonzales (@jcgsville)
• Jessica Rynkar (@jessrynkar)
• iamacup (@iamacup)
• Jake Fell (@jakefell)

v3.48.0 (2025-07-17)

🚀 Features

• add findDistinct operation (#13102) (a20b436)
• atomic number field updates (#13118) (841bf89)
• plugin-import-export: adds support for disabling fields (#13166) (5839cb6)
• plugin-import-export: adds support for forcing export format via plugin config (#13160) (7294cf5)
• plugin-import-export: adds pluginConfig options to disable Save and Download buttons in export UI (#13158) (de53f68)
• richtext-lexical: export $createLinkNode and $isLinkNode for server use (#13205) (6ae730b)
• ui: supports collection scoped folders (#12797) (12539c6)

🐛 Bug Fixes

• Enhances field-level access controls on Users collection to address s… (#13197) (cab7ba4)
• cron jobs running when calling bin scripts, leading to db errors (#13135) (64d76a3)
• types for RenderField fields prop (#13162) (5f01953)
• db-mongodb: improve compatibility with Firestore database (#12763) (41cff6d)
• plugin-import-export: disabled flag to cascade to nested fields from parent containers (#13199) (95e373e)
• plugin-import-export: export field dropdown to properly label and path fields in named/unnamed tabs (#13180) (2a59c5b)
• plugin-multi-tenant: selector could become hidden (#13134) (e575511)
• plugin-seo: add localized property to MetaTitleComponent (#12751) (d213c91)

⚡ Performance

• drizzle: further optimize postgres row updates (#13184) (7cd682c)

📚 Documentation

• fix minor typo (#13185) (be8e8d9)
• performance (#13068) (277448d)
• fix invalid syntax failing the docs import (#13165) (4831bae)
• add section on browser environment variables when using experimental-build-mode (#13164) (4c69f8e)

🧪 Tests

• move i18n list tests to i18n suite (#13143) (a57faeb)
• fix flaky uploads test (#13141) (53ad02a)

📝 Templates

• bump for v3.47.0 (#13161) (f4d951d)

⚙️ CI

• disable bundle analysis for forks (#13198) (e6da384)
• fix post-release-templates workflow (#13159) (edd1f02)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Sasha (@r1tsuu)
• Sean Zubrickas (@zubricks)
• Elliott W (@elliott-w)
• Elliot DeNolf (@denolfe)
• jangir-ritik (@jangir-ritik)
• Jacob Fletcher (@jacobsfletch)
• Patrick Roelofs (@Patrickroelofs)

v3.47.0 (2025-07-11)

🚀 Features

• allow joins, select, populate, depth and draft to /me REST API operation (#13116) (2d91cb6)
• exports new sanitizeUserDataForEmail function (#13029) (9f1bff5)
• next: redirect non-existent documents to list view with banner (#13062) (5e82f9f)
• next: add redirect from ${adminRoute}/collections to ${adminRoute} (#13061) (a7a0501)
• plugin-import-export: show delayed toast when export download takes time (#13126) (b3a994e)
• storage-*: include modified headers into the response headers of files when using adapters (#12096) (cb6a73e)
• ui: add API key visibility toggle (#13110) (8a3b97c)
• ui: adds support for copy pasting complex fields (#11513) (1d6ffcb)

🐛 Bug Fixes

• execute mimetype validation on the file buffer data (#13117) (5695d22)
• login operation not returning collection and _strategy (#13119) (0c2b105)
• ensure we perform ssrf check within dispatcher (#13078) (e99c67f)
• ensure default values are not shown when value is hidden (#13074) (855a320)
• correctly reset login attempts (#13075) (aa97f3c)
• payload auth api-key algorithm compatibility (#13076) (9c45321)
• next: prevent live preview url functions from firing unnecessarily (#13088) (0b88466)
• plugin-import-export: sync export field selection with list view columns from query columns (#13131) (c1bad01)
• plugin-import-export: flattening logic for polymorphic relationships in CSV exports (#13094) (c6105f1)
• plugin-import-export: selectionToUse field to dynamically show valid export options (#13092) (0806ee1)
• plugin-import-export: sync field select dropdown with form value (#13103) (1c6a79b)
• ui: disabled and styles add row button correctly (#13140) (2cafe49)
• ui: ensure buildFormStateHandler throws error instead of returning null for unauthorized requests (#13123) (06ef798)
• ui: monomorphic joins tables not fetching draft documents (#13139) (19a3367)
• ui: ensure that schedule publishing time picker can only be in the future (#13128) (f63dfad)
• ui: hidden input should wait for form initialization (#13114) (c77b39c)
• ui: improve alignment of clear and dropdown indicator buttons in select based fields (#12995) (4c25357)
• ui: prevent error crashing UI when relationship assigned as useAsTitle (#12981) (8a5cb27)

⚡ Performance

• db-postgres: simplify db.updateOne to a single DB call with if the passed data doesn't include nested fields (#13060) (055cc4e)

📚 Documentation

• richtext-lexical: add documentation page about official features (#13132) (576644d)
• templates: fix grammar in README (#13027) (96c24a2)

⚙️ CI

• use .tool-versions file in setup (#13093) (dde9681)
• audit-dependencies workflow (#13090) (c876ddf)
• blank audit-dependencies workflow [skip ci] (fee33b5)

🏡 Chores

• deps: bump deps to resolve all high severity (#13002) (417b70e)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Aaron Claes (@AaronClaes)
• Patrik (@PatrikKozak)
• Jessica Rynkar (@jessrynkar)
• Paul (@paulpopus)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Said Akhrarov (@akhrarovsaid)
• Elliot DeNolf (@denolfe)
• Jacob Fletcher (@jacobsfletch)
• Dani Calero (@danicaleroo)
• Dan Ribbens (@DanRibbens)
• Adam Klingbaum (@adamklingbaum)

v3.46.0 (2025-07-07)

🚀 Features

• adds restricted file check (#12989) (ba660fd)

🐛 Bug Fixes

• deduplicate custom array id fields (#13064) (e6f8ca6)
• check hostname of upload url (#13018) (30fc7e3)
• db-mongodb: updateOne mutates the data object and does not transform it for read (#13065) (6d5cc84)
• next: adds token to reset password initialState (#13067) (f4f13a2)
• next: respect collection-level live preview config (#13036) (f49eeb1)
• plugin-redirects: make 'from' field unique to prevent errors in redirect logic (#12964) (50c2f8b)
• ui: increase timeout for opening list drawer in RelationshipInput (#13031) (2650eb7)
• ui: change password button is hidden when user has full field access (#12988) (1d9ad6f)

🧪 Tests

• fix tests that rely on remote urls (#13073) (34920a7)

⚙️ CI

• analyze bundle size (#13071) (af9837d)

🤝 Contributors

• Patrik (@PatrikKozak)
• Kendell (@kendelljoseph)
• Alessio Gravili (@AlessioGr)
• Jessica Rynkar (@jessrynkar)
• Jarrod Flesch (@JarrodMFlesch)
• Germán Jabloñski (@GermanJablo)
• Jacob Fletcher (@jacobsfletch)

v3.45.0 (2025-07-03)

🚀 Features

• mount live preview to document root (#12860) (f2213e5)
• drizzle: support half-precision, binary, and sparse vectors column types (#12491) (583a733)

🐛 Bug Fixes

• disable graphql introspection queries when disableIntrospectionInProduction is true (#12982) (a9580e0)
• strict custom view paths (#12968) (cfc7adc)
• appropriately throw unverified email error (#12933) (9f60306)
• db-mongodb: nested sorting by ID (#13016) (81532cb)
• db-mongodb: add ability to disable fallback sort and no longer adds a fallback for unique fields (#12961) (c902f14)
• db-postgres: joins with hasMany: true relationships nested to an array (#12980) (0e8ac0b)
• drizzle: ensure updateOne does not create new document if where query has no results (#12991) (fafaa04)
• examples: only allow super admins to create users with super admin role (#13015) (6e5ddc8)
• examples: checks requested tenant matches user tenant permissions (#13012) (5002953)
• plugin-import-export: pre-scan columns before streaming CSV export (#13009) (34c3a51)
• plugin-import-export: preview table to include all selected columns regardless of populated data (#12985) (335af1b)
• plugin-multi-tenant: unnecessary modal appearing (#12854) (16f5538)
• templates: wrong link in demo content (custom components) (#13024) (f70c6fe)
• ui: save nested richtext inside inlineBlock (#12773) (babcd59)
• ui: autosave infinite loop within document drawer (#13007) (b40c581)
• ui: field bulk upload showing stale data (#13006) (9ba740e)
• ui: prevent document drawer from remounting on save (#13005) (c80b6e9)
• ui: bulk upload redirecting to relationship documents when added (#13001) (a9ad7c7)
• ui: skip disabled fields when adding OR filter conditions in list view (#13004) (7a40a9f)
• ui: render preview sizes button when adjustments are disabled but image sizes are defined (#12999) (b1ae749)
• ui: block rows unexpectedly collapse and array rows not collapsed on init (#12987) (3f30a2e)
• ui: prevent error if rows is undefined in mergeServerFormState (#12962) (6f6d305)

🎨 Styles

• richtext-lexical: ensure error state is shown at small-break (#12827) (ac19b78)

🧪 Tests

• reduce queue test amount (#13008) (57d00ad)
• fix multi-tenant flakes (#12983) (c07187d)

📝 Templates

• fix pnpm 10 ignored build scripts warning (#12974) (463c975)

⚙️ CI

• template errors not being caught due. fix: error due to updated generated-types User type (#12973) (4458f74)

🏡 Chores

• fix payload bundle script (#13022) (e6b6642)

🤝 Contributors

• Patrik (@PatrikKozak)
• Sasha (@r1tsuu)
• Sebastian Blank (@blankse)
• Alessio Gravili (@AlessioGr)
• Germán Jabloñski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• Jacob Fletcher (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)
• Said Akhrarov (@akhrarovsaid)
• Paul (@paulpopus)

v3.44.0 (2025-06-27)

🚨 Notice 🚨

If your project uses the local auth strategy with db-postgres or db-sqlite, a migration is required. This is due to a new security feature (enabled by default) that stores a unique auth session identifier in the database.

To opt out and continue using the previous behavior, you can disable the feature by setting auth.useSessions: false in your users collection config.

For example:

// payload.config.ts
collections: [
  {
    slug: 'users',
    auth: {
      useSessions: false,
    },
    fields: [],
  },
],

🚀 Features

• auth sessions (#12483) (26d709d)
• collection-level preferences (#12909) (c8b7214)
• collection-level disableBulkEdit (#12850) (a5ec55c)
• plugin-import-export: preview displays CSV and JSON data accurately (#12948) (3830d71)
• templates: added int and e2e tests to blank and website templates (#12866) (87c7952)

🐛 Bug Fixes

• richTextField supports beforeInput/afterInput, but these were missing from types.ts (#12889) (e769550)
• validate "null" value for point field as true when its not required (#12908) (2da6d92)
• get external resource blocked (#12927) (a7ad573)
• restore missing properties to live preview client config (#12904) (bcb10b5)
• uses valid fractional index for test (#12942) (8900a38)
• querying virtual fields deeply with draft: true (#12868) (bc9b501)
• use small pill size when viewing version information (#12844) (6c4dfe4)
• db-mongodb: strip deleted from the config blocks from the result (#12869) (54afaf9)
• db-postgres: joins with custom schema (#12937) (c1f6297)
• db-postgres: querying on hasMany: true select field in a relationship (#12916) (b74969d)
• drizzle: skip column if undefined in findMany (#12902) (605c993)
• live-preview: client-side live preview cannot populate more than 10 relationships at once (#12929) (7472798)
• live-preview: foreign postMessage events reset client-side state (#12925) (67fa5a0)
• next: live preview popup triggers leave without saving modal (#12947) (141133a)
• next: prevent errors in globals version view (#12920) (39e9519)
• next: remove error handling from next auth functions (#12897) (1b5e3fe)
• next: remove console.error from next auth functions (#12881) (fe58f03)
• plugin-import-export: duplicated rows and headers in CSV export when streaming paginated results (#12941) (5cf9287)
• plugin-import-export: csv export for polymorphic relationship fields (#12926) (6d76874)
• plugin-import-export: omit CSV columns when toCSV returns undefined (#12923) (751691a)
• plugin-multi-tenant: updates tenant selector upon tenant creation (#12936) (c76d839)
• richtext-lexical: consistent html converter inline padding (#12848) (11ac230)
• ui: usePreventLeave should not show alert for exceptions (#12722) (c3c1614)
• ui: vertically align table headers to the middle (#12699) (0e9865c)
• ui: properly render create new button in polymorphic joins (#12930) (a1822d2)
• ui: render DateTime label as <label> instead of <span> (#12949) (4b9566f)
• ui: bulk upload losing state when adding additional files (#12946) (d62d9b4)
• ui: unreachable custom views when admin route set to '/' (#12812) (379fc12)
• ui: toggle list selections off on successful bulk action (#12861) (9f17db8)
• ui: align caret on error tooltip for checkbox field (#12917) (c094b0e)
• ui: updates auth fields UI to reflect access control (#12745) (1845669)
• ui: folder server function must reference exports dir (#12898) (0d50799)
• ui: custom row labels on arrays should not be removed on field duplication (#12895) (37c945b)
• ui: date format of useAsTitle lost after changing value (#12928) (20bbbcf)
• ui: properly differentiate between DOM events and raw values in setValue (#12892) (c03e9c1)
• ui: should select document after creation from relationship field (#12842) (25e3902)
• ui: support react node content in ConfirmationModal heading and body (#12841) (dffdee8)

🛠 Refactors

• changed default exports to named exports in payload package (#12871) (053192c)
• remove unused assets, move remaining assets out of payload packages (#12874) (bb17cc3)
• simplify job queue error handling (#12845) (59f536c)
• simplify job type (#12816) (84cb2b5)

📚 Documentation

• remove group from list of default field validations (#12921) (e5e0ec8)
• filterOptions anchor link fix (#12883) (fcaf989)
• fix typo on authentication overview page (#12891) (7a0308f)
• plugin-sentry: add pg query instrumentation guide (#12229) (dede3a4)

🧪 Tests

• bulk edit flaky selectors (#12950) (86e48ae)
• adds test for skipSafeFetch allowList (#12954) (7ebac63)
• guard against null values in custom toCSV functions (#12938) (1cdec86)
• fix database/int.spec.ts with postgres custom schema (#12922) (cf87871)
• fix database integration tests with postgres (#12919) (886c07e)

📝 Templates

• bump for v3.43.0 (#12831) (d1826c6)

📓 Examples

• fix broken navigation to post in localization example (#12810) (6a935d4)

⚙️ CI

• bring back CODEOWNERS file for reviews, approval not required [skip ci] (1db0619)
• revert bump pnpm to v10 (#12840) (#12906) (ca0d036)
• add timeout-minutes for int and e2e (#12903) (c7dc1b4)
• adjust neverBuiltDependencies in test/package.json (#12896) (a44e4c4)
• bump pnpm to v10 (#12840) (85e0e0e)

🏡 Chores

• fix jest global teardown incorrectly always returning process exit status 0 (#12907) (5368440)
• set trimTrailingWhitespace and insertFinalNewline in vscode settings (#12939) (b1a57fa)
• fix withPayload helper jsdoc (#12503) (57f4fb6)
• remove neverBuiltDependencies from test/package.json (4831f66)
• add eslint rule to ignore default exports in test suite configs (#12655) (9c5adba)

🤝 Contributors

• James Mikrut (@jmikrut)
• Jacob Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Roman (@spielerx)
• Jesper We (@JesperWe)
• ThijsAtFreave (@ThijsAtFreave)
• Sam Wheeler (@swheeler7)
• Chandler Gonzales (@jcgsville)
• Jessica Rynkar (@jessrynkar)
• Said Akhrarov (@akhrarovsaid)
• Dani Calero 🚀 (@danicaleroo)
• Sasha (@r1tsuu)
• Dan Ribbens (@DanRibbens)
• Patrik (@PatrikKozak)
• Dave Ryan (@dave-wwg)
• Jarrod Flesch (@JarrodMFlesch)
• Kendell (@kendelljoseph)
• Ondřej Závodný (@ozavodny)
• Paul (@paulpopus)
• Ruby Jasmin (@rubyjasmin)
• Anatoly Kopyl (@anatolykopyl)
• Alessio Gravili (@AlessioGr)
• Andrea Ghidini (@ghidosoft)
• Adler Weber (@adlrwbr)
• Marcus Michaels (@marcusmichaels)
• Philip (@stuckinsnow)

v3.43.0 (2025-06-16)

🚀 Features

• admin upload controls (#11615) (f2e0422)
• expose data argument in afterChange hook for collections and globals (#12756) (458a04b)
• db-postgres: allow to store blocks in a JSON column (#12750) (215f49e)
• db-postgres: support read replicas (#12728) (0a35737)
• version diff view overhaul (#12027) (4e2e4d2)
• next: reorder document view tabs (#12288) (65309b1)
• storage-s3: dynamic presigned URL downloads (#12706) (865a9cd)
• ui: adds constructorOptions to upload config (#12766) (b372a34)
• ui: moves folder rendering from the client to the server (#12710) (a43d1a6)

🐛 Bug Fixes

• ensure job autoruns are not triggered if jobs collection not enabled (#12808) (769ca03)
• filtering joins in where by ID (#12804) (9943b35)
• change payload.jobs.run and bin script to only run jobs from default queue by default, adds support for allQueues argument (#12799) (06ad171)
• remove unsupported path property from default document view configs (#12774) (f64a0ae)
• field inside an unnamed group field erroring when used as a title (#12771) (143aff5)
• error when saving global with versioning enabled (#12778) (cf43c5c)
• reduce global DOM/Node type conflicts in server-only packages (#12737) (67fb29b)
• orderable has incorrect sort results depending on capitalization (#12758) (37afbe6)
• ensure redirect route is correctly formatted for "Copy to locale" (#12560) (9d2817e)
• db-mongodb: 4x and more level deep relationships querying (#12800) (245a2de)
• db-mongodb: bump mongoose to 8.15.1 (#12755) (860e0b4)
• db-postgres: reordering of enum values, bump drizzle-kit@0.31.0 and drizzle-orm@0.43.1 (#12256) (7045182)
• db-postgres: x3 and more nested blocks regression (#12770) (df8be92)
• db-sqlite: sqlite unique validation messages (#12740) (254ffec)
• plugin-import-export: download button in collection edit view (#12805) (8235fe1)
• plugin-import-export: incorrect custom type on toCSVFunction changed to toCSV (#12796) (3edcc40)
• plugin-import-export: export all available fields by default (#12731) (c4e5831)
• plugin-nested-docs: check error name that is changed at compile time (#12798) (729b676)
• plugin-redirects: add missing optional chaining (#12753) (d0e647a)
• storage-azure: return error status 404 when file is not found instead of 500 (#11734) (018317d)
• storage-gcs: return 404 on file not found instead of 500 (#11746) (d8626ad)
• storage-s3: return error status 404 when file is not found instead of 500 (#11733) (a19921d)
• translations: reformats bnBD and bnIN translation imports to camelCase (#12736) (08fbcb5)
• ui: reordering with a join field inside a group (#12803) (e60db07)
• ui: adjust alignment of list header actions (#12793) (77f3805)
• ui: not showing hyphenated field values in table (#12791) (e7b5884)
• ui: inconsistent pill sizes across admin panel (#12788) (9364d51)

⚡ Performance

• ui: do not re-animate drawer on re-render, reduce useEffects (#12743) (cb3f9bb)

🛠 Refactors

• next: simplify document tab rendering logic (#12795) (53835f2)
• next: simplify document view routing (#12777) (b556fe3)

📚 Documentation

• fix header custom component example (#12801) (7fef589)
• remove outdated buildPath property (#12741) (38652d7)
• add info about localized/built-in validation error messages (#12718) (96f417b)
• fix invalid code block language (#12734) (ebe7fde)

🏡 Chores

• adds filters (#12622) (c04c257)
• remove invalid colon from workspaces key in package.json (#12757) (08d5b2b)
• migrate to TypeScript strict in Payload package - #4/4 (#12733) (53f8838)
• scripts: fix tsconfig.base.json reset (3313ab7)

🤝 Contributors

• Sasha (@r1tsuu)
• Jessica Rynkar (@jessrynkar)
• Alessio Gravili (@AlessioGr)
• Dan Ribbens (@DanRibbens)
• Kendell Joseph (@kendelljoseph)
• Paul (@paulpopus)
• Jacob Fletcher (@jacobsfletch)
• Jayce Pulsipher (@jaycetde)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Patrick Roelofs (@Patrickroelofs)
• Anders Semb Hermansen (@andershermansen)
• Said Akhrarov (@akhrarovsaid)
• Elliot DeNolf (@denolfe)
• Anyu Jiang (@anyuj)
• Germán Jabloñski (@GermanJablo)
• codeflorist (@codeflorist)

v3.42.0 (2025-06-09)

🚀 Features

• create the importmap file if missing and the location can be found (#12727) (c6659db)
• plugin-import-export: add custom toCSV function on fields (#12533) (8f4c442)
• plugin-import-export: add debug logging option (#12705) (678bfc7)
• translations: add Bangla translations (#12696) (3f670ca)

🐛 Bug Fixes

• proper globals max versions clean up (#12611) (9fbc3f6)
• adds routeParams to the req on views (#12711) (773e4ad)
• plugin-form-builder: export DateField type (#12695) (8d7dbe6)
• plugin-import-export: incorrect config extension of jobs (#12730) (ff615d3)
• plugin-import-export: revise zhTw translations (#12685) (afbdf3d)
• richtext-lexical: text state css not applied if 2+ text state groups present (#12726) (3d177fd)
• richtext-lexical: prevent runtime error if using TextStateFeature without props (#12668) (6f82154)
• richtext-slate: add 'li' string literal to RichTextElement type (#12693) (e10e445)
• translations: correct i18n dynamic variable name for 'movingFromFolder' (#12642) (6f76d72)

⚡ Performance

• richtext-lexical: improve typing performance while toolbars are enabled (#12669) (aef4f77)

📚 Documentation

• document how to expose the jobs collection in Admin UI (#12707) (34fe36b)
• fix formatting in custom components > edit view paragraph (#12697) (6466684)
• improve jobs autorun docs, adds e2e test (#12196) (7c05c77)
• enhance drafts documentation with examples for REST, Local, and GraphQL APIs (#12575) (629e74d)
• removes duplicate headline in building without a db connection (#12694) (4ee4aa7)
• plugin-form-builder: add warning about GraphQL type name collis… (#12720) (7b21270)

🏡 Chores

• enable turbopack by default in monorepo (#12684) (f80dc5b)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Sasha (@r1tsuu)
• sonny.you (@SonnyYou)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Germán Jabloñski (@GermanJablo)
• Gordon Westerman (@gwesterman)
• Willian de Souza (@WillFelisberto)
• Anyu Jiang (@anyuj)
• SHOMRIDDHO'S WORLD (@shomriddho)
• Jessica Rynkar (@jessrynkar)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)

v3.41.0 (2025-06-05)

🚀 Features

• optionally exclude collection documents from appearing in browse-by-folder (#12654) (337f618)
• improve turbopack compatibility (#11376) (319d335)
• polymorphic join querying by fields that don't exist in every collection (#12648) (2b40e0f)
• ui: use document drawers for folder edit/create (#12676) (9581092)
• ui: adds new editMenuItems custom component (#12649) (625d8d9)

🐛 Bug Fixes

• correctly detect glb & gltf mimetypes during upload (#12623) (05eeddb)
• allow unnamed group fields to not set a label at all (#12580) (d561195)
• cpa: generate .env when using the --example flag (#12572) (836fd86)
• db-postgres: ensure deletion of numbers and texts in upsertRow (#11787) (bd512f1)
• db-postgres: in query with null (#12661) (c08cdff)
• live-preview: correct type inference (#12619) (c83e791)
• next: cannot override tab of default views (#11789) (c639c5f)
• plugin-seo: thread allowCreate to meta image component (#12624) (ede5c67)
• richtext-lexical: export defaultColors for use in client components (#12627) (8199a7d)
• richtext-lexical: enable select inputs with ctrl+a or cmd+a (#12453) (89ced5e)
• translations: add missing import for lv locale from date-fns (#12577) (cbc37d8)
• ui: adjusts margin spacing on upload actions (#12692) (1dd4a12)
• ui: safely extract text from React nodes (#12419) (48e5ee6)
• ui: formatDate and formatTimeToNow utility type error on i18n arg to support I18nClient too (#12576) (76bf459)
• ui: correctly thread through the autoComplete attribute from admin config to the text input (#12473) (08ec837)
• ui: clear miliseconds in date fields unless theyre explicitly provided in the display format (#12650) (a9ff375)
• ui: reset columns state throwing errors (#11903) (08a6f88)
• ui: upload action button styles (#12592) (6119d89)

⚡ Performance

• ui: prevent unnecessary client config sanitization (#12665) (2bd098c)

🛠 Refactors

• translations: correct i18n translation for Mandarin (#12561) (6f8cff7)
• ui: improve relationship field option loading reliability using queues (#12653) (30dd9a2)

📚 Documentation

• add Content-Type header for JWT authentication (#12513) (3f7debd)
• fix import statements for plugin-nested-docs (#12494) (5635ec5)
• improve rich-text documentation with hasText usage tip (#12645) (53de775)
• fix beforeHook documentation to reflect actual behaviour (#12651) (fd5cd1a)
• improve module augmentation docs for request context (#12681) (0c3ff88)
• update seo plugin tabbedUI docs to mention potential pitfalls with the config option (#12549) (505eaa2)
• missing dash (#12644) (684c436)
• building without a db connection (#12607) (7c094dc)

📝 Templates

• do not expose users in example custom routes (#12677) (be52a20)
• bump for v3.40.0 (#12613) (71df378)

⚙️ CI

• skip flaky test on supabase (#12667) (30bb749)
• ability to test against turbopack (#12652) (0ceb96b)

🏡 Chores

• fix various e2e test setup issues (#12670) (545d870)
• fix lint warnings for default exports, unused imports, unused err in catch (#12666) (48218bc)
• migrate to TypeScript strict in Payload package (enable strictNullChecks) - #3 (#12586) (6ec21a5)
• update CONTRIBUTING.md (#12511) (5e3a94b)

🤝 Contributors

• Patrik (@PatrikKozak)
• Kamil Troczewski (@kamiloox)
• codeflorist (@codeflorist)
• Rot4tion (@Rot4tion)
• iamacup (@iamacup)
• Jacob Fletcher (@jacobsfletch)
• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Said Akhrarov (@akhrarovsaid)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Germán Jabloñski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• Jacob (@chmielulu)
• Tobias Odendahl (@tak-amboss)
• Anyu Jiang (@anyuj)

v3.40.0 (2025-05-29)

🚀 Features

• adds new canSetHeaders prop to auth strategies (#12591) (ca6f849)
• moves getSafeRedirect into payload package (#12593) (7e873a9)
• adds calling of before and after operation hooks to resetPassword (#12581) (54a0484)
• show nested fields in named tabs as separate columns in the list view (#12530) (20f7017)
• filter query preset constraints (#12485) (0204f0d)
• select field filter options (#12487) (f75d62c)
• ui: export FieldAction type (#12589) (699af8d)

🐛 Bug Fixes

• parseCookies ignore invalid encoded values (#12515) (bfdcb51)
• improve translation script prompt and fix some incorrectly used terms in spanish and dutch (#12548) (1731dd7)
• browseByFolder route should be optional (#12527) (c010d51)
• thread req into interal folder payload operations (#12523) (64443d8)
• infinite loop in findUp utility when a result is not found (#12457) (842d184)
• delete subfolders hook with relational databases (#12507) (45f4c5c)
• db-*: disable DB connection for payload migrate:create (#12596) (12395e4)
• db-*: migrate:reset executes in a wrong order (#12445) (1b1e36e)
• db-mongodb: exists query on checkbox fields (#12567) (f2b6c4a)
• db-postgres: properly escape the ' character (#12590) (6888f13)
• examples: update live-preview example to ESM (#12570) (d6f6b05)
• next: folder redirects not working (#12509) (bc43982)
• richtext-lexical: respect disableBlockName (#12597) (ca26402)
• richtext-lexical, ui: opening relationship field with appearance: "drawer" inside rich text inline block (#12529) (f2b54b5)
• storage-vercel-blob: client uploads with a prefix (#12559) (b61ef13)
• templates: update template/plugin and fix import map issue (#12305) (68ba24d)
• translations: improve Spanish translations (#12555) (8a7ac78)
• translations: correct Norwegian terms for “locale” and language labels (#12557) (bd2571c)
• ui: reduces pill sizing in autosave cells (#12606) (a17d84e)
• ui: oversized column selector pills (#12583) (3022cab)
• ui: filtering on hasMany fields (#12579) (166dafe)
• ui: prevent textarea description overlapping fields and not honoring rows attribute (#12406) (032375b)
• ui: cloudfront removing X-HTTP-Method-Override header (#12571) (8448e5b)
• ui: live-preview-tab should show beforeDocumentControls (#12568) (dfa0974)
• ui: safari css rendering issues with table and folder cards (#12531) (293cdc1)
• ui: only and files/folders to the grid/list if they were added to the current folder (#12525) (5a75881)
• ui: replaces css fn with css calc (#12520) (feeee19)
• ui: index based ids without useAsTitle breaks folders (#12519) (e9cda1e)

⚡ Performance

• folder views download only images and get best fit from image sizes (#12514) (11a4a20)

🛠 Refactors

• use parseCookies method from Next.js (#12599) (d85909e)

📚 Documentation

• autoLogin codeblock was not nested under 'admin' (#12573) (0c0b0fe)
• typos and links (#12484) (7fa879c)
• fix typos, duplicated words, wrong property names etc. (#12480) (e2f7889)

📝 Templates

• bump for v3.39.1 (#12504) (6b6948f)

🏡 Chores

• updates bug template (#12587) (4a41369)
• fixes monorepo dev plugin-import-export (#12528) (06fbc07)
• moves collections folders property to the top level (#12508) (d83b2bf)
• examples: remove unused imports from custom server example (#12467) (071c61f)
• examples: fix read permission in auth example (#12403) (cceb793)
• ui: finish adding folders e2e tests (#12524) (feb7e08)

🤝 Contributors

• Sasha (@r1tsuu)
• Jarrod Flesch (@JarrodMFlesch)
• James Mikrut (@jmikrut)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Jordy (@jordanlambrecht)
• Alessandro Stoppato (@alexrah)
• Germán Jabloñski (@GermanJablo)
• Sean Zubrickas (@zubricks)
• Jessica Rynkar (@jessrynkar)
• Patrik (@PatrikKozak)
• Said Akhrarov (@akhrarovsaid)
• Paul (@paulpopus)
• Anders Semb Hermansen (@andershermansen)
• Anyu Jiang (@anyuj)
• Dan Ribbens (@DanRibbens)
• Ricardo Tavares (@rjgtav)
• Jake Grella (@jakegrella)
• Rémy (@rrelmy)
• Elliot DeNolf (@denolfe)

v3.39.1 (2025-05-22)

🐛 Bug Fixes

• update folders export paths (#12501) (0f7dc38)

📚 Documentation

• folders beta (#12500) (c720ce3)

📝 Templates

• include ui package (#12499) (3a73a67)
• bump for v3.39.0 (#12498) (4c6fde0)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)

v3.39.0 (2025-05-22)

🚀 Features

📁 Folders (#10030) (00667fa)

Folders allow you to organize your documents in a more manageable way. Now you can enable folders on a per-collection basis and from there start adding folders from within the admin panel (or via the API). Once you have folders enabled you can then start organizing. You can create folders and store documents across multiple collection types and then view them either in the collection "By Folder" or in the global "Browse by Folder" view.

https://github.com/user-attachments/assets/da1e0dec-abc7-4e5c-9241-3a733b2bfa0c

• show fields inside groups as separate columns in the list view (#7355) (2a41d3f)
• plugin-form-builder: add new date field (#12416) (4dfb2d2)
• richtext-lexical: add TextStateFeature (allows applying styles such as color and background color to text) (#9667) (fc83823)
• ui: extracts relationship input for external use (#12339) (88769c8)

🐛 Bug Fixes

• auto inject req.user into query preset constraints (#12461) (22b1858)
• telemetry in opennext cloudflare (#12327) (2ab8e2e)
• prevent resizing of original file with withoutEnlargement on update (#12291) (1235a18)
• incorrect environment file loading (#12360) (1425269)
• sanitize duplicate blocks (#12440) (5855f3a)
• orderable with groups and tabs requires migration (#12422) (529bfe1)
• respect hidden: true for virtual fields that have reference to a relationship field (#12219) (1f6efe9)
• cpa: ensure it always installs the latest version of the templates (#12488) (898e97e)
• db-*: ensure consistent sorting even when sorting on non-unique fields or no sort parameters at all (#12447) (72ab319)
• db-mongodb: remove limit from nested querying (#12464) (230128b)
• db-postgres: allow the same block slug in different places with a different localized value (#12414) (219fd01)
• plugin-import-export: add translations for all UI elements and fields (#12449) (3127d6a)
• plugin-multi-tenant: multi-locale tenant select label (#12444) (4fe3423)
• plugin-multi-tenant: add missing translation for Assigned Tenant field (#12448) (e8c2b15)
• plugin-seo: fix genImageResponse result parsing (#12301) (cead312)
• richtext-lexical: support inline block types in strict mode for JSXConvertersFunction type (#12478) (8596ac5)
• templates: make images visible in live preview if it is not running on port 3000 (#12432) (d4899b8)
• ui: set gap to 0 in sort column buttons to remove unneeded spacing (#12481) (c772a32)
• ui: render missing group children fields for unnamed group (#12433) (6fb2beb)
• ui: req not being threaded through to views (#12213) (bd6ee31)

⚡ Performance

• ui: useAsTitle field lags on slow cpu (#12436) (18f2f89)

📚 Documentation

• update rich text to HTML conversion documentation (#12465) (c701dd4)
• fix API capitalization typo in virtual fields documentation (#12477) (324daff)

🧪 Tests

• add test for sorting by a virtual field with a reference (#12351) (81d333f)

📝 Templates

• bump for v3.38.0 (#12434) (4166621)

🏡 Chores

• simplifies buildColumnState functions (#12496) (8142a00)
• ignore .idea run configuration templates (#12439) (23f4204)
• fix all lint errors and add mechanisms to prevent them from appearing again (#12401) (2a929cf)
• add ignores .next folder in eslint config for templates template (#12423) (e395a0a)
• drizzle: fix lint errors in @payloadcms/drizzle (#12428) (38029cd)
• live-preview: load schemaJSON from proper client config in integration tests (#12167) (08a3dfb)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Paul (@paulpopus)
• Anders Semb Hermansen (@andershermansen)
• Germán Jabloñski (@GermanJablo)
• Patrik (@PatrikKozak)
• Sasha (@r1tsuu)
• Dan Ribbens (@DanRibbens)
• Alessio Gravili (@AlessioGr)
• Keisuke Ikeda (@ksk1kd)
• Jacob Fletcher (@jacobsfletch)
• conico974 (@conico974)
• Femi Oladipo (@femioladipo)
• Anyu Jiang (@anyuj)
• Elliot DeNolf (@denolfe)
• ch-jwoo (@ch-jwoo)

v3.38.0 (2025-05-15)

🚀 Features

• add latvian language support (#12363) (77bb7e3)
• allow group fields to have an optional name (#12318) (e258cd7)
• prevent query preset lockout (#12322) (9779cf7)
• thread overrideAccess through field validations (#12399) (7130834)
• plugin-multi-tenant: prompt the user to confirm the change of tenant before actually updating (#12382) (faa7794)
• storage-s3: presigned URLs for file downloads (#12307) (800c424)
• ui: fixed toolbar group customization (#12108) (b7b2b39)
• ui: display the actual error message on unpublish if available (#11898) (b3cac75)

🐛 Bug Fixes

• db-mongodb: sort by fields in relationships with draft: true (#12387) (fd67d46)
• db-mongodb: localized dates being returned as date objects instead of strings (#12354) (c43891b)
• db-postgres: build near sort query properly for point fields (#12240) (58fc2f9)
• db-postgres: dbName in arrays regression with long generated drizzle relation names (#12237) (5fce501)
• db-postgres: v2-v3 migration errors with relation already exists (#12310) (3edfd7c)
• db-postgres: ensure module augmentation for generated schema is picked up correctly in turborepo (#12312) (98283ca)
• db-postgres: selectDistinct might remove expected rows when querying with nested fields or relations (#12365) (8219c04)
• drizzle: improve db push schema comparison (#12193) (7266225)
• next: tells webpack not to bundle the require-in-the-middle pkg (#12417) (7498d09)
• plugin-cloud: ensure scheduled publishing works if no custom jobs are defined (#12410) (d63c8ba)
• richtext-lexical: newTab not being able to be checked to true by default (#12389) (3e7db30)
• ui: respect filterOptions: { id: { in: [] } } (#12408) (8ebadd4)
• ui: passes value to server component args (#12352) (d9c0c43)

⚡ Performance

• remove duplicative deep loops during field sanitization (#12402) (93d79b9)
• actually debounce rich text editor field value updates to only process latest state (#12086) (1d5d96d)

📚 Documentation

• remove link to outdated ecommerce template from stripe plugin docs (#12353) (cd45574)
• add local api instructions for vercel content link (#12385) (a9cc747)
• add pagination and limit: 0 information in pagination for API docs (#12243) (05ae957)

📝 Templates

• fix categories search sync (#12359) (3701de5)
• add eslint ignore rule for '.next/' (#12332) (09f15ff)
• fix Media component failing when setting a custom serverURL (#12214) (1869377)

🏡 Chores

• add NODE_OPTIONS to vscode settings by default in the repo for playwright extension (#12390) (e93d0ba)
• add no-frozen-lockfile flag for templates script (#12394) (735d699)
• bump node version in monorepo and add new flag for node 23.6+ (#12328) (021932c)
• plugin-stripe: enable TypeScript strict (#12303) (edeb381)

🤝 Contributors

• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Jarrod Flesch (@JarrodMFlesch)
• Dan Ribbens (@DanRibbens)
• Dmitrijs Trifonovs (@dt-globelaxy)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Ruslan (@ruslan-amboss)
• Philipp Schneider (@philipp-tailor)
• Anyu Jiang (@anyuj)
• Jessica Rynkar (@jessrynkar)
• Germán Jabloñski (@GermanJablo)
• Rot4tion (@Rot4tion)
• jeepman32 (@jeepman32)
• Tobias Odendahl (@tak-amboss)

v3.37.0 (2025-05-05)

🚀 Features

• exports additional login helper utils (#12309) (dcd4e37)
• live-preview: expose requestHandler to subscribe.ts (#10947) (35c0404)
• ui: update RelationshipFilter if only filterOptions are changed (#11985) (446938b)
• ui: add document link to drawer (#12036) (292b462)
• ui: add option to open related documents in a new tab (#11939) (1ef1c55)
• ui: make select and relationship field placeholder configurable (#12253) (e568391)
• ui: allow array fields to be filtered in list view (#11925) (78d3af7)

🐛 Bug Fixes

• allow custom admin user collection in query presets constraints (#12202) (b9868c4)
• cpa: overwrites existing env variables (#10636) (e5b28c9)
• db-*: migration batch not incrementing past 1 (#12215) (3c9ee5d)
• db-postgres: start transaction in v2-v3 migration only after drizzle prompts to avoid timeout (#12302) (2628b43)
• graphql: nextPage and prevPage are non nullable even though they can be null sometimes (#12201) (3fb81ef)
• graphql: population of joins that target relationship fields that have relationTo as an array (#12289) (c08c707)
• plugin-cloud-storage: missing 'prefix' in cloud storage plugin (#11970) (0d10f43)
• plugin-multi-tenant: make tenant selector respect order if orderable enabled for tenant collection (#12314) (a6d76d6)
• richtext-lexical: add missing line-breaks to plaintext conversion (#11951) (ddf40d5)
• ui: unable to search for nested fields in WhereBuilder field selection (#11986) (3818634)
• ui: blockType ignored when merging server form state (#12207) (a62cdc8)
• ui: fix version list status for unpublished documents (#11983) (b6b02ac)

📚 Documentation

• fix typo in fields/relationship.mdx (#12306) (055a263)
• repair blank template markdown link in installation docs (#12297) (5365d4f)

🏡 Chores

• live-preview: enable TypeScript strict (live-preview-vue) (#12299) (b480f81)
• live-preview-react: enable TypeScript strict (#12298) (11018eb)
• storage-uploadthing: enable TypeScript strict (#12304) (d7d3744)

🤝 Contributors

• Ruslan (@ruslan-amboss)
• Anyu Jiang (@anyuj)
• Florian Beeres (@cideM)
• James Mikrut (@jmikrut)
• Tobias Odendahl (@tak-amboss)
• Sasha (@r1tsuu)
• Dan Ribbens (@DanRibbens)
• Germán Jabloñski (@GermanJablo)
• Bamsi (@francescoamici)
• Philipp Schneider (@philipp-tailor)
• qoheleth-tech (@qoheleth-tech)
• Samuel Gabriel (@sam-gab)
• Jessica Rynkar (@jessrynkar)
• Janus Reith (@janus-reith)

v3.36.1 (2025-04-30)

🐛 Bug Fixes

• duplicate with orderable (#12274) (710fe09)
• virtual relationship fields with select (#12266) (564fdb0)
• update email regex to support special characters (#12181) (8fee016)
• db-postgres: count crashes when query contains subqueries and doesn't return any rows (#12273) (4a56597)
• plugin-import-export: csv export column order (#12258) (47a1eee)
• richtext-lexical: ensure state is up-to-date on inline-block restore (#12128) (1b17df9)

⚡ Performance

• optimize file access promises (#12275) (6133a1d)
• db-postgres: skip pagination overhead if limit: 0 is passed (#12261) (27d644f)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Sasha (@r1tsuu)
• Mattias Grenhall (@grenhall)
• Tobias Odendahl (@tak-amboss)

v3.36.0 (2025-04-29)

🚀 Features

• add beforeDocumentControls slot to allow custom component injection next to document controls (#12104) (d553069)
• add showSaveDraftButton option to show draft button with autosave enabled (#12150) (34ea6ec)

🐛 Bug Fixes

• user validation error inside the forgotPassword operation in the cases where user had localised fields (#12034) (c85fb80)
• db-mongodb: fallback version when not selected (#12158) (6dc61ae)
• db-postgres: sort by distance when the near operator is used (#12185) (9955818)
• examples: incorrect documentation links for Live Preview example (#12233) (ab03f4f)
• next: pg-cloudflare build issue (#12242) (2157450)
• plugin-search: delete does not also delete the search doc (#12148) (df7a369)
• richtext-lexical: prevent extra paragraph when inserting blocks or uploadNodes. Add preemptive selection normalization (#12077) (5492542)
• richtext-lexical: allow to indent and outdent if at least one selected node allows it (#12182) (9b1dd2a)
• richtext-lexical: reset indent on node transforms (#12183) (2c20051)
• ui: copyToLocale should not pass any id's to avoid duplicates (#11887) (34ead72)
• ui: relationship using list drawer correctly updates when hasMany is true (#12176) (5bd852c)
• ui: reflect default sort in join tables (#12084) (b750ba4)

⚡ Performance

• optimize virtual fields that reference ID (#12159) (fdff587)
• graphql: skip count query for join field using simple pagination (#12223) (6b83086)
• plugin-nested-docs: remove extra find call (#12224) (2f21d46)
• plugin-search: reduce query depth in hooks (#12225) (caae598)
• ui: only select necessary data for relationship options (#12251) (9948040)

🛠 Refactors

• translations: improvements for german translations (#11807) (92380bf)

📚 Documentation

• adds warning about handling different environments with migrations (#12249) (b7ae4ee)
• fix query preset config link (#12156) (034a267)
• virtual fields linking with relationship fields (#12145) (d91478c)

🤝 Contributors

• Germán Jabloñski (@GermanJablo)
• Tobias Odendahl (@tak-amboss)
• Jessica Rynkar (@jessrynkar)
• Bjørn Nyborg (@Bjornnyborg)
• Dan Ribbens (@DanRibbens)
• Sam Wheeler (@swheeler7)
• Adrian Maj (@AdrianMaj)
• Tylan Davis (@tylandavis)
• Elliot DeNolf (@denolfe)
• Said Akhrarov (@akhrarovsaid)
• Silas Krause (@krsilas)
• Sasha (@r1tsuu)
• Corey Larson (@coreyleelarson)
• Patrik (@PatrikKozak)

v3.35.1 (2025-04-17)

🐛 Bug Fixes

• next: missing @payloadcms/next/auth export (#12144) (ed50a79)

🏡 Chores

• db-postgres: improve table name length exceeded error message (#12142) (0a59707)

🤝 Contributors

• Jessica Chowdhury (@JessChowdhury)
• Sasha (@r1tsuu)

v3.35.0 (2025-04-16)

🚀 Features

• queriable / sortable / useAsTitle virtual fields linked with a relationship field (#11805) (1c99f46)
• threads operation through field condition function (#12132) (c877b1a)
• adds and exports reusable auth server functions (#11900) (6b34937)
• db-postgres: dependency inject pg to allow Sentry instrumentation (#11478) (da7be35)
• ui: add option for rendering the relationship field as list drawer (#11553) (55d00e2)
• ui: use defaultDepth in API view (#11950) (b354d00)

🐛 Bug Fixes

• respects boolean query preset constraints (#12124) (a675c04)
• ensures cors headers are run against custom endpoints (#12091) (e79b203)
• reordering draft documents causes data loss (#12109) (e90ff72)
• correct typo in error message and remove console.log (#12082) (a9eca3a)
• db-postgres: use correct export path for codegen in createSchemaGenerator (#12043) (71e3c78)
• db-sqlite: text field converts to floating point number (#12107) (6572bf4)
• richtext-lexical: allow to indent children even if their parents are not indentable (#12042) (babf4f9)
• templates: missing default value in select field (#11715) (5b554e5)
• translations: add missing Catalan translations (#10682) (85e6edf)
• ui: stale paths on custom components within rows (#11973) (21599b8)
• ui: issue with schedule publish disappearing on autosave collections (#12078) (3a7cd71)
• ui: use route.api from config in OrderableTable (#12081) (3287f70)

⚡ Performance

• ui: prevent blockType: "$undefined" from being sent through the network (#12131) (4426625)

📚 Documentation

• fix syntax issue in blocks field (#11855) (b9832f4)
• minor formatting tweaks to server function examples (#12102) (c661d33)

🏡 Chores

• adjusts ChevronIcon styling to match other icons (#12133) (2362899)
• assign available port to env variable in dev suite (#12092) (39462bc)
• separate Lexical tests into dedicated suite (#12047) (a66f90e)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Philipp Schneider (@philipp-tailor)
• Tylan Davis (@tylandavis)
• Kristian Djaković (@kristian240)
• Jacob Fletcher (@jacobsfletch)
• James Mikrut (@jmikrut)
• Dan Ribbens (@DanRibbens)
• Tobias Odendahl (@tak-amboss)
• Adler Weber (@adlrwbr)
• Sam Wheeler (@swheeler7)
• AoiYamada (@AoiYamada)
• Edgar Guerra (@edguerrade)
• Jessica Chowdhury (@JessChowdhury)
• Paul (@paulpopus)
• Slava Nossar (@slavanossar)
• Corey Larson (@coreyleelarson)
• alexrah (@alexrah)
• Germán Jabloñski (@GermanJablo)

v3.34.0 (2025-04-10)

🚀 Features

• support where querying by join fields (#12075) (466dcd7)
• add support for time format config on scheduled publish (#12073) (eab9770)

🐛 Bug Fixes

• cannot define a join field when the target relationship is nested to a second or higher tab (#12041) (7aa3c5e)
• image previews getting stuck in list view when paginating (#12062) (a0fb335)
• array minRow validation should not show when non-required with no rows (#12037) (f079ece)
• querying by polymorphic join field relationTo with overrideAccess: false (#11999) (b9ffbc6)
• db-postgres: long array field table aliases cause error even when dbName is used (#11995) (09782be)
• richtext-lexical: diff component css was not included in css bundle (#12028) (f1d9b44)
• ui: ensure file field is only serialized at top-level for upload-enabled collections (#12074) (112e081)
• ui: form state race conditions (#12026) (4d7c1d4)
• ui: adds multi select inputs for text fields in where builder (#12054) (18ff9cb)
• ui: orderable table rendering (#12066) (9853f27)
• ui: adds multi select inputs for number fields in where builder (#12053) (09916ad)
• ui: resets value in where builder when operator changes (#11136) (ec34e64)
• ui: upload edits handling for bulk uploads (#12001) (c7b14bd)
• ui: prefer adminThumbnail even if file is non-image (#11948) (7721025)

⚡ Performance

• richtext-lexical: debounce field onChange handler (#12046) (101f765)

📚 Documentation

• formatting tweaks for local api docs (#12064) (a90ae9d)
• adjust formatting on Local API - Server Functions documentation (#12058) (d19412f)
• adds server function and access control sections to local API docs (#11902) (b809c98)
• clarify file upload example with _payload & field explanation (#12025) (83319be)
• fix and normalize links (#11993) (e109491)
• fix a typo (#12012) (dee9abd)
• fix markdown link (#12000) (5c54d9a)

🧪 Tests

• optimistic form state rows (#12055) (bd557a9)
• temp skip blocks e2e (#11988) (750210f)

📝 Templates

• update readme on blank template and blank template variations for Vercel (#12070) (3523c2c)
• bump for v3.33.0 (#12003) (6d83147)

⚙️ CI

• add sort and hooks suites to the e2e tests matrix (#12023) (ae9e5e1)

🏡 Chores

• run dev:generate-types (#11994) (97e2e77)
• add logging templates script and fix engines for pnpm v10 (#12021) (b270901)
• deps: bump image-size to 2.0.2 version (#12063) (37bfc63)
• deps: bump next.js to 15.3.0 and related dependencies (#12067) (e0046bb)
• deps: bump image-size package for security update (#12040) (acae547)
• plugin-seo: enable TypeScript strict (#11933) (a72fa86)

🤝 Contributors

• Sasha (@r1tsuu)
• Germán Jabloñski (@GermanJablo)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Jacob Fletcher (@jacobsfletch)
• Jessica Chowdhury (@JessChowdhury)
• Philipp Schneider (@philipp-tailor)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Tylan Davis (@tylandavis)
• Said Akhrarov (@akhrarovsaid)
• Elliot DeNolf (@denolfe)
• Omar (@oasaleh)
• zy1p (@zy1p)

v3.33.0 (2025-04-04)

🚀 Features

• drizzle: export buildQuery and parseParams (#11935) (f34eb22)
• graphql: improve non-nullability in query result types (#11952) (018bdad)
• next: improved lexical richText diffing in version view (#11760) (d29bdfc)
• storage-uploadthing: configurable upload router input config (#11954) (f9c73ad)
• ui: use drag overlay in orderable table (#11959) (816fb28)

🐛 Bug Fixes

• postgres null value breaks orderable hook (#11997) (9adbbde)
• allow custom password field when using disableLocalStrategy: true (#11893) (8ad22eb)
• ValidationError error message when label is a function (#11904) (dc793d1)
• do not append doc input for scheduled publish job if it's enabled only for globals (#11892) (760cfad)
• db-mongodb: querying relationships with where clause as an object with several conditions (#11953) (857e984)
• db-postgres: deleteOne fails when the where query does not resolve to any document (#11632) (4ebd3ce)
• db-postgres: down migration fails because migrationTableExists doesn't check in the current transaction (#11910) (f310c90)
• graphql: respect draft: true when querying joins (#11869) (e5690fc)
• storage-uploadthing: pass clientUploads.routerInputConfig to the handler (#11962) (8e93ad8)
• ui: optimistic rows disappear while form state requests are pending (#11961) (8880d70)

⚡ Performance

• ui: significantly optimize form state component rendering, up to 96% smaller and 75% faster (#11946) (e87521a)

📚 Documentation

• fix invalid markdown (#11996) (f7ed8e9)
• add missing comma (#11976) (e6aad5a)
• fix variable names for lexical markdown conversion (#11963) (06d937e)

📝 Templates

• set packageManager pnpm version for vercel templates (#11992) (b76844d)

🏡 Chores

• fix flake (fae113b)
• plugin-cloud-storage: enable TypeScript strict (#11850) (d47b753)
• plugin-form-builder: enable TypeScript strict (#11929) (a58ff57)
• plugin-nested-docs: enable TypeScript strict (#11930) (fd42ad5)
• plugin-redirects: enable TypeScript strict (#11931) (6c735ef)
• richtext-lexical: add DebugJsxConverterFeature (#10856) (308cb64)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Alessio Gravili (@AlessioGr)
• Tony Tkachenko (@tonytkachenko)
• James (@jmikrut)
• Jacob Fletcher (@jacobsfletch)
• reiv (@reiv)
• Said Akhrarov (@akhrarovsaid)
• Germán Jabloñski (@GermanJablo)

v3.32.0 (2025-04-01)

🚀 Features

• orderable collections (#11452) (d963e6a)
• configurable job queue processing order (LIFO/FIFO), allow sequential execution of jobs (#11897) (c844b4c)
• change version view modifiedOnly default to true (#11794) (21f7ba7)
• db-*: return database name to unsanitized config (#11913) (a083d47)
• db-*: export types from main export (#11914) (a6f7ef8)

🐛 Bug Fixes

• typescriptSchema override required to false (#11941) (968a066)
• support parallel job queue tasks (#11917) (9a1c3cf)
• next: block encoded and escaped open redirects in getSafeRedirect (#11907) (96289bf)
• plugin-cloud-storage: ensure client handlers are added to import map regardless of enabled state (#11880) (98e4db0)
• richtext-lexical: incorrectly hidden fields in drawers due to incorrect permissions handling (#11883) (f34cc63)
• translations: improve Swedish translations for query presets (#11937) (5b0e0ab)
• ui: nested fields disappear when manipulating rows in form state (#11906) (373f6d1)
• ui: switching languages does not update cached client config (#11725) (4a0bc86)
• ui: query presets are available for unrelated collections (#11872) (4fc2eec)
• ui: nested custom components sometimes disappear when queued in form state (#11867) (10ac989)

⚡ Performance

• prefer async fs calls (#11918) (d1c0989)
• ui: download only images and optimize image selection for document edit view, prioritize best-fit size (#11844) (5ae5255)

🛠 Refactors

• drizzle: replace query chaining with dynamic query building (#11923) (9c88af4)
• ui: replace autosave queue pattern with useQueues hook (#11884) (62c4e81)

📚 Documentation

• capitalization error (#11912) (af8c786)
• fix invalid react-hooks docs (#11895) (2b6313e)
• correct spelling of "it" (#11889) (b863fd0)
• fix links in custom components and custom features (#11881) (6b56343)

🧪 Tests

• deflake versions with autosave e2e (#11919) (03d4c5b)
• deflake indexed e2e (#11911) (70b9cab)

📝 Templates

• pin all payload packages, improve gen-templates script (#11841) (59c9fee)

🏡 Chores

• deps: bump mongodb-github-action (#10921) (329cd0b)
• live-preview: enable TypeScript strict (#11840) (6badb5f)
• ui: added selected option as a class to list table cell (#11750) (1578cd2)

🤝 Contributors

• Germán Jabloñski (@GermanJablo)
• Dan Ribbens (@DanRibbens)
• Jacob Fletcher (@jacobsfletch)
• Marcus Forsberg (@marcusforsberg)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Said Akhrarov (@akhrarovsaid)
• Nate Schneider (@nate-at-keen)
• Maxim Seshuk (@maximseshuk)
• Philipp Schneider (@philipp-tailor)
• Pranav (@pranav-vaniya)
• Paul (@paulpopus)

v3.31.0 (2025-03-25)

🚀 Features

Query presets (#11330) (998181b)

Query Presets allow you to save and share filters, columns, and sort orders for your collections. This is useful for reusing common or complex filtering patterns and column configurations across your team. Query Presets are defined on the fly by the users of your app, rather than being hard coded into the Payload Config.

https://github.com/user-attachments/assets/1fe1155e-ae78-4f59-9138-af352762a1d5

• add Armenian translation (#11857) (f61f6b7)

🐛 Bug Fixes

• auth fields distrupt field paths within the field schema map (#11861) (74f935b)
• add uuid fallback for non-secure contexts in JSON fields (#11839) (1081b4a)
• next: adds safe redirect utility and apply to login redirects (#11814) (234df54)
• next: version view breaking for deeply nested tabs, rows and collapsibles (#11808) (3c4b3ee)
• plugin-seo: translation correction (#11817) (6174708)
• richtext-lexical: ensure initial state for nested lexical fields (#11837) (fb01b40)

⚡ Performance

• reduce job queue db calls (#11846) (a5c3aa0)
• drizzle: remove unnecessary db.select call in updateOne operation (#11847) (73fc3c6)

🛠 Refactors

• richtext-lexical: ensure field can be rendered outside EntityVisibilityProvider (#11842) (eb1434e)

🧪 Tests

• rearrange relationships test blocks properly (#11858) (93cc66d)

⚙️ CI

• add license-check script (#11860) (7fb4b13)

🏡 Chores

• admin-bar: enable TypeScript strict (#11834) (8d374cb)
• db-sqlite: enable TypeScript strict (#11831) (fe9317a)
• db-vercel-postgres: enable TypeScript strict (#11833) (de0aaf6)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Diego Satelier (@SatelierDiego)
• Sasha (@r1tsuu)
• Dan Ribbens (@DanRibbens)
• Patrik (@PatrikKozak)
• Germán Jabloñski (@GermanJablo)

v3.30.0 (2025-03-24)

⚠️ Next.js Peer Dependency Bump

This release bumps the peer dependency version of Next.js to 15.2.3 to address a security vulnerability. Next.js Blog post here for more detail. (PR #11823).

NOTE: This vulnerability does not affect any of the functionality of Payload, as the framework does not leverage anything affected in the vulnerability. This would only affect you if you've built additional functionality on top of Payload using additional Next.js middleware.

🚀 Features

• bump minimum next version to 15.2.3 (#11823) (5f6bb92)
• db-mongodb: support sorting by fields in other collections through a relationship field (#11803) (4081953)
• next: add support for custom props on the html element (#11738) (f9f53a6)

🐛 Bug Fixes

• respect draft: true when querying docs for the join field (#11763) (1b2b6a1)
• ui: exclude fields lacking permissions from bulk edit (#11776) (7532c4a)

📚 Documentation

• fix afterErrorHook export name in collection hooks (#11821) (d20f06e)
• fix links to locked document docs (#11770) (85db8ff)
• payload proper nouns (#11792) (5f7202b)

🧪 Tests

• deflakes conditional logic e2e (#11785) (90a08c4)

⚙️ CI

• sanitize breaking section in release notes (b1469ea)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Matthew Crutchfield (@mtcrutch)
• Philipp Schneider (@philipp-tailor)
• Jacob Fletcher (@jacobsfletch)
• Ivica Batinić (@isBatak)

v3.29.0 (2025-03-20)

Important

This release upgrades the lexical dependency from 0.27.1 to 0.28.0.

If you installed lexical manually, update it to 0.28.0. Installing lexical manually is not recommended, as it may break between updates, and our re-exported versions should be used. See the yellow banner box for details.

If you still encounter richtext-lexical errors, do the following, in this order:

1. Delete node_modules
2. Delete your lockfile (e.g. pnpm-lock.json)
3. Reinstall your dependencies (e.g. pnpm install)

---

🚀 Features

• pass i18n through field label and description functions (#11802) (31211e9)
• sort support for payload.update operation (#11769) (20e975b)
• add find to payloadDataLoader to cache local API queries (#11685) (975bbb7)
• distinct error for unverified email login (#11647) (fd99a30)
• aligns user _strategy returned from API (#11701) (8a51fe1)
• form state select (#11689) (9ea8a7a)
• add forceSelect collection / global config property (#11627) (5e3d07b)
• added support for conditional tabs (#8720) (878dc54)
• db-*: support sort in db.updateMany (#11768) (e96d3c8)
• db-*: allow to thread id to create operation data without custom IDs (#11709) (f442d22)
• db-postgres: add vector raw column type (#10422) (11d7487)
• plugin-form-builder: radio field (#11716) (427a5f1)
• richtext-lexical: support escaping markdown characters (#11784) (43cdccd)
• richtext-lexical: upgrade lexical from 0.27.2 to 0.28.0 (#11764) (240730f)
• richtext-lexical: allow disabling TabNode (#11656) (013b515)
• richtext-lexical: upgrade lexical from 0.27.1 to 0.27.2 (#11706) (adb42cb)
• ui: don't trigger preventLeave when opening a new tab (#11683) (398607f)

🐛 Bug Fixes

• add locale support to relationship filter options in WhereBuilder (#11783) (90f2491)
• add locale support to relationship filter options in WhereBuilder (#11783) (39ad31a)
• save button styles in edit-many modal (#11780) (7bc75e2)
• wrap login redirect routes with encodeURIComponent (#11778) (a02e476)
• email format validation with hyphens (#11761) (afe4432)
• improves email validation format rules (#11757) (875afcc)
• field appending on duplicate should ignore non string values (#11621) (74996fd)
• passes id and data to read access func when accessing upload URLs (#11684) (4a712e1)
• bulk upload validation when files are missing (#11744) (ea66e21)
• ensures select & radio field option labels accept JSX elements (#11658) (3c92fbd)
• add classes for picture tag in media component (#11605) (d66cdbd)
• db-mongodb: spread version schema options correctly (#11793) (1d25b16)
• plugin-cloud-storage: s3Storage client uploads working with more than 2 instances of the plugin (#11732) (bb39c87)
• plugin-import-export: export with draft true (#11762) (67a7358)
• plugin-import-export: translated preview labels (#11758) (e83f452)
• plugin-multi-tenant: ensures redirect route is correctly formatted (#11753) (06aa940)
• plugin-multi-tenant: missing key console message (#11693) (3d129e8)
• richtext-lexical: error in admin panel when block collapsed preference is not an array (#11771) (b857273)
• richtext-lexical: error in admin panel when setting a richtext field in useAsTitle (#11707) (ef527fe)
• richtext-lexical: make the toolbar indent button consider the disabledNodes property on IndentFeature (#11739) (dd80f52)
• richtext-lexical: unchecked list items were rendered as checked in html converter (#11747) (3f23160)
• richtext-lexical: remove undefined rel and target attributes in link HTML converter (#11754) (aa3737c)
• ui: adding guard check for populate docs in upload field (#11800) (7d9d067)
• ui: bulk edit subfields (#10035) (b5fc8c6)
• ui: excess error css coming from group fields (#11700) (0fe922e)
• ui: fallback localization data was appearing in document (#11743) (ebfb0eb)
• ui: scheduled publish not displaying the timezone's label and timezones being reset when scheduling a publish, brisbane is now a default timezone (#11699) (e0bf505)
• ui: processing and initializing form does not disable standalone fields (#11714) (0b1a1b5)

⚡ Performance

• use direct db calls in job-queue system (#11489) (032c424)
• download only images and optimize image selection for upload list view, prioritize best-fit size (#11696) (6270d73)
• ui: implements select in bulk edit (#11708) (d8bfb22)

🛠 Refactors

• richtext-lexical: new plaintext and markdown converters, restructure converter docs (#11675) (82840aa)

📚 Documentation

• mention correct --disable-transpile flag (#11788) (6640b1c)
• updates docs for useDocumentInfo (#11686) (ff2df62)

🧪 Tests

• dedicated bulk edit test suite (#11756) (a44a252)

🏡 Chores

• export type FieldAccessArgs (#11749) (f31e5e6)
• bump prettier, re-enable prettier for docs (#11695) (9f9db3f)
• deps: bump next.js from 15.2.2 to 15.2.3 in monorepo (#11748) (95821c6)
• examples: add locale to revalidatePath in Pages hook (#11775) (68f2582)

🤝 Contributors

• Jacob Fletcher (@jacobsfletch)
• Alessio Gravili (@AlessioGr)
• Ainsley Clark (@ainsleyclark)
• Anders Semb Hermansen (@andershermansen)
• Nacho Martin (@nachomglz)
• Jarrod Flesch (@JarrodMFlesch)
• Patrik (@PatrikKozak)
• Terry Yuen (@tyuen)
• Germán Jabloñski (@GermanJablo)
• Dan Ribbens (@DanRibbens)
• Said Akhrarov (@akhrarovsaid)
• Jessica Chowdhury (@JessChowdhury)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• DriesCruyskens (@DriesCruyskens)
• AoiYamada (@AoiYamada)
• Md. Tajmirul Islam Akhand (@Tajmirul)
• Philipp Schneider (@philipp-tailor)
• Tobias Odendahl (@tak-amboss)

v3.28.1 (2025-03-12)

🐛 Bug Fixes

• exclude plugin-cloud-storage, plugin-sentry and plugin-stripe from bundling optimization (#11673) (0fc70e0)
• incorrect height rounding when resizing images with sharp (#11634) (9d6583d)
• incorrect types for field Label, Description and Error server components (#11642) (88eeeaa)
• storage-s3: ensure s3 sockets are cleaned up (#11626) (3f6699f)
• translations: improve Swedish translations (#11654) (7be0219)
• ui: form state infinite render (#11665) (b81358c)
• ui: add RowLabelProvider context for blocks row labels (#11664) (4defa33)
• ui: prevent fieldErrorsToast from showing empty errors list (#11643) (b44603b)

📚 Documentation

• fix invalid ```txt language (#11638) (d14bc44)

🧪 Tests

• deflakes blocks e2e (#11640) (f2abc80)

📝 Templates

• bump Payload and Next.js dependencies (#11641) (c4fd27d)

🏡 Chores

• fix typo (rename mognoose to mongoose) (#11653) (885f580)
• infer React context providers and prefer use (#11669) (355bd12)
• deps: bump next.js from 15.2.1 to 15.2.2 in monorepo (#11636) (9c53a62)
• plugin-multi-tenant: remove SELECT_ALL constant (#11660) (39d783a)
• release: eslint/3.28.0 (bc79608)
• translations: polish Swedish (#11353) (1da50f5)

🤝 Contributors

• Germán Jabloñski (@GermanJablo)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Said Akhrarov (@akhrarovsaid)
• Patrik (@PatrikKozak)
• Marcus Forsberg (@marcusforsberg)
• Jesper We (@JesperWe)

v3.28.0 (2025-03-11)

Important

Compilation Performance Improvements

We’ve introduced a new opt-in flag that can cut Payload’s compile times in half during development. To enable it, add the following to your next.config.js:

const nextConfig = {
  // ...
}

-export default withPayload(nextConfig)
+export default withPayload(nextConfig, { devBundleServerPackages: false })

In some rare cases, you may see unexpected behavior if your project relies on server-only Payload dependencies being bundled during development. Because of this, we’ve made the feature opt-in for existing projects.

Lexical Version Bump

This release upgrades the lexical dependency from 0.21.0 to 0.27.1. Alongside table improvements and bug fixes, this version bump lays the groundwork for frequently requested features like color pickers.

If you installed lexical manually, update it to 0.27.1. Installing lexical manually is not recommended, as it may break between updates, and our re-exported versions should be used. See the yellow banner box for details.

If you still encounter richtext-lexical errors, do the following, in this order:

1. Delete node_modules
2. Delete your lockfile (e.g. pnpm-lock.json)
3. Reinstall your dependencies (e.g. pnpm install)

---

🚀 Features

• defaults to noindex nofollow (#11623) (5285518)
• threads path through field validate function (#11591) (3ede7ab)
• allow specification of which JWT extraction methods are supported, and in which order (#10794) (8f6d2e7)
• db-mongodb: strip keys from the data that don't exist in the schema from read results (#11558) (2ad035f)
• next: fully expose Next.js metadata (#11593) (397c1f1)
• richtext-lexical: allow disabling indentation for specific nodes (#11631) (eb09ce9)
• richtext-lexical: upgrade lexical from 0.21.0 to 0.27.1 (#11564) (557ac99)
• richtext-lexical: adds ability to disable auto link creation (#11563) (1e708bd)
• richtext-lexical: new HTML converter (#11370) (36921bd)
• ui: form state queues (#11579) (ac1e3cf)
• ui: adds disable copy to locale option to collection config (#11546) (657ad20)

🐛 Bug Fixes

• ensure only authenticated users can access the payload-locked-documents collection (#11624) (8f3d1bd)
• upload imageSizes forces original file uploads to be compressed (#11612) (6d0924e)
• add missing auth property to new defaults function (#11561) (3af0468)
• db-mongodb: properly sanitize updateVersion read result (#11589) (e9afb36)
• graphql: sanitize graphql field names for schema generation (#11556) (029cac3)
• plugin-import-export: plugin breaks i18n configuration (#11590) (5d65cb0)
• translations: update translation placeholders to not be translated for lithuanian (#11622) (85f88a0)
• ui: adds fallback locale when defaultLocale is unavailable (#11614) (9ac7a3e)
• ui: stale list thumbnails when navigating (#11609) (fc5876a)
• ui: logic for showing copyToLocale button and adds test (#11584) (a53876d)
• ui: upload.displayPreview should affect all previews in the admin panel (#11496) (6f90d62)
• ui: apply consistent styling to custom & default block thumbnails (#11555) (8378654)
• ui: incorrect error states (#11574) (4811531)

⚡ Performance

• 50% faster compilation speed by skipping bundling of server-only packages during dev (#11594) (c7bb694)

🛠 Refactors

• more reliable import map generation, supporting turbopack and tsconfig basePath (#11618) (243cdb1)

📚 Documentation

• fix documentation about custom i18n types (#11386) (38f61e9)
• document payload migrate:create flags (#11592) (3de1636)

📝 Templates

• fix issue with populateAuthors hook breaking live-preview on website template (#11608) (72efc84)
• allow displaying dynamic error message on forms created via Form Builder plugin (#11275) (814ced4)

⚙️ CI

• adjust paths filter for workflows, only look at main.yml (#11572) (9f7e8f4)
• add canary nightly cron, adjust lock and stale crons (259ea6a)
• use GITHUB_OUTPUT instead of set-output [skip ci] (1ad1de7)
• canary and internal releases [skip ci] (#11565) (1797782)

🏡 Chores

• set all licenses for internal tooling (30af889)
• db-postgres: enable TypeScript strict (#11560) (c8f01e3)
• deps: bump all eslint packages (#11629) (f2da72b)
• deps: bump next.js from 15.2.0 to 15.2.1 in monorepo (#11576) (b0da85d)
• deps: bumps @payloadcms/admin-bar in templates and examples (#11566) (7cef890)
• ui: code/json field full height should include any padding added (#11607) (051c1fe)
• ui: removes margin when row is empty and passes style from props (#11504) (6699844)

🤝 Contributors

• Germán Jabloñski (@GermanJablo)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Rokas Puzonas (@RokasPuzonas)
• Jessica Chowdhury (@JessChowdhury)
• Dan Ribbens (@DanRibbens)
• Jarrod Flesch (@JarrodMFlesch)
• Paul (@paulpopus)
• Sasha (@r1tsuu)
• Md. Tajmirul Islam Akhand (@Tajmirul)
• Elliot DeNolf (@denolfe)
• James Mikrut (@jmikrut)

v3.27.0 (2025-03-05)

🚀 Features

• payload admin bar (#3684) (9724067)
• allow hiding the blockName field visible in blocks' headers via admin.disableBlockName (#11301) (143b6e3)
• threads path through field condition functions (#11528) (ba30d76)
• compound indexes (#11512) (bacc0f0)
• allows overriding import map location (#11532) (f01cfbc)
• plugin-import-export initial work (#10795) (4f822a4)
• ui: improves field error toast messages (#11521) (2163b0f)

🐛 Bug Fixes

• safe auth strategy execution (#11515) (312aa63)
• beforeValidate deleting value when access returns false (#11549) (6939a83)
• collection config deep merge during sanitization causing unpredictable behavior (#11524) (5adb764)
• format admin url inside forgot pw email (#11509) (56dec13)
• next: admin panel fails compiling when fullySpecified is set in next config (#11531) (cc05937)
• richtext-lexical: fix bug in $createAutoLinkNode when the link is preceded by a textnode (#11551) (4ebe673)
• storage-*: client uploads with disablePayloadAccessControl: true (#11530) (5cc0e74)
• storage-gcs: client uploads are enabled even if clientUploads is not set (#11527) (e36ab6a)
• ui: views rendered in drawers can update step nav (#11548) (04b0468)
• ui: execute client upload handler only when file exists (#11538) (31e2179)

📚 Documentation

• remove dead links from client live-preview (#11552) (bbfff30)

🧪 Tests

• add unit tests for getFieldByPath (#11533) (62c0872)

⚙️ CI

• cache mongodb image to avoid rate limiting (#11529) (64b63f6)

🏡 Chores

• cleanup generated configs (#11536) (8f203bb)
• indexes are not iterable, corrects indexes default value sanitization (#11534) (f0ea918)
• add plugin-import-export to publishList release tool (#11535) (672dace)

🤝 Contributors

• Sasha (@r1tsuu)
• Jarrod Flesch (@JarrodMFlesch)
• Jacob Fletcher (@jacobsfletch)
• Paul (@paulpopus)
• Germán Jabloñski (@GermanJablo)
• Said Akhrarov (@akhrarovsaid)
• Patrik (@PatrikKozak)
• Dan Ribbens (@DanRibbens)
• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)

v3.26.0 (2025-03-04)

🚀 Features

• ability to cancel jobs (#11409) (38131ed)
• maintains column state in url (#11387) (3709950)
• db-*: support limit in db.updateMany (#11488) (6a3d58b)
• db-*: add updateMany method to database adapter (#11441) (41c7413)
• richtext-lexical: add htmlToLexical helper (#11479) (cd29978)
• richtext-lexical: add editorConfigFactory helper to streamline getting the editor config (#11467) (e1b3084)
• ui: close the nav when the user navigates away on small screens (#10932) (9bb89b7)

🐛 Bug Fixes

• avif images not converting to upload.formatOptions set file types (#11505) (c417e3a)
• excludes index files from migration files filtering (#10722) (c828e33)
• response headers from authstrategies are now merged together, even if no user was returned (#10883) (45a7c8b)
• ensures req.origin includes port on localhost (#11454) (a65289c)
• ensure errors returned from tasks are properly logged (#11443) (d53f166)
• incorrect value inside beforeValidate field hooks (#11433) (b3e7a9d)
• examples: ensure working multi-tenant example with pg (#11501) (4ddf965)
• examples: replace depreciated 'mergeHeaders' import in the MultiTenant example (#11306) (48e613b)
• next: incorrect active state for partial matches of collection names in sidebar (#11511) (7d2480a)
• next: active nav item not clickable in edit view (#11457) (83b4548)
• next: properly instantiates req.url on localhost (#11455) (67c4a20)
• next: email verification not working due to incorrect token url parsing (#11439) (f3844ee)
• next: disables active nav item (#11434) (c4bc0ae)
• plugin-multi-tenant: scope access constraint to admin collection (#11430) (9c25e7b)
• richtext-lexical: ensure nested forms do not use form element (#11462) (6d8aca5)
• storage-*: ensure client handler is always added to the import map, even if the plugin is disabled (#11438) (dfddee2)
• storage-s3, storage-azure, storage-gcs: client uploads when a collection has prefix configured (#11436) (fc42c40)
• storage-uploadthing: files are duplicated to the storage via client uploads (#11518) (f143d25)
• templates: handle enableLink condition safely (#10728) (f7f5651)
• ui: uses query provider as single source of truth for where builder (#11476) (927078c)
• ui: remove stale thumbnails in bulkUpload after partial success (#10651) (e75d38c)
• ui: bulk editing users throws client-side exception (#11461) (6cbda9e)
• ui: scope rah-static and progress-bar styles to payload-default layer (#11442) (bef98c8)
• ui: use full image url for upload previews instead of thumbnail url (#11435) (96d1d90)
• ui: locale selector in versions view should remove filtered locales (#11447) (9e97319)
• ui: copyToLocale should not pass id in data, throws error in postgres (#11402) (428c133)
• ui: duplicate basePath in Logout Button Link (#11432) (f7b1cd9)
• ui: disable publish button if form is autosaving (#11343) (7118b64)

⚡ Performance

• automatically add index on a relationship field when used as target for a join field (#11463) (90d3c65)
• disable returning of db operations that don't need the return value (#11437) (6ce5e8b)
• db-*: add option to disable returning modified documents in db methods (#11393) (c21dac1)
• db-mongodb: faster join field aggregation by replacing mongoose-aggregate-paginate-v2 with a custom implementation (#10936) (d4d2bf4)
• next: reduce initReq calls from 3 to 1 per page load (#11312) (c8c578f)

📚 Documentation

• clarify that image resizing/cropping require sharp to be specified in payload config (#11470) (d57a786)
• fix documentation "CheckListFeature" (#11480) (b9108b4)
• add few notes about DocumentDB and Azure Cosmos DB (#11336) (25e8799)
• fix method useAllFormFields on admin/hooks.mdx (#10935) (8b5bc3d)
• use local API to upload a local file (#10839) (19b4ec2)
• adds info and example for headersWithCors (#11141) (77395b6)
• custom auth strategy requires the collection slug in return value (#11327) (fcaf591)
• broken ' char entity instead of ' in plugins/build-your-own (#11363) (206b4b9)
• replace HTML entity ' with literal apostrophe (#11321) (8b55e7b)

📝 Templates

• fix vercel website template importmap error caused by missing import (#11500) (562acb7)
• bump payload versions, upgrade next.js to 15.2.0, fix eslint errors (#11486) (f03d450)
• improve naming of richtext component import, add 'payload-richtext' classname (#11485) (398d48a)

⚙️ CI

• change custom github actions target back to es5 (fd1a4f6)
• clarify version reporting in issue templates (#11498) (a15c38f)
• repro guide to use create-payload-app@latest instead of @beta (#11451) (e055565)

🏡 Chores

• add docker volume directories to gitignore (#10902) (fa8a2f8)
• temporarily disables flaky "should execute a custom script" test (#11487) (1929644)
• db-mongodb: tsconfig uses strict: true and noUncheckedIndexedAccess: true (#11444) (79a7b4a)
• deps: bumps payload-admin-bar to v1.0.7 to suppress react 19 warnings (#11499) (bf4fa59)
• eslint: speed up no-imports-from-self rule by ensuring cache is used (#11483) (3774544)
• examples: update multi-tenant example (#11459) (81e8a9d)
• plugin-search: enable TypeScript strict mode (#11508) (efce154)
• richtext-lexical: export LexicalFieldAdminProps (#11464) (dda17f0)
• richtext-lexical: improve UploadData jsdocs (#11292) (4a1b749)
• translations: enable TypeScript strict mode (#11494) (a3fe607)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Germán Jabloñski (@GermanJablo)
• Ondřej Nývlt (@onvlt)
• Jarrod Flesch (@JarrodMFlesch)
• Paul (@paulpopus)
• Jacob Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Vincent Vu (@rubixvi)
• Alessio Gravili (@AlessioGr)
• Dmitrii Kuzmin (@ApplY3D)
• Said Akhrarov (@akhrarovsaid)
• Michael Bykovski (@bykof)
• Mike Newberry (@MikeNewXYZ)
• nomad-dev (@n0mad-d3v)
• Liège Arthur (@Thisisjuke)
• Violet Rosenzweig (@6TELOIV)
• Adrian Maj (@AdrianMaj)
• Jessica Chowdhury (@JessChowdhury)
• Martijn Luyckx (@martijnckx)
• Roy Barber (@roybarber)
• Philipp Meyer (@Quppi)