PayloadCMS releases filter

v3.93.0 (2026-11-04)

⚠️ Contains vital security updates. We encourage updating as soon as possible.

🚀 Features

• add auth.passwordHashIterations for environments that limit PBKDF2 (3.x) (#19074) (488f183)

🐛 Bug Fixes

• enforce block child read access in queries (21bdbbf)
• restrict blocks to each field's configured types (cfa60ea)
• enforce pasteURL restrictions on remote URL uploads (9071e58)
• apply xml response policy to xsl content (50d25f2)
• constrain global view redirects to available tenants (63a3a69)
• preserve shared localized draft changes (3.x backport of #17367) (#17394) (49b3c0b)
• resolve config labels before interpolating them into strings (#19209) (9c37160)
• prevent error in sendEmail due to empty from recepient (#18189) (aaea87b)
• delete the browser upload when a processed client upload replaces it for upload-thing storage (#19012) (8995c00)
• drizzle: lazily load drizzle kit tooling (3.x) (#17660) (d89c7c8)
• next: clamp description param on og endpoint (a56cc64)
• richtext-lexical: escape stored values in HTML converters (bed603f)
• ui: translate document drawer labels (3.x) (#19154) (b4e131c)
• ui: prevent duplicate autosaves from virtual field updates (#19096) (ef1bb73)
• ui: translate the collection label in the create new card button (3.x) (#19116) (04ec212)

⚙️ CI

• skip content api tests for audit deps PRs (3.x) (#19300) (59c52a7)
• port audit-dependencies action to 3.x (#19118) (8bbd52e)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)
• Nate Lentz (@nathanlentz)
• Jake Fletcher (@jacobsfletch)

v3.92.1 (2026-10-27)

🐛 Bug Fixes

• localizeStatus PG migration db.execute signature (#16889) (05f4000)
• upload processed client files from temp file for upload-thing storage (#19010) (ea3778b)
• run the password field's validation on reset password (3.x) (#18980) (779f06f)
• graphql: port virtual fields should be nullable in GraphQL schema (#17256) (1a028cb)
• plugin-cloud-storage: store processed bytes for cropped and mislabeled client uploads (#18913) (6fc83d7)
• storage-vercel-blob: keep the receipt key for processed client uploads with addRandomSuffix (#18921) (f2cbc85)
• storage-vercel-blob: keep image-size filenames separate with addRandomSuffix (#18920) (8282414)
• storage-vercel-blob: upload processed client files from temp file (#18388) (210de57)

📚 Documentation

• clarify development environment security expectations (#18835) (dd19aae)
• update topic order for ui components (#18784) (bd538aa)

🧪 Tests

• email-nodemailer: use a local transport in integration tests (#19022) (5aceaec)

⚙️ CI

• upgrade playwright for ubuntu 26.04 on 3.x (#19071) (12f1d80)
• preview release notes on bump dry run (3.x) (#18981) (8bebfde)
• attach per-package SBOMs to releases (3.x) (#19014) (c42b3f1)
• use ubuntu-26.04 runners (3.x) (#19015) (fd11385)
• approve templates bump PR so auto-merge completes (3.x) (#18992) (8b31ddf)
• reduce releaser log noise (3.x) (#18982) (a574750)
• start only Supabase Postgres for 3.x integration tests (#18976) (ef1b739)

🏡 Chores

• configure coderabbit reviews (3.x) (#18985) (51fd560)
• skills: sync record-pr-demo with main (#19037) (33b9740)

🤝 Contributors

• Sasha (@r1tsuu)
• Jake Fletcher (@jacobsfletch)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Nate Lentz (@nathanlentz)
• Patrik (@PatrikKozak)

v3.92.0 (2026-10-22)

🐛 Bug Fixes

• bump minimum node version to 22.23.4 (#18957) (7440041)
• bump undici to 7.30.1 (3.x) (#18950) (e091098)
• pass document id to field access (#18269) (3165b35)
• set error names explicitly to survive minification (3.x) (#18775) (4173db9)
• validate each locale when writing localized fields with locale all (3.x) (#18500) (8ef7658)
• db-mongodb: support limit 0 in joins across multiple collections (3.x) (#18855) (84483a1)
• drizzle: backport localized polymorphic join filters to 3.x (#18860) (c0bc6f2)
• ui: register the bulk upload success callback every time the drawer opens (#18742) (4a45e3e)

📚 Documentation

• backport internal link and anchor fixes to 3.x (#18849) (4f58ea6)
• explain admin text direction in i18n docs (#18834) (5cd5c51)
• add rewards and recognition section to security policy (3.x) (#18780) (f711f46)

⚙️ CI

• bump templates to the released version on every release (3.x) (#18925) (bf744df)
• pick the release bump from the commits, require a reason to override (3.x) (#18919) (288afc1)
• preserve integration test heap settings (3.x) (#18924) (362748d)
• upgrade pnpm to 11.28.6 (3.x) (#18871) (07afd7f)
• grant cache lookup jobs actions read permission (3.x) (#18866) (6a38177)
• add one-click release flow (3.x) (#18717) (6964415)

🏡 Chores

• skills: backport PR demo recording to 3.x (#18772) (428d26c)

⚠️ BREAKING CHANGES

• bump minimum node version to 22.23.4 (#18957) (7440041)

  Raises the minimum supported Node.js version to 22.23.4, retaining support for Node.js 24.22.1 and newer.

🤝 Contributors

• German Jablonski (@GermanJablo)
• Jake Fletcher (@jacobsfletch)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• Jarrod Flesch (@JarrodMFlesch)
• Sean Zubrickas (@zubricks)
• Nate Lentz (@nathanlentz)

v3.91.0 (2026-10-15)

🚀 Features

• plugin-mcp: add missing properties to find tools, clean up object inputs (#18436) (0f6c5b0)

🐛 Bug Fixes

• return 404 for version operations when versions are disabled (#18057) (d72c669)
• prevent join field where mutation during query validation (#18511) (5060fee)
• bump minimum node version to 20.18.1 (#18467) (fe030c5)
• dev HMR reload not working when Next.js basePath is set (#18485) (f56e92e)
• prevent silent CLI exits (#18398) (1fcb220)
• backport v4 fix to render custom block views on initial load (#18188) (5eb5471)
• save job logs when runHooks is enabled (#18365) (26731e6)
• check draft read access against the latest version in findByID (#18000) (9106bf8)
• drizzle: size sqlite batch inserts by table column count (#17235) (d4c81bb)
• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)
• graphql: backport nested select projections to 3.x (#18366) (231634a)
• plugin-cloud-storage: hide storage metadata from list controls (#18356) (52fadda)
• plugin-import-export: filter disabled export fields (#18434) (b65335c)
• plugin-seo: authorize generation for manual fields (#18428) (451dd68)
• richtext-lexical: handle pasting unsupported blocks (#18368) (3cfa97b)
• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)
• ui: show image thumbnails in folder list view (#17980) (c1569dc)
• ui: preserve default block types when conditions reveal rows (#18299) (2554a34)
• ui: backport activity-aware auth sessions (#17854) (7691ba3)

⚡ Performance

• db-mongodb: reduce referenced block schema memory usage significantly (#18367) (7defbc6)
• drizzle: add _parent_id index to localized tables (#18724) (e3559cd)
• ui: build the client field schema map in linear time for rich text fields (#18697) (000093d)

📚 Documentation

• fix broken rich text link and typos (#18699) (7bf7fb5)
• catalog additional UI components (#18195) (c114379)

⚙️ CI

• add sync-mirror workflow (3.x) (#18561) (3fd91ec)

🏡 Chores

• bump undici to 7.29.1 (#18514) (c1e959f)

⚠️ BREAKING CHANGES

• bump minimum node version to 20.18.1 (#18467) (fe030c5)

  BREAKING: Raises the minimum supported Node.js version. NOTE: Node 18 already had issues, this just bumps the value to be what was functionally true.

• email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)

  If you pass your own transport created with nodemailer 9, upgrade nodemailer to ^10 and remove @types/nodemailer. A transport typed by @types/nodemailer no longer type-checks against the adapter. Runtime behavior does not change.

• storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)

  Breaking: this bumps the minimum node version required by @payloadcms/storage-azure from 20.18.1 to 22.0.0. Due to @azure/storage-blob bumping their min. node version to 22.0.0 in a minor release, we're not able to avoid this change.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Patrik (@PatrikKozak)
• Jake Fletcher (@jacobsfletch)
• toyeshhm (@toyeshhm)
• Apoorv Darshan (@apoorvdarshan)
• Elliot DeNolf (@denolfe)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jessica Rynkar (@JessRynkar)
• Sean Zubrickas (@zubricks)
• Paul (@paulpopus)
• Sasha (@r1tsuu)

v3.90.2 (2026-09-23)

🐛 Bug Fixes

• await slugify func to match type (#18181) (3fad98e)
• next: remove invalid libsql tracing include (#18238) (972a4fb)
• next: support next.config trailingSlash (#18207) (05e49da)
• plugin-cloud-storage: forward alwaysInsertFields when the plugin is enabled (#18222) (f5d261d)
• plugin-mcp: create/update tools crash the MCP endpoint under TypeScript 6 ("use strict" prologue) (#17109) (e6efd70)
• plugin-multi-tenant: avoid refreshing forms without stale tenant cookie (#18245) (a815140)
• ui: prevent client upload handler rerenders (#18184) (b382576)

⚙️ CI

• tune runner memory and scope job token permissions (#18216) (d58f8fb)

🤝 Contributors

• Cody Swartz (@ctsstc)
• Jarrod Flesch (@JarrodMFlesch)
• Lazizbek Ergashev (@lazerg)
• Paul (@paulpopus)
• Jessica Rynkar (@JessRynkar)
• Elliot DeNolf (@denolfe)

v3.90.1 (2026-09-18)

🐛 Bug Fixes

• do not carry parent where queries into nested relationship fields (#18212) (d5ead4b)

🏡 Chores

• bump templates to payload 3.90.0 (#18209) (c8407d0)
• backport telemetry updated to v3 (#18133) (500971d)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)

v3.90.0 (2026-09-18)

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

• Regenerate your payload types: pnpm payload generate:types
• If you are using a relational database, you will need to create and run a migration:

pnpm payload migrate:create <migration-name>
pnpm payload migrate

Password changes now revoke other sessions

• No action needed.

Password reset now clears lockouts; forgot-password is throttled

• Adds new resetPasswordRequestedAt field to user collections

• Action required:

  • Regenerate types: pnpm payload generate:types
  • If using a relational database, perform migration:

pnpm payload migrate:create add-reset-password-requested-at
pnpm payload migrate

Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

• Have publish or unpublish events queued when upgrading.
• Use multiple admin-capable auth collections.
• Queue schedulePublish jobs directly or depend on its generated task types.

Action required:

• Re-create pending scheduled publish and unpublish events after upgrading.
• Update custom queue code to pass user: { relationTo, value } (value is user ID).
• Regenerate committed Payload types if applicable.
• No database migration is required.

Stricter validation for SVG and XML uploads

Affected if you:

• Upload SVG, XHTML, or XML-family files.
• Use direct client uploads, particularly with Azure or a custom integration.
• Depend on path components being retained in new filenames.

Action required:

• Verify affected upload and XML-delivery workflows.
• Ensure custom upload clients send the required metadata and returned headers.
• Set allowRestrictedFileTypes: true in the collections upload property if the previous behavior is explicitly required.

Client uploads hardened across all adapters

Affected if you:

• Use any client upload adapters with clientUploads: true (S3, GCS, Azure, or custom).

Action required:

• If using GCS adapter, add x-goog-if-generation-match header to GCS CORS allowed headers.

Azure containers default to private

Affected if you:

• Use the @payloadcms/storage-azure adapter with allowContainerCreate: true

Action required:

• If you wish to retain the previous behavior, set containerAccess: 'blob' in your Azure storage config.

Client uploads are stored in a per-upload folder

Affected if you:

• Use clientUploads with a storage adapter and access stored files outside Payload (for example, by building paths from prefix and filename)
• Set document prefix values outside the adapter's collection prefix

What changed:

• New client uploads are stored at <prefix>/<_objectKey>/<filename>, including generated image sizes. _objectKey is a new field on upload collections. Existing files are not moved.
• New uploads and replacements are always stored inside the collection prefix. For example, a document prefix of user-123 with collection prefix media is stored under media/user-123/.

Action required:

• Include _objectKey (when set) between the prefix and filename when building storage paths outside Payload.
• If using a relational database, the migration from the "After upgrading" step adds the _objectKey column.

disablePayloadAccessControl no longer disables safe outbound fetch

Affected if you:

• Set disableAccessControl: true in your Payload config.

Action required:

• Configure a narrow upload.skipSafeFetch allowlist for trusted destinations
• Use skipSafeFetch: true only when every URL accepted by the collection is trusted.
• No action is required when files are retrieved from ordinary public endpoints.

External file fetches require a trusted origin

Affected if you:

• Use upload.disableLocalStorage: true and rely on Payload fetching relative URLs whose endpoint requires a Payload session cookie.
• Implement externalFileHeaderFilter, particularly if it assumes it runs only once.
• Use non-HTTP(S) external-file URLs.

Action required:

• Configure serverURL or add the exact application origin to your CORS or CSRF configuration.
• Replace non-HTTP(S) external-file URLs with HTTP(S) URLs.
• Review externalFileHeaderFilter and use the optional context when headers need to vary by destination.

upload: {
  externalFileHeaderFilter: (headers, context) => {
+   if (!context?.isSameOrigin) {
+     delete headers.cookie
+     delete headers.authorization
+   }
+
    return headers
  },
}

Uploaded filename hardening

Affected if you:

• Use a custom top-level prefix field on an upload collection as ordinary application data.
• Change an upload’s storage prefix without also replacing its file.

Action required:

• Rename a custom, non-storage prefix field or update it through trusted server-side code.
• Submit storage-prefix changes as part of a file replacement. Adapter-managed prefix fields do not require migration.

Multipart uploads are now capped at 50MB by default

Affected if you:

• Use multipart uploads and rely on uploads being larger than 50MB

Action required:

• Raise the multipart cap if your application requires support for larger uploads for requests. Adjust the requestSizeLimit in your Payload config:

upload {
+  requestSizeLimit: 75 * 1024 * 1024, // Example 75 MiB for the complete multipart request
}

Form Builder defaults form submission read access to the admin collection

Affected if you:

• Have more than one auth enabled where the secondary auth collections are expected to be able to read either:
  • form-submission docs
  • forms.emails array field

Action required:

• Supply an explicit formSubmissionOverrides.access or formOverrides.access to override the new defaults. If you already have overrides configured, they will continue to be respected.

Stricter where validation for polymorphic joins

Polymorphic joins now apply complete where constraints and throw a QueryError when a filter is unsupported.

Unsupported filters include:

• Localized fields.
• Fields nested inside arrays or blocks.
• Paths traversing relationship, upload, or JSON fields, such as owner.email.
• The near, within, intersects, and all operators.
• The same field path having incompatible definitions across joined collections, such as number in one collection and text in another.

Affected if you:

• Use a join whose collection references multiple collections, and
• Apply an unsupported filter through:
  • A target collection's read access rule.
  • A join where constraint.
  • An Admin baseFilter or baseListFilter used by folder browsing.
• Use folders with folder-enabled collections whose read access or base filters contain one of these unsupported shapes.

Action required:

• Review where constraints and read access rules for every collection referenced by a polymorphic join.
• If using folders, review every folder-enabled collection's read access rules and Admin base filters.
• Rewrite unsupported filters to use direct, compatible fields while preserving the intended access restrictions.

API keys are no longer readable after initial generation through UI or within Payload operations

If you wish to retain old behavior, set the following in your config:

auth: {
-  useAPIKey: true,
+  useAPIKey: {
+    reveal: true,
+  },
 }

Lexical version bump

Full Details

No application changes or data migration are needed when using Payload's built-in rich text features.

If you maintain custom rich text features, check that they still compile and that custom content loads, copies, and pastes correctly. Lexical removed some older APIs, tightened TypeScript types, and changed how custom nodes are loaded and copied. Tests that inspect the editor's HTML may also need updated selectors or snapshots because Lexical adds some internal markup.

Do not install lexical or @lexical/* yourself for use with Payload. Remove any direct dependencies you added for the editor and use Payload's re-exports from @payloadcms/richtext-lexical/lexical and @payloadcms/richtext-lexical/lexical/*. Payload supplies the matching versions; mixing versions can break the editor. This is the existing custom feature requirement.

v3.89.0 (2026-09-10)

🚀 Features

• ui: add warning type to Banner (#17750) (6e5f386)

🐛 Bug Fixes

• avoid buffering large client uploads into memory (#17872) (e896688)
• "No client field found for ..." 500 error in version diff (#18001) (88f0622)
• upgrade next to 16.3.3 across core and templates (#17933) (24164d8)
• db-mongodb: avoid unnecessary aggregation when no joins are selected (#17785) (9a309af)
• drizzle: preserve omitted hasMany selects (#18085) (ee7c00c)
• drizzle: warn on truncated identifiers, throw on collisions (#17650) (52c4d70)
• email-resend: http fetch error handling swallows errors (#17798) (61d3961)
• plugin-form-builder: include autolink nodes in LinkHTMLConverter, v3 backport (#17788) (5061283)
• ui: handle unsupported preview URLs (#18136) (112f419)
• ui: add @swc/helpers direct dependency (#17893) (ec0e98e)
• ui: prevent render loop during rapid title input (#17834) (f954804)
• ui: rich text fields not read-only inside tabs on trashed and locked documents 3.x (#17791) (82f5576)

🛠 Refactors

• improve access defaults for jobs (#17867) (4379bf0)

📚 Documentation

• add UI component library (#18093) (4884195)
• clarify pagination limits (#18095) (2e4806a)
• fix invalid TypeScript examples (#17995) (79fd084)
• add guide for overriding default fields (#17926) (1c0c454)
• fix CLAUDE.md path in agent instructions (#17881) (b48a151)

⚠️ BREAKING CHANGES

• improve access defaults for jobs (#17867) (4379bf0)

  This backports the v4 jobs access changes to Payload v3.

🤝 Contributors

• Paul (@paulpopus)
• Jake Fletcher (@jacobsfletch)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Nate Lentz (@nathanlentz)
• Tyler Schwartz (@tschwartz)
• Fahad Noor (@FahadNoor)
• Anders Semb Hermansen (@andershermansen)
• Patrik (@PatrikKozak)
• Jens Becker (@jhb-dev)
• Dan Ribbens (@DanRibbens)
• Jessica Rynkar (@JessRynkar)

v3.88.0 (2026-08-11)

🐛 Bug Fixes

• prevent multipart content-type backtracking (#17679) (a742140)
• ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#17595) (c6477b8)

🛠 Refactors

• plugin-mcp: better access control defaults for api keys collection (#17751) (025581d)

📝 Templates

• bump next.js to 16.3.0 (#17683) (ee155b7)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Nate Lentz (@nathanlentz)

v3.87.1 (2026-08-06)

🐛 Bug Fixes

• connect to the correct Next.js dev HMR endpoint per version (#17644) (291ac66)
• db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #17609) (#17608) (f039324)
• deps: bump undici (#17630) (9e2c11e)
• plugin-mcp: bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611) (0cb605d)
• richtext-lexical: preserve link drawer form state (#17586) (90fb9e1)
• templates: fix with-cloudflare-d1 build and bump dependencies (#17577) (ca3e899)

📚 Documentation

• update admin panel location link in custom components docs (#17624) (57178e3)

⚙️ CI

• allow changes job to check out repository (#17643) (ec4f979)

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Patrik (@PatrikKozak)

v3.87.0 (2026-07-31)

🚀 Features

• storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#17319) (3c00a39)

🐛 Bug Fixes

• preserve parent localization through tabs 3.x (#17591) (9c8d636)
• replace image-size with image-dimensions dependency for upload dimensions (#17571) (2a99a01)
• forward locale in count and countGlobalVersions (3.x) (#17547) (e042561)
• pass id to delete access control on soft delete in updateByID (#17529) (a539f5b)
• prefer draft titles in by folder view (#17412) (ef8a6a5)
• arrays and blocks should handle null values, v3 backport (#17278) (2a69863)
• db-mongodb: error on null values in arrays and blocks (#17190) (249f8df)
• drizzle: validate companion table name length against 63-char limit (#17563) (fd629f2)
• drizzle: dedupe reused localized block tables (#17430) (3e8191c)
• plugin-multi-tenant: apply tenant on confirm (#17350) (09e01df)
• storage-vercel-blob: allow overwriting existing blob keys (#17385) (fc2572e)
• templates: prevent unauthenticated draft-mode access in website preview route (#17472) (0c2e9a8)
• templates: mark website button as client component for radix-slot context (#17474) (981b282)
• ui: resolve named-tab field permissions in bulk edit field select (3.x backport of #17523) (#17524) (2371624)
• ui: keep folder create drawers open during autosave (#17421) (bf72bda)
• ui: handle undefined field admin components (#17388) (5157c72)

📚 Documentation

• remove deprecated root endpoint property (#17570) (6402daa)
• accessibility banner fix (#17431) (29dd43c)
• fix link in live preview dynamic url section (#17340) (cc81ef0)
• document exported TypeScript type helpers for plugins (#17336) (d4d029f)
• plugin-mcp: fix broken Claude Code link (#17502) (21e24ca)

🧪 Tests

• richtext-lexical: create dev user first in seed to fix flaky e2e (3.x backport of #17507) (#17568) (0f6c1b3)

⚙️ CI

• remove --json from pnpm publish to fix release hang on pnpm v11 (#17279) (4a82c20)

🏡 Chores

• export parse params and related sanitizers (#17314) (f14722a)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Nate Lentz (@nathanlentz)
• Kacper Zawojski (@zawoj)
• Marc Maceira (@marcmaceira)
• Jarrod Flesch (@JarrodMFlesch)
• Sean Zubrickas (@zubricks)
• Raşit Akyol (@rasitakyol)
• Jessica Rynkar (@JessRynkar)
• Elliot DeNolf (@denolfe)

v3.86.0 (2026-07-10)

🚀 Features

• collection-level disableBulkDelete (#17207) (ca02cdc)
• plugin-form-builder: v3 backport to support translations (#17255) (2cde8c8)
• ui: add livePreview.openByDefault config option (#17213) (f23b693)

🐛 Bug Fixes

• coerce schedulePublish doc.value to collection ID type before update (#17238) (7de11b2)
• escape regex metacharacters in isURLAllowed pathname allow-list (#17237) (2061859)
• respect disabled GraphQL config, v3 backport (#17228) (9e9c35a)
• allow access to files reuploaded on a draft (#17209) (f02d22a)
• plugin-multi-tenant: run tenant delete cleanup inside the request transaction (#17175) (d128fde)
• sdk: use qs-esm allowEmptyArrays parameter (#17208) (c7dc68e)
• ui: presentational fields skipped in form state when admin.condition is false (#17224) (f31f26d)
• ui: prevent slug field error tooltip from hiding lock button (#15885) (908fba1)

⚙️ CI

• upgrade pnpm to v11 (#17169) (ca72620)

🤝 Contributors

• Jessica Rynkar (@JessRynkar)
• Ævar Þór Gunnlaugsson (@aevarOrigo)
• Sasha (@r1tsuu)
• Herman Ciechanowiec (@ciechanowiec)
• Vivek Tyagi (@darkspirit2802)
• Noah Bachmann (@noahbachmann)
• Jake Fletcher (@jacobsfletch)
• Amelia (@LimChorngUan)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Jarrod Flesch (@JarrodMFlesch)

v3.85.2 (2026-07-01)

🐛 Bug Fixes

• payload bin fails with tsx on node v23.5+ (#17081) (afb0226)
• regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88)
• prevent type generation script from hanging on storage-r2 (#17020) (b681448)
• prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0)
• db-mongodb: remove duplicate IDs in nested relationship queries (#17019) (8533dfb)
• deps: resolve high severity audit vulnerabilities (#17086) (ac000e5)
• deps: override transitive js-cookie to ^3.0.7 (CVE-2026-46625) (#17000) (ef888de)
• drizzle: preserve failing sub-table on unique-constraint ValidationError (3.x) (#17015) (6dfac53)
• plugin-cloud-storage: split client and server utility exports (#17152) (30bc3fd)
• plugin-cloud-storage: prevent draft file reupload from unpublishing the document (3.x) (#17034) (a18ae22)
• richtext-lexical: preserve hard line breaks on markdown import (#17061) (c0affcb)
• translations: replace Malay strings in Burmese (my) locale (3.x) (#17032) (c3ae01d)
• ui: preserve polymorphic upload bulk select relation (#17112) (9691e42)
• ui: list relationship cell shows (Untitled) for draft-only titles (#16979) (16152e2)
• ui: respect admin.condition on row fields (#16954) (29afa77)

⚙️ CI

• backport test service image pinning to ghcr on 3.x (#17162) (d04d47e)
• reintroduce audit script (#17122) (f76d670)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• German Jablonski (@GermanJablo)
• Amelia (@LimChorngUan)

v3.85.1 (2026-06-09)

🐛 Bug Fixes

• fix draft save and duplicate behaviour on upload-enabled collections (#16853) (fad992c)
• bin scripts cannot import dependencies without explicit "type": "module" (backport) (#16848) (6707e85)
• add type declarations for css export (TypeScript 6 compat) (#16348) (6c81355)
• follow redirects when fetching uploaded files for MIME type detection (#16708) (ac46214)
• plugin-import-export: fix CSV import of arrays and richText nest… (#16923) (ccbdcc2)
• ui: use explicit relative paths for internal SCSS imports v3.x (#16827) (c039e55)
• ui: hide entire tabs field when admin.condition is false (#16809) (79b4e4c)

⚡ Performance

• ui: skip rendering custom components hidden by admin.condition (#16819) (0be11b6)

📚 Documentation

• fixes 404 link to monaco editor options (#16877) (5f40868)
• restructure getting started and concepts pages (#16846) (0f384f4)

⚙️ CI

• restore post-release workflow on 3.x (#16748) (f1861c1)

🤝 Contributors

• Paul (@paulpopus)
• Habeeb (@haxllo)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Anders Semb Hermansen (@andershermansen)
• Elliot DeNolf (@denolfe)

v3.85.0 (2026-05-26)

🚀 Features

• plugin-import-export: out of beta and added support for collection-level and field-level hooks (#16556) (cf9252d)

🐛 Bug Fixes

• bump uuid package to 13.0.2 (#16545) (274af06)
• stop workflows retrying forever when no retries are configured (#16465) (caf9150)
• db-mongodb: bump mongoose to 8.22.1 for GHSA-wpg9-53fq-2r8h (#16688) (4baba91)
• plugin-cloud-storage: propagate custom hook errors during upload (#16632) (055c508)
• plugin-cloud-storage: preserve user-defined prefix.defaultValue (#16529) (8d14915)
• plugin-cloud-storage: dedupe filename in clientUploads signed URL (#16510) (64b2860)
• plugin-multi-tenant: tenant field unselectable in bulk upload "Edit all" (#16466) (695df3c)
• richtext-lexical: cursor kicked out of nested richtext while typing in a block (#16490) (931a349)
• richtext-lexical: drag/drop image into rich text fails when a field name matches the collection slug (#16409) (d6f7b47)
• ui: bulk upload silently counts failed files as saved (#16532) (c31f4ef)
• ui: respect formatDocURL returning null in ListDrawer (#16464) (0facc44)
• ui: show all listSearchableFields in ListDrawer search placeholder (#16467) (3cd4a64)

📚 Documentation

• fix links in admin faq (#16711) (7e4f7af)
• adds relevant videos to docs sections (#16516) (d17298f)

📝 Templates

• bumps next.js to 16.2.6 (#16538) (9b36063)

⚙️ CI

• use postgres 15 for content api tests (#16706) (99d4930)

🏡 Chores

• deps: bump nodemailer minimum version to 8.0.5 (#16664) (efa4afe)

🤝 Contributors

• Sean Zubrickas (@zubricks)
• German Jablonski (@GermanJablo)
• Jake Fletcher (@jacobsfletch)
• Paul (@paulpopus)
• Alessio Gravili (@AlessioGr)

v3.84.1 (2026-04-23)

Retargeting create-payload-app to pull from 3.x branch.

⚙️ CI

• adjust 3.x branch references (#16358) (b6131f7)

🤝 Contributors

• Elliot DeNolf (@denolfe)

v3.84.0 (2026-04-22)

🚀 Features

• allow client components to also be used as custom collection views (#16312) (8fe5f04)
• email-nodemailer: add email recipient override config (#16311) (1c1ed97)
• plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036)
• plugin-form-builder: add support for multi part uploads (#15268) (aa01a45)
• plugin-mcp: add support for server instructions (#15858) (c852d85)

🐛 Bug Fixes

• unique value errors are not displayed properly for localized fields (#16069) (f6e9073)
• correct slugifyTitle hook example in documentation (#16306) (48db8c1)
• handle multipart uploads without content-length (#16301) (c150ef8)
• plugin-ecommerce: verify PaymentIntent succeeded before creating… (#15902) (500e39d)
• richtext-lexical: internal links export as text in markdown transformer (#16302) (3dc6041)
• storage-*: simplify key handling for signed urls and composite prefixes (#16291) (6139508)
• templates: remove tilde SCSS imports and add Sass loadPaths for Windows (#16295) (7ca8b05)
• ui: json and richText fields expose unsupported operators in WhereBuilder (#16353) (a507fcc)
• ui: bulk edit ignores fields in named tabs and shows incorrect labels for unlabeled containers (#16340) (e5bc6be)

📚 Documentation

• add publishing access control example (#16021) (da17810)

🧪 Tests

• add tests for autosave creating new versions and losing draft status on reload (#16335) (60d8678)
• add more integration tests to CI (#15419) (8a470c1)

📝 Templates

• bump plugin template to latest payload version (#16305) (9de13c2)

⚙️ CI

• disable audit-dependencies slack notification (#16329) (eeee018)
• use SLACK_CHANNEL env var for activity notifications (#16323) (a7cc58b)
• use artifacts for e2e prep so job retries don't fail on cache eviction (#16310) (bc590bd)

🏡 Chores

• change other instances of port 3000 being hardcoded in tests (#16290) (7f0b069)
• templates: fix link to one-click deployment (#16337) (5a39afc)
• templates: strengthen types in preview url gen (#14947) (fcbc987)
• templates: remove unused image-3 from website templates (#16155) (f0735b1)

🤝 Contributors

• Patrik (@PatrikKozak)
• Sasha (@r1tsuu)
• Jake Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)
• Marcin Gierada (@teastudiopl)
• Anton Ambarov (@AntonAmbarov)
• Paul (@paulpopus)
• Jens Becker (@jhb-dev)
• Neha Prasad (@nehaaprasad)
• Jarrod Flesch (@JarrodMFlesch)

v3.83.0 (2026-04-15)

🚀 Features

• expand plugin API (#16247) (54189e1)
• add profiling utilities for performance analysis (#16198) (9391c20)
• add internal plugin priority and slug api for cross-plugin discovery (#16244) (5f5694f)
• hide slug field buttons when field is read-only (#14824) (67c2c47)
• cpa: add --agent flag for coding agent skill installation (#16278) (9f9f343)
• drizzle: add uuidv7 support (#16113) (ac01e82)
• email-resend: add Custom headers for the Resend adapter (#15645) (a7dd17c)
• next: add support for custom collection views (#16243) (835a0ad)
• plugin-form-builder: change checkbox label from 'Default Value' to 'Checked by default' (#15229) (b3d2054)
• plugin-mcp: allow external plugins to extend mcp plugin (#16245) (ac4fc31)
• richtext-lexical: add view override system for custom node rendering (#14244) (1ef43eb)
• storage-*: add useCompositePrefixes option and fix client upload prefix handling (#16230) (74aa825)

---

Expanded Plugin API — New definePlugin helper introduces opt-in execution ordering, cross-plugin discovery via a slug-keyed plugins map, and module augmentation for type-safe plugin options. The existing (config) => config contract remains unchanged. #16247

import { definePlugin } from 'payload'

export const seoPlugin = definePlugin<SEOPluginOptions>({
  slug: 'plugin-seo',
  order: 10,
  plugin: ({ config, plugins, collections, generateTitle }) => ({
    ...config,
    // collections and generateTitle come from SEOPluginOptions
  }),
})

Profiling Utilities — Lightweight timeSync and timeAsync wrappers for measuring function execution time during development. Wrap any function to capture its duration, then call printProfileResults for a formatted timing table. Not intended for production use. #16198

Internal Plugin Priority & Slug API — Plugins can now attach priority, slug, and options properties for execution ordering and cross-plugin discovery. Lower priority runs first; other plugins can find each other by slug via config.plugins without imports. Marked @internal for now. #16244

Hidden Slug Field Buttons on Read-Only — The Generate and Lock/Unlock buttons on slug fields are now automatically hidden when the field is read-only, removing controls that serve no purpose in that state. #14824

Agent Flag for CPA (cpa) — create-payload-app now supports a --agent / -a flag (claude, codex, cursor) that downloads the Payload coding skill from GitHub and installs it in the correct directory for your agent. A root-level CLAUDE.md or AGENTS.md is written for discoverability. Use --no-agent to skip. #16278

<img width="514" height="386" alt="CPA agent selection prompt" src="https://github.com/user-attachments/assets/c5bc9e68-0c02-4881-ae6c-957e465e9f96" />

UUIDv7 Support (drizzle) — New idType: 'uuidv7' option for Postgres and SQLite adapters generates time-ordered UUIDs that are friendlier for B-tree indexes than random v4 UUIDs, while using the same storage column type. IDs are generated in application code so older Postgres versions are supported. #16113

Custom Email Headers (email-resend) — The Resend adapter now passes custom headers from sendEmail options to the Resend API, enabling features like List-Unsubscribe headers that were previously silently dropped. #15645

await payload.sendEmail({
  from: "Test <test@domain.com>",
  to: "jimmybillbob@example.com",
  subject: "Email with custom headers",
  html: html,
  headers: {
    "List-Unsubscribe": "<https://domain.com/unsubscribe>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
  },
});

Custom Collection Views (next) — Register custom views at the collection level via admin.components.views[key] with a Component and path. Folders take routing precedence over custom views on upload collections. #16243

{
  slug: 'products',
  admin: {
    components: {
      views: {
        grid: {
          Component: '/components/GridView',
          path: '/grid',
          exact: true,
        },
      },
    },
  },
}

Checkbox Label Clarity (plugin-form-builder) — The form builder checkbox field label was changed from "Default Value" to "Checked by default" to eliminate confusion about whether the checkbox toggles a default value or sets the initial checked state. #15229

Extensible MCP Plugin (plugin-mcp) — External plugins can now extend plugin-mcp by finding it via slug in config.plugins and injecting custom MCP tools into its options. Also exports the MCPPluginConfig type for type-safe tool injection. #16245

View Override System for Custom Node Rendering (richtext-lexical) — ⚠️ Experimental. Override how any Lexical node type is rendered in the editor via view maps. Supports custom DOM, React components, or HTML strings. Works in both the admin editor and frontend JSX serialization for WYSIWYG consistency. #14244

export const myViews: LexicalEditorViewMap = {
  default: {
    heading: {
      createDOM() {
        const h2 = document.createElement('h2')
        h2.textContent = 'Custom Heading'
        return h2
      },
    },
    horizontalRule: {
      Component: () => <div className="custom-hr">---</div>,
    },
    link: {
      html: '<a href="#">Custom Link</a>',
    },
  },
}

{
  fields: [
    {
      name: 'content',
      type: 'richText',
      editor: lexicalEditor({
        views: '/path/to/views.tsx#myViews',
      }),
    },
  ]
}

Composite Prefixes for Storage Adapters (storage-*) — New useCompositePrefixes option combines collection and document prefixes instead of one overriding the other. Also fixes a bug where client uploads ignored document prefix entirely. Applies to S3, Azure, GCS, R2, and Vercel Blob. #16230

| Mode | Collection Prefix | Doc Prefix | Result | |------|------------------|------------|--------| | false (default) | media-folder | user-123 | user-123/file.jpg | | true | media-folder | user-123 | media-folder/user-123/file.jpg |

🐛 Bug Fixes

• restore falling back to current document values for undefined fields (#16272) (4b4d61c)
• enforce mimeTypes restriction when useTempFiles is enabled (#16255) (bb749a5)
• prevent cron from permanently dying after handler errors (#16219) (c5e0e02)
• use safe property assignment in deepMergeSimple (#16271) (2b23010)
• handle concurrent autosave write conflicts gracefully (#16216) (e8502fa)
• use instanceof instead of constructor name in formatErrors (#16089) (216d162)
• parse JSON string where query param (#15745) (2a26b5a)
• expose type for field's position (#14390) (d9b3c07)
• default virtual fields to readOnly in admin UI (#16016) (72396f6)
• localized array,group,blocks fields duplicate with empty values (#15849) (067e14f)
• fixes importMap type in monorepo usage (#15203) (79f4cc7)
• db-postgres: bump drizzle-orm to 0.45.2 to resolve an SQL injection vulnerability and pg to 8.20.0 (#16168) (af1a932)
• drizzle: surface connection errors in beginTransaction instead of hanging forever (#16220) (1e1c591)
• drizzle: ensure getPrimaryDb is used for all write operations (#16240) (aa44649)
• email-resend: support path and preserve base64 content in mapAttachments (#16094) (57e71f5)
• next: persist language cookie across browser sessions (#15081) (0acff80)
• plugin-ecommerce: price not showing as 0 when explicitly set (#16289) (62aa42b)
• plugin-ecommerce: priceInput does not respect required field status (#15783) (ed1c874)
• plugin-import-export: hide invalid sortBy options (#11676) (9d6bf0b)
• plugin-search: serialize reindexing to prevent locale data race conditions (#15917) (79d1b6b)
• plugin-seo,richtext-lexical: add missing translations (#11859) (da27afc)
• plugin-stripe: supports webhooks within serverless environments (#10890) (4179bf3)
• translations: 'noResults' translation expected a singular label, rewrite sentence sine a plural label is injected. (#13360) (cb0ce1c)
• translations: modified Spanish translations to be gender neutral (#15796) (a00267d)
• translations: fall back to base language tag for Accept-Language matching (#15076) (cf95cad)
• ui: usePreventLeave default message (#15042) (8de32a2)
• ui: use i18n for live preview "Open in new window" tooltip (#16038) (173b453)
• ui: preselect folder when bulk uploading from inside a folder (#16030) (71a6c60)
• ui: prevent NaN aspect ratio in createThumbnail on svg files (#10488) (b332bff)
• ui: thread cache tag to list view thumbnails (#11741) (5afcef5)

⚡ Performance

• plugin-mcp: minify JSON in MCP tool responses (#15598) (976369d)

🛠 Refactors

• simplify storage adapter handler pattern (#16231) (6690769)
• clean up dead code and minor bugs in job queue system (#16234) (e49c224)

📚 Documentation

• documents upload node markdown placeholder (#16135) (a9b0ca7)
• change import to use type import for GlobalConfig (#11578) (289e2b6)

🧪 Tests

• remove debug console.log left in SlugField overrides fields test suite (#16279) (22e2466)
• plugin-multi-tenant: verify that tenant selector respects access control (#14916) (0516803)

📝 Templates

• bump payload and next.js versions (#16229) (2b10973)

📓 Examples

• add Dockerfile to Remix (#11429) (e34cbc3)

⚙️ CI

• consolidate docker service startup into start-services action (#16277) (4912005)
• make build cache restore resilient to eviction (#16275) (d1837ad)
• update actions to resolve Node.js 20 deprecation warnings (#16267) (04163ea)
• run e2e tests using turbopack (#16237) (3a7c9f3)

🏡 Chores

• allow e2e port to be defined by env vars (#16285) (cb97614)
• mark the plugin API as experimental (#16276) (56325ef)
• increase test summary script suite timeout to 120 seconds (#16264) (59f78f0)
• update deprecated VS code rules (#16185) (359dc94)
• templates: fix postgres volume (#15157) (b44135e)
• templates: wrong links to Draft Preview Example (#13053) (a2dee84)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Paul (@paulpopus)
• Philipp Schneider (@philipp-tailor)
• Riley Langbein (@rilrom)
• Patrik (@PatrikKozak)
• Ran (@eddieran)
• Alessio Gravili (@AlessioGr)
• Jens Becker (@jhb-dev)
• Ruben Hutter (@ruben-hutter)
• German Jablonski (@GermanJablo)
• Sean Zubrickas (@zubricks)
• Muhammad Aqib (@aqib-io)
• Jarrod Flesch (@JarrodMFlesch)
• Bob Bass (@robertjbass)
• Said Akhrarov (@akhrarovsaid)
• Mahmoud Hamdy (@mahmoodhamdi)
• fdurackbrooks (@fdurackbrooks)
• Jake Fletcher (@jacobsfletch)
• David Murdoch (@dsm23)
• Ossaid (@ossaidqadri)
• Adrian Maj (@AdrianMaj)
• Thijs Marinussen (@ThijsAtFreave)
• roboin (@Robot-Inventor)
• Jeremías Benitez (@jerebenitez)
• Sebastian Blank (@blankse)
• Sasha (@r1tsuu)
• Yaniv (@y4aniv)
• Marwin Hormiz (@marwinhormiz)
• Jeffery To (@jefferyto)
• Roman Ryzhikov (@yagee)
• Hugo Duarte (@hugomeduarte)
• Boyan Bratvanov (@bratvanov)
• jakobpevec (@jakobpevec)
• Siim Sams (@siimsams)
• W1ckh3ad (@W1ckh3ad)
• Shane Friedman (@smoores-dev)
• Marius (@MariusMatu)
• guoyangzhen (@guoyangzhen)

v3.82.1 (2026-04-09)

🐛 Bug Fixes

• next: use correct config key for disabling turbo server fast refresh (#16215) (11adc9d)
• plugin-nested-docs: await populateBreadcrumbs in resaveChildren (#15582) (0554b50)

⚡ Performance

• storage-s3: avoid getObject call if ETag matches (#15295) (7ccc3f0)

📚 Documentation

• fix incorrect select syntax example in querying docs (#14590) (be6c443)

📝 Templates

• bump to 3.82.0, remove --no-server-fast-refresh flag (#16212) (79c8d7e)

🤝 Contributors

• William Ding (@wingding12)
• Syazwan (@syazwanz)
• Alessio Gravili (@AlessioGr)
• Anders Semb Hermansen (@andershermansen)

v3.82.0 (2026-04-08)

🚀 Features

• disambiguate media files by prefix via query parameter (#15844) (05ddec1)
• add missing disableErrors to globals findOne operation (#14913) (c8332e7)
• improve default slugify utility by triming whitespace first (#14421) (fdaa051)
• add typescript.postProcess hook for type generation (#16103) (67b5dc3)
• plugin-redirects: add Portuguese translation (#15269) (122f4c1)
• plugin-search: pass collection slug to beforeSync hook (#11581) (ebbd6ad)
• ui: export drag-and-drop components (#12626) (23b0f1b)

🐛 Bug Fixes

• incorrect 24 hour format comment example (#15649) (f42b767)
• resolve 404/500 error when downloading files containing hash in filename (#15799) (3a09387)
• JSDoc string for focalPoint option in uploads so it correctly mentions defaults to true (#13070) (84090ac)
• skip validation for unpublish operations with localized required fields (#16120) (24b9e13)
• skip default validation for virtual fields (#16015) (e09c619)
• db-mongodb: update mongoose-paginate-v2 to fix collation pagination (#16049) (78a27ab)
• drizzle: convert equals/not_equals to in/not_in for hasMany relationship array values (#15766) (59af156)
• next: fix hmr, bump minimum required next.js 16 version to 16.2.2 (#16202) (7f83571)
• next: admin.meta.title object form renders [object Object] in browser tab (#16117) (0981cdc)
• plugin-mcp: add error handling to convertCollectionSchemaToZod (#16114) (6184b0c)
• plugin-multi-tenant: infinite api calling loop on user switch (#16065) (3da805f)
• storage-*: redundant re-uploads when file was already uploaded by the client and add comprehensive E2E tests for s3 and vercel-blob (#16115) (a6735f3)
• storage-azure: fix azure storage mime type handling for streaming uploads (#15949) (cd7fcea)
• templates: tailwind file extension is wrong in website template components.json file (#9342) (2011f28)
• templates: fixed forgot password link (#15037) (b505e36)
• templates: add generated files to ESLint ignores (#15716) (941a41f)
• templates: typo in with-cloudflare-d1 template (#14243) (14b708f)
• translations: fix Swedish unpublish translations and capitalization (#15353) (4e48706)
• translations: correct French translation for 'move' action (#14771) (750d29f)
• translations: update passive voice and newLabel wording in zh-TW translations (#13761) (e284ab5)
• translations: update Japanese translations related to localizeStatus (#15358) (7ab2881)
• ui: relationship filter duplicate options when switching operators (#16204) (3a1f31a)
• ui: unpublish button missing for globals and version count incorrectly incrementing after unpublish (#16203) (1ddeb60)
• ui: exclude unnamed tab labels from filter and groupBy field options (#9965) (b13c5c9)
• ui: update node to v20 (#15717) (b2593d6)
• ui: radio fields do not reliably trigger admin.condition re-evaluation on sibling fields (#16056) (7e2a126)

⚡ Performance

• skip validation for default timezones (#16129) (76f3693)

🛠 Refactors

• plugin-seo: rename non-JSX files from .tsx to .ts (#14418) (b67882c)
• translations: improve German translations for consistency and accuracy (#14439) (f3c0bc8)

📚 Documentation

• fix typo in Collection Config docs (collection → collections) (#16183) (ac085cd)
• remove JSX comment from content in dashboard (#16156) (05447b7)
• add warning about Cosmos dB incompatibility (#13350) (c4375bd)
• add info about custom errors via APIError to hooks overview (#13047) (d03054e)
• fix typo in storage-adapters documentation (#13648) (911f059)
• rename incorrect usage of the cloud storage plugin to align with the imported module in storage-adapters.mdx (#11475) (d491f29)
• add dev note about auth strategy hot-reload requirement (#14122) (c4da453)
• fix anchor link reference for settingsMenu (#14391) (8c748d6)
• nested plugin (#15230) (2e653ae)
• add getDataByPath to useForm table (#12098) (69a49e7)
• add missing comma to seo plugin doc (#11516) (df03ed0)
• fix typo in ecommerce template link in seo plugin docs (#15641) (e2cd07c)
• corrects Local API example in import export docs (#16128) (13a726a)
• update link to Custom Components Performance docs (#15723) (9141e34)
• update folders documentation with the right property (#14060) (b63198d)

📝 Templates

• fix tailwind typography config so that it works better with shadcn CLI (#16209) (4931458)

🏡 Chores

• upgrade vitest and @vitest/ui to 4.1.2 (#16154) (5af591c)
• export FieldAccessArgs from payload (#14755) (c3ec73f)
• extract sanitizeField from sanitizeFields (#16133) (b705af4)
• improve int summary counts when content-api is unavailable (#16127) (a65e715)
• add React component file structure conventions to CLAUDE.md (#16125) (9284441)
• richtext-lexical: improve Swedish translations (#15273) (ac16116)
• templates: add type detection on getGlobal utility (#11617) (b278a17)
• templates: remove redundant condition check (#12130) (cf0a883)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Maxim Seshuk (@maximseshuk)
• Paul (@paulpopus)
• Jens Becker (@jhb-dev)
• JianJroh (@JianJroh)
• Pierre Cabrière (@pierrecabriere)
• Tyler Schwartz (@tschwartz)
• Jarrod Flesch (@JarrodMFlesch)
• Patrik (@PatrikKozak)
• Mohsen (@webgodo)
• German Jablonski (@GermanJablo)
• Anders Semb Hermansen (@andershermansen)
• Marcus Forsberg (@marcusforsberg)
• Sasha Rakhmatulin (@r1tsuu)
• Said Akhrarov (@akhrarovsaid)
• marketsystems (@marketsystems)
• Eduardo Würch (@ewurch)
• Matthieu (@RibeyrollesMatthieu)
• Riley Langbein (@rilrom)
• Matthew DeAbreu (@mdeabreu)
• Tim @ erdee (@tim-at-erdee)
• José Eduardo Dias (@josedudias)
• Rot4tion (@Rot4tion)
• Adebayo Ajayi (@Braggedtooth)
• Christian Wesselhoeft (@xtian)
• ab192130 (@ab192130)
• MichalKormanik (@MichalKormanik)
• Yi Chi (@chiyi4488)
• swenzel-arc (@swenzel-arc)
• roboin (@Robot-Inventor)
• Wes DiMiceli (@wesdimiceli)
• codeflorist (@codeflorist)
• Vincent Vu (@rubixvi)
• Ilham Saputrajati (@ilhamsj)
• Boyan Bratvanov (@bratvanov)
• Roman Ryzhikov (@yagee)
• spiner2000 (@spiner2000)
• Sean Zubrickas (@zubricks)
• Sebastian Blank (@blankse)
• Max Malm (@benjick)
• Omar Yusuf Abdi (@omar-y-abdi)
• Shaun Wallace (@ShaunMWallace)

v3.81.0 (2026-04-01)

🚀 Features

• add LLM eval suite for Payload conventions and code generation (#15710) (db4b00e)
• next: prevent admin panel errors when cacheComponents is enabled (#16020) (1ecd7dd)

🐛 Bug Fixes

• update file-type, ajv and jose packages (#16118) (d09ed54)
• add field-level access control to internal auth fields (#16119) (4ae5577)
• where querying by a join field with relationship nested to an array (#16101) (0f79eed)
• trashed documents still show as IDs in relationship responses (#16102) (aa143e6)
• db-mongodb: virtual fields within blocks (#16107) (77cdb17)
• db-postgres: stabilize read replicas support (#16083) (46ddf8d)
• db-postgres: handle blockType filters for versions (#16071) (727d74e)
• deps: resolve high severity audit vulnerabilities (#16104) (c5a3767)
• next: respect canAccessAdmin when a custom dashboard view is configured (#16105) (329090c)
• next: forgot password basePath was not respected (#16084) (3c40241)
• plugin-multi-tenant: forbidden error when logging in as a user with no tenant and no access to all tenants (#16047) (9c58e7c)
• richtext-lexical: prevent invalid h0 heading nodes when all heading sizes are disabled (#16090) (185548a)
• sdk: pass trash to request (#16092) (e0b3e81)
• storage-gcs: bump @google-cloud/storage (#16046) (5c06266)
• storage-vercel-blob: properly handle alwaysInsertFields and add comprehensive integration test suite with a vercel blob emulator (#16080) (8530b45)
• templates: add --no-server-fast-refresh to all dev scripts for Next.js 16.2+ compatibility (#16074) (8045887)
• ui: prevent data loss in copy-to-locale with drafts (#16073) (43b8de6)
• ui: tokenInMemory not set after refreshing cookie (#15928) (17266ab)
• ui: respect admin.dateFormat for list view filters (#16040) (d5fe0ce)

🛠 Refactors

• ui: live preview iframe loader (#16004) (167a01e)

📚 Documentation

• clarify unique field index behavior and add warnings for array/blocks nesting (#15969) (38c1d4d)
• document ListViewServerProps/ClientProps and custom list view component patterns (#15970) (eb3b227)
• adds code examples for how to fully implement textStateFeature (#16053) (80ae745)

🧪 Tests

• add defaultSort join field property integration tests (#16057) (b2a8917)

📝 Templates

• fix broken images on Next.js 16 by using relative paths for local media (#16058) (1a0f4d0)
• bump to Next.js 16.2.1 (#16032) (5c3244f)

⚙️ CI

• fix localstack startup (#16048) (0d15620)

🏡 Chores

• claude: update audit-dependencies skill with lockfile strategy and override rules (#16106) (974870a)
• deps: bump qs-esm from 7.0.2 to 8.0.1 (#16110) (d6862fe)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Jarrod Flesch (@JarrodMFlesch)
• angus-msquared (@angus-msquared)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Jake Fletcher (@jacobsfletch)
• Mahmoud Hamdy (@mahmoodhamdi)
• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Nathan Bo Wang (@nathanbowang)
• Jon Bockhorst (@jmbockhorst)
• Daniel Giljam (@DanielGiljam)
• Kendell (@kendelljoseph)

v3.80.0 (2026-03-20)

🚀 Features

• add disableUnique property to the slug field for better multi tenant plugin support (#15963) (395e1ed)

🐛 Bug Fixes

• unpublish updates existing version instead of creating a new one (#15985) (67063ab)
• use latest draft version data when trashing unpublished documents (#15981) (57a0edc)
• db-mongodb: fix pagination with collation in transactions (#15990) (5c935aa)
• db-postgres: near query can give incorrect results (#15907) (843306c)
• db-sqlite: scheduled publish does not show upcoming events because of wrong nested json querying (#15911) (3fa834a)
• deps: resolve high severity audit vulnerabilities (#15961) (da212fd)
• drizzle: pagination applied incorrectly when sorting by a field inside an array field (#15908) (0f67215)
• drizzle: groups inside localized tabs are not working correctly (#15936) (57bde77)
• graphql: force nullable for relationships to avoid errors when the related document is related (#15915) (560cabe)
• plugin-mcp: plugin can break next.js request handler because underlying Hono library modifies the global Request object (#15938) (4cfa495)
• plugin-multi-tenant: modal container blocks clicks on create-first-user page (#15973) (8157f4c)
• richtext-lexical: richtext fields don't respect RTL direction for Arabic and other RTL locales (#15964) (944a889)
• ui: defer live preview iframe rendering (#15999) (9999083)
• ui: stale data modal shown when onChange starts while save is in-flight (#15960) (dc98f0f)

📚 Documentation

• add custom admin location docs (#15581) (04a4b0a)
• updating lexical richtext fields (#15968) (8e5d56d)
• add copy and paste documentation for blocks (#15987) (747be91)
• warning for numeric field names (#15966) (99dcac1)
• storage adapters improvements (#15946) (9815d83)

📝 Templates

• bump templates to Next.js 16.2.0 (#16003) (4e34130)

⚙️ CI

• add audit-dependencies claude skill (#15967) (5efc2ff)

🏡 Chores

• add docker:clean script and fix docker:start reliability (#16000) (2646018)
• bump monorepo Next.js version to 16.2.0 (#15992) (a188556)
• consolidate docker scripts into single docker-compose with profiles (#15974) (f89e736)
• examples: update astro package.json name (#15118) (4e1c04e)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Jake Fletcher (@jacobsfletch)
• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Sean Zubrickas (@zubricks)
• Riley Langbein (@rilrom)
• Elliot DeNolf (@denolfe)

v3.79.1 (2026-03-16)

🐛 Bug Fixes

• text field validation rejecting localized object values (#15932) (fac59c8)
• use Sec-Fetch-Site header for cookie authentication validation (#15751) (ef507a6)
• improved request origin retrieval (#15919) (f30d34f)
• generate:types inlines all blocks, add forceInlineBlocks property to use in plugin mcp (#15892) (6a9e367)
• update broken custom components docs link in config types jsdoc (#15794) (17aa1b5)
• run sanitizeWhereQuery for join query access result (#15891) (dc049fe)
• early return out of me access (#15883) (c6054c5)
• scope orderable join reordering by parent relation (#15842) (17a0d19)
• stricter input validation (#15868) (e474205)
• drizzle: avoid ts errors for payload generate:db-schema with circular references (#15895) (66a2efa)
• drizzle: error when using contains operator on hasMany select fields (#15865) (fba2438)
• drizzle: correctly apply query limit on polymorphic joins (#15652) (fe36dde)
• plugin-import-export: add space in zh translation for exportDocu… (#15833) (43d5596)
• plugin-mcp: bump @modelcontextprotocol/sdk from 1.25.2 to 1.27.1 (#15942) (94d2249)
• storage-azure: add stream aborts for error handling and connection closure (#15768) (b2a03c9)
• ui: stale data modal incorrectly shown when user saves their own document (#15933) (a5d9388)
• ui: copy & pasting block content duplicates array items in editor UI (#15941) (9bcedc8)
• ui: deleted array item reappears after reorder with autosave (#15906) (752c15a)
• ui: use consistent empty state styling in relationship table (#15914) (93b90da)
• ui: clicking filtered Combobox entries fails to trigger selection (#15788) (de3e5ae)
• ui: document status shows changed after publishing specific locale (#15765) (b95df0b)
• ui: split only on first colon in toast error messages (#15894) (fd64504)
• ui: block clipboard paste causes duplicate ID errors in Postgres (#15863) (e7d6331)
• ui: monomorphic relationship fields don't support multi-select with in/not_in operators (#15886) (f71ef61)
• ui: equal column widths for block-drawer blocks (#15867) (07f7802)
• ui: isolate join table column preferences from list view (#15846) (649f117)
• ui: falling back to UTC timezones in timezone picker (#15841) (70099b7)

⚡ Performance

• richtext-lexical: 3-15x less main thread blocking via centralized toolbar state (#15832) (2bdf7ce)

📚 Documentation

• correct type name in editMenuItems client component example (#15904) (03b20d0)
• adds req to available args and wraps examples with proper String type conversions in nested-docs (#15931) (d2a0740)
• adds docs for logger config (#15927) (46e43fc)
• fix links to virtual relationship documentation in both Blocks and Array field documentation (#15888) (fff60c8)
• broken anchor link in blocks field table (#15887) (36c051a)
• examples: clarify MongoDB prerequisites in Mongo-backed examples (#15860) (2aa973f)
• plugin-mcp: updates MCP plugin documentation (#15729) (b97b4e7)

🧪 Tests

• adjust total test count to exclude todo tests in summary output (#15943) (e46daec)
• fixes pagination and sorting list-view tests due to hydration timing issues (#15925) (b0f00c4)
• flaky timeout when clicking Create New button in versions test suite (#15850) (3fb10e1)

🏡 Chores

• bump next.js canary in monorepo (#15900) (62f2b7c)

🤝 Contributors

• Jessica Rynkar (@JessRynkar)
• Patrik (@PatrikKozak)
• German Jablonski (@GermanJablo)
• Copilot (@Copilot)
• Leon Gattermayer (@LeonGatt)
• Omar Yusuf Abdi (@omar-y-abdi)
• Sean Zubrickas (@zubricks)
• Eduardo Costa (@ed-cscosta)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Seiya (@silmin)
• Maxim Seshuk (@maximseshuk)
• Kendell (@kendelljoseph)
• Divyam gupta (@divyamdotfoo)
• deepshekhardas (@deepshekhardas)
• Paul (@paulpopus)
• zzz1220 (@zzz1220)
• Mikko Vänskä (@vanska)

v3.79.0 (2026-03-04)

🚀 Features

• richtext-lexical: separate configuration for lexical block icons (#15632) (f0498f2)
• richtext-lexical: upgrade lexical from 0.35.0 to 0.41.0 (#15760) (ba3bd74)
• translations: add i18n translations for modular dashboards (#15004) (cef2838)

---

Separate Block Icon Configuration (richtext-lexical) — Configure different images for Lexical block icons and block drawer thumbnails independently. Previously, imageURL served both contexts, forcing a compromise between a good 20x20px icon and a good drawer thumbnail. The new images property supports separate icon and thumbnail values with automatic fallback. Fully backwards compatible — imageURL still works but is deprecated. #15632

<img width="562" height="370" alt="image" src="https://github.com/user-attachments/assets/912e1482-0b37-40f7-a144-e21e43fc7aec" />

const QuoteBlock: Block = {
  slug: 'quote',
  images: {
    icon: 'https://example.com/icons/quote-20x20.svg',
    thumbnail: { url: 'https://example.com/thumbnails/quote-480x320.jpg', alt: 'Quote block' },
  },
  fields: [...],
}

Lexical Upgrade 0.35.0 → 0.41.0 (richtext-lexical) — Upgrades the Lexical rich text editor dependency from v0.35.0 to v0.41.0. Includes upstream fixes like normalizeMarkdown (facebook/lexical#7812). All Lexical breaking changes are handled internally by Payload — no action required for standard usage. If you installed lexical manually, update it to 0.41.0 (though using the re-exported versions from @payloadcms/richtext-lexical/lexical/* is recommended). #15760

Modular Dashboard Translations (translations) — Adds i18n translation support for the Modular Dashboards feature, covering all dashboard widget buttons and error messages. Previously, dashboard UI elements lacked translation keys, making them inaccessible for non-English users. Also updates the automatic translation script to use GPT-4.1 for improved cost efficiency. #15004

<img width="830" height="399" alt="image" src="https://github.com/user-attachments/assets/ca6cd857-e0dd-47b0-8b36-6242396f2c73" />

🐛 Bug Fixes

• restoreVersion validation for localized required fields (#15821) (e899182)
• draft doc validation when duplicating docs (#15816) (f470699)
• plugin-ecommerce: pass req to Payload API calls in Stripe adapter (#15839) (74799ea)
• plugin-import-export: automatically inherit locale and limit from URL queries (#15812) (ee083f0)
• plugin-import-export: fix imports with locales in a different column order than exported (#15808) (410912c)
• plugin-import-export: fix exports in other non-latin scripts being broken when opened in excel (#15813) (d931894)
• ui: drag and drop not working for sortable hasMany fields (#15845) (2c7ef3f)
• ui: prevent false positive stale data modal on autosave-enabled documents (#15817) (6aff717)
• ui: typo in CodeEditor export statement (#15795) (c5b2a91)

🛠 Refactors

• rename widget ComponentPath to Component for consistency (#15780) (f7d0d04)

📚 Documentation

• add documentation for conditional tabs (#15809) (a1d6733)
• fix table formatting in import-export plugin (#15792) (0dba95a)

🧪 Tests

• update suites selected by default in runTestsWithSummary (#15789) (07f2f05)

🏡 Chores

• prevent dev server from dirtying tracked files (#15826) (cb6f426)
• plugin-search: clean up .DS_Store file and resulting empty images directory (#14506) (f6f73dd)

⚠️ BREAKING CHANGES

• rename widget ComponentPath to Component for consistency (#15780) (f7d0d04)

  • Renames Widget.ComponentPath to Widget.Component and types it as PayloadComponentinstead ofstring`
  • This aligns dashboard widgets with every other component reference in (collections, globals, fields, admin components) - none of them path in the property name, and all of them are typed as PayloadComponent
  • Enables new typescript plugin to work for widget paths (the plugin uses PayloadComponent contextual type detection - string-typed properties were invisible to it)

• ui: typo in CodeEditor export statement (#15795) (c5b2a91)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jens Becker (@jhb-dev)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Luiz Cláudio (@lcnogueira)
• Palamar Roman (@VeiaG)
• Sebastian Blank (@blankse)
• Alessio Gravili (@AlessioGr)
• Mahmoud Hassan (@Mhmod-Hsn)

v3.78.0 (2026-02-27)

🚀 Features

• typescript plugin for import paths (#15779) (7639664)
• move trash out of beta and delete access can now be limited to trash only (#15210) (2347cd9)
• next, ui: widget fields (#15700) (0a123b5)
• plugin-mcp: out of beta (#15711) (1b19d5f)
• plugin-mcp: ignore virtual fields in create and update operations (#15680) (cc8f888)
• richtext-lexical: add markdown transformer for upload nodes (#15630) (4af5a85)
• ui: adds dashed button style (#15728) (d570787)
• ui: make query-presets editable from the form view (#15657) (575f8e9)

---

Feature Details

TypeScript Plugin for Component Paths - New @payloadcms/typescript-plugin validates PayloadComponent import paths directly in your IDE. It checks that referenced files and exports exist, provides autocomplete for file paths and export names, supports go-to-definition on component path strings, and understands all Payload path conventions including absolute paths, relative paths, tsconfig aliases, and package imports. #15779

https://github.com/user-attachments/assets/2a8a8f73-a8fd-4e79-9dc4-795d817b5b75

pnpm add -D @payloadcms/typescript-plugin

{
  "compilerOptions": {
    "plugins": [{ "name": "next" }, { "name": "@payloadcms/typescript-plugin" }]
  }
}

Trash Out of Beta with Granular Delete Access - Trash is now a stable feature. Delete access control can now distinguish between trashing and permanently deleting — allowing you to permit users to soft-delete documents while restricting permanent deletion to admins. When data.deletedAt is being set, the operation is a trash; otherwise it's a permanent delete. #15210

import type { CollectionConfig } from 'payload'

export const Posts: CollectionConfig = {
  slug: 'posts',
  trash: true,
  access: {
    delete: ({ req: { user }, data }) => {
      // Not logged in - no access
      if (!user) {
        return false
      }

      // Admins can do anything (trash or permanently delete)
      if (user.roles?.includes('admin')) {
        return true
      }

      // Regular users: check what operation they're attempting
      // If data.deletedAt is being set, it's a trash operation - allow it
      if (data?.deletedAt) {
        return true
      }

      // Otherwise it's a permanent delete - deny for non-admins
      return false
    },
  },
  fields: [
    // ...
  ],
}

Widget Fields (next, ui) - Dashboard widgets can now declare configurable fields, similar to Blocks. Widget data is editable from a new drawer UI when in dashboard editing mode. Full type generation is included — WidgetInstance<T> is generic with typed data and width, and WidgetServerProps is generic so widget components receive typed widgetData. #15700

https://github.com/user-attachments/assets/b24d3635-8635-4d5f-84af-a6dcf801aa4f

import { buildConfig } from 'payload'

export default buildConfig({
  admin: {
    dashboard: {
      widgets: [
        {
          slug: 'sales-summary',
          ComponentPath: './components/SalesSummary.tsx#default',
          fields: [
            { name: 'title', type: 'text' },
            {
              name: 'timeframe',
              type: 'select',
              options: ['daily', 'weekly', 'monthly', 'yearly'],
            },
            { name: 'showTrend', type: 'checkbox' },
          ],
          minWidth: 'small',
          maxWidth: 'medium',
        },
      ],
    },
  },
})

import type { WidgetServerProps } from 'payload'

import type { SalesSummaryWidget } from '../payload-types'

export default async function SalesSummaryWidgetComponent({
  widgetData,
}: WidgetServerProps<SalesSummaryWidget>) {
  const title = widgetData?.title ?? 'Sales Summary'
  const timeframe = widgetData?.timeframe ?? 'monthly'

  return (
    <div className="card">
      <h3>
        {title} ({timeframe})
      </h3>
    </div>
  )
}

MCP Plugin Out of Beta (plugin-mcp) - @payloadcms/plugin-mcp is now stable and ready for production use. #15711

Virtual Field Filtering in MCP (plugin-mcp) - Virtual fields (virtual: true) are now automatically stripped from MCP tool input schemas and filtered from parsed data before create, update, and updateGlobal operations. This prevents non-stored fields from appearing as accepted MCP parameters. #15680

Markdown Transformer for Upload Nodes (richtext-lexical) - Upload nodes are now properly converted when using convertLexicalToMarkdown. Previously, upload nodes were silently dropped during markdown conversion. Now populated image uploads output ![alt text](/uploads/image.jpg), non-image uploads output link syntax, and non-populated uploads output a reference placeholder so data is never lost. #15630

Dashed Button Style (ui) - Adds a new dashed button style variant. Also replaces box-shadow with border on all buttons and fixes icon-only button padding. #15728

<img width="2021" height="1261" alt="Button styles overview" src="https://github.com/user-attachments/assets/8d97fb19-51c3-46a3-9148-c54b15d49723" />

Editable Query Presets from Form View (ui) - Query presets can now be created and edited directly from the document form view using a full WhereBuilder, column picker, and groupBy selector — no longer requiring the list view to build queries first. #15657

https://github.com/user-attachments/assets/d25b447b-c942-47ae-8878-47bd17a8a7fb

---

🐛 Bug Fixes

• getFieldsToSign crashes when user missing group/tab fields (#15775) (9f0c101)
• improve mobile touch support for dnd (#15771) (418bb92)
• prevent silent data overwrites on concurrent edits (#15749) (7a3f43f)
• preserve block metadata in mergeLocalizedData and filterDataToSelectedLocales (#15715) (6557292)
• return 400 for malformed JSON request bodies (#15706) (4861fa1)
• globals not updating updatedAt when saving drafts (#15764) (df17cb1)
• return early if pasteURL is not defined (#15748) (23d52a0)
• prevent req.file leak between sequential duplicate() calls on upload collections (#15620) (2baea2e)
• sanitize filenames in storage adapters (#15746) (45bd2f1)
• throw error for unknown query operators (#15739) (08226db)
• preserve locale data in unnamed groups with localizeStatus (#15658) (38b8c68)
• next: conditionally query snapshot field based on localization (#15693) (d5706ee)
• plugin-import-export: update docs on jobs and basic usage as well as visibility (#15695) (a40210c)
• plugin-mcp: use inline block schemas in JSON output (#15675) (a66e844)
• plugin-multi-tenant: hasMany tenant fields double-wrap arrays in filterOptions (#15709) (aaddeac)
• plugin-multi-tenant: return false instead of query when no tenants (#15679) (f5a5bd8)
• richtext-lexical: bump acorn to resolve type mismatch with transitive dep (#15791) (801e851)
• richtext-lexical: link markdown regex should not match similar looking image markdown (#15713) (0a0afb0)
• richtext-lexical: use headingLevel in danish heading label (#15685) (ad4c0f6)
• richtext-lexical: strip server-only properties from blocks in lexical client schema map (#15756) (c05ace2)
• templates: ecommerce find my order access functionality to use email (#15736) (b317eaa)
• ui: array field add button margin not applying consistently (#15773) (ee298f5)
• ui: respect custom Cell components on richText fields in list view (#15762) (139cf3e)
• ui: use correct translation key for collection version restore modal (#15757) (c1892eb)
• ui: encode HTML special characters in version diff view (#15747) (30fee83)
• ui: flash of border on list selection buttons (#15735) (7f3c6c8)

🛠 Refactors

• extract regex escape pattern into shared utility (#15676) (8ce389e)
• plugin-mcp: reduced code and de-duplication (#15705) (039e6c9)

🎨 Styles

• richtext-lexical: lists and quotes have inconsistent letter spacing (#15682) (f2397a8)

🧪 Tests

• fix flaky versions tests timing out on link clicks before hydration (#15790) (02da3fd)
• fix flaky lexical code block test with incorrect error expectations (#15776) (4e3e780)
• trash e2e list view clicks timing out in CI (#15778) (fd81fd5)
• fix flaky localization tests with race conditions (#15777) (bda5d0d)
• bulk upload button clicks timeout in CI (#15703) (8228a7d)
• field update access control test times out locally (#15691) (78e8e14)
• fix flaky account unlock test in postgres-uuid and custom-schema (#15696) (e3a76e3)
• fix flaky lexical e2e navigation timeouts and drawer clicks (#15694) (9ca5cda)
• fix flaky access-control bulk delete tests failing due to timing issues (#15692) (558345b)
• fix flaky drawer open and column sort timing issues (#15677) (00f763b)

📝 Templates

• fix cloudflare logger error in with-cloudflare-d1 template (#15752) (8791a72)
• ecommerce add missing access control on collections (#15744) (c74d91d)
• fix ecommerce webhooks url and update docs on using stripe webhooks (#15681) (677596c)

🏡 Chores

• make test:e2e agent-friendly with --grep support and dev server reuse (#15755) (929203c)
• deps: bump next.js canary in monorepo (#15708) (e3d8a94)
• plugin-mcp: improve schema sanitization and test coverage (#15704) (7e20b5c)
• templates: bump versions to 3.77.0 (#15678) (e26df27)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Sean Zubrickas (@zubricks)
• Benedikt Rötsch (@axe312ger)
• Shobhit Singhal (@shobhitsinghal624)
• The Mavik (@themavik)
• Divyesh Jain (@divyesh123-jain)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Jens Becker (@jhb-dev)
• Jarrod Flesch (@JarrodMFlesch)
• Jessica Rynkar (@JessRynkar)
• Kendell (@kendelljoseph)
• Varun Chawla (@veeceey)

v3.77.0 (2026-02-18)

🚀 Features

• pass local API depth through to req.query.depth for consistency (#15023) (9a38469)
• db-*: add customID arg to db.create (#15653) (0935824)
• plugin-mcp: migrate from @vercel/mcp-adapter to mcp-handler (#15661) (24025fd)

---

Feature Details

Local API Depth Consistency - The depth option passed to Local API calls like payload.find() is now automatically set on req.query.depth. Previously, hooks relying on req.query.depth would behave differently between Local API and REST/GraphQL calls unless you manually passed req: { query: { depth: x } } in addition to depth: x. This change ensures consistent behavior across all API methods. #15023

Custom ID Support in db.create (db-*) - New customID argument on payload.db.create allows creating documents with a specific ID without requiring a custom ID field in your collection schema. #15653

payload.db.create({ collection: 'posts', customID: 'ce98d6c4-c3ab-45de-9dfc-bf33d94cc941', data: { } })

MCP Plugin Migration (plugin-mcp) - Migrates from the deprecated @vercel/mcp-adapter to mcp-handler and bumps @modelcontextprotocol/sdk to 1.25.2 addressing a security vulnerability. Exposes new handler options: disableSse, onEvent, and redisUrl. #15661

import { mcpPlugin } from '@payloadcms/plugin-mcp'

export default buildConfig({
  plugins: [
    mcpPlugin({
      // Optional: Enable SSE transport (disabled by default)
      disableSse: false,
      // Optional: Redis URL for SSE session management (defaults to REDIS_URL env)
      redisUrl: 'redis://localhost:6379',
      // Optional: Track MCP events for analytics/debugging
      onEvent: (event) => {
        console.log('MCP event:', event)
      },
    }),
  ],
})

---

🐛 Bug Fixes

• hasMany text fields cannot be filtered with contains operator (#15671) (4513a05)
• use consistent empty state styling between list and folder views (#15555) (8953b37)
• populate previousValue correctly in afterChange hooks for nested lexical fields (#15623) (1cc3bb9)
• add i18n support for dashboard edit mode buttons (#15564) (818e31d)
• next: handle undefined fieldTab in version diff tabs (#15590) (bbacab8)
• plugin-cloud-storage: ensure file data persists across operations (#15570) (6af3673)
• plugin-cloud-storage: generateFileURL only ran when disablePayloadAccessControl was true (#15667) (6c5611c)
• plugin-import-export: remove deprecated import (#15666) (733b1df)
• plugin-import-export: export and import issues when using custom IDs (#15518) (7e2a3ab)
• plugin-import-export: columns being duplicated when using toCSV hook (#15597) (28e07dc)
• plugin-mcp: resolve union type fields failing in update tool (#15660) (9ae89dd)
• plugin-multi-tenant: improve translation for "Tenant" (use "Mandant" instead of "Mieter") (#15537) (4d4033b)
• plugin-multi-tenant: tenant selector not appearing after login (#15617) (dd09f67)
• storage-r2: build error due to types issue in R2 Bucket type (#15670) (7d1e233)
• ui: fix broken polymorphic join edit drawer (#15621) (d450e99)

📚 Documentation

• update cell component docs (#15574) (c403b00)
• outline html lexical content conversion (#15601) (dc1b799)
• updates collection admin options (#14605) (8e92f7f)
• update custom components docs (#15576) (ae82294)
• clarify supported Next.js versions and optional dependencies in installation guide (#15604) (409bc0d)

🧪 Tests

• trash e2e tests check URL before navigation completes (#15599) (7fe5a8c)

🏡 Chores

• add md and mdx language block linting (#15309) (5415516)
• bump playwright to fix vscode run test indicators (#15626) (f74d288)
• only add publishAllLocales to publish when localizeStatus is enabled (#15610) (d57bc22)

🤝 Contributors

• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Jessica Rynkar (@JessRynkar)
• German Jablonski (@GermanJablo)
• Kendell (@kendelljoseph)
• Ahmad Yasser (@AhmadYasser1)
• Sasha (@r1tsuu)
• Philipp Schneider (@philipp-tailor)
• Philipp Brumm (@brumm)
• Sebastian Blank (@blankse)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Vaishnav Patil (@vaishnav-3)
• Divyesh Jain (@divyesh123-jain)

v3.76.1 (2026-02-11)

🐛 Bug Fixes

• use optional chaining for adminThumbnail size lookup to prevent crash (#15586) (6937eec)
• non-image files should not recieve 0 bytes with useTempFiles (#15538) (a313627)
• add CSP headers to SVG uploads to prevent XSS (#15506) (8283c25)
• richtext-lexical: link tooltip overflows outside viewport with long URLs (#15584) (af6b1a1)
• ui: prevent Tabs field crash when stored tabIndex exceeds tab count (#15588) (a9e296e)
• ui: copy to locale function swallowing errors (#15562) (8ce62d8)
• ui: ensure unpublish button only shows when drafts are enabled (#15459) (69dc5e6)

⚙️ CI

• releaser always pull latest on release (#15566) (84344a2)

v3.76.0 (2026-02-09)

🚀 Features

• plugin-import-export: adds new exportLimit, importLimit and per collection limit control (#15405) (a7beeca)

🐛 Bug Fixes

• drizzle: use dynamic import for typescript to avoid dependency in production (#15545) (98a756c)
• live-preview-vue: update build config to compile as esm (#14293) (60c65ed)
• next: drop support for Next.js versions with known CVEs, add canary 16.2.0 support (#15547) (2b3061a)
• next: suppress webpack "Critical dependency" warning in dynamicImport (#15534) (6158489)
• plugin-import-export: errors when import/export files were stored in a storage adapter such as S3 (#15441) (73a9650)
• ui: tab error badge not counting required array validation errors (#15563) (0ce6193)
• ui: folder view toggle button styles overridden due to equal specificity (#15544) (df42bec)
• ui: remove clearData call in dropzone drop handler (#10475) (b4e6761)

📝 Templates

• fix deprecation warnings during install (#15536) (5edba8e)
• bump to 3.75.0 (#15533) (8ea162c)

⚙️ CI

• do not wait for generating int and e2e matrix (#15546) (de43402)

🏡 Chores

• fix deprecation warning when running reinstall or clean:all monorepo script (#15535) (03bfaf4)
• drizzle: add logs indicating which migration statements are generated (#15374) (306974d)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Daniel Waltz (@danielwaltz)
• Said Akhrarov (@akhrarovsaid)

v3.75.0 (2026-02-05)

🚀 Features

• adds beforeNav and afterNav component slots (#15493) (f23a1df)
• next: pass full initReq context to server functions and dashboard widgets (#15427) (ce13e97)

🐛 Bug Fixes

• handle absolute paths correctly with tempFileDir upload option (#14436) (5ca9bd4)
• ungenerated image sizes should not store original URL (#15454) (fa1cd62)
• add safety check to redirects from external file URL uploads (#15458) (1041bb6)
• sass warning not hidden during webpack build (#15442) (dec0ea7)
• add collection property to auth documents, fixing multi tenancy access control issue (#15404) (d6aa6cc)
• graphql: blocks return null with select: true (#15464) (c2baef4)
• next: versions diff error when swapping blocks with relationship fields (#15478) (5ba0055)
• next: export SlugField from the client dir not rsc (#15461) (6c07f3b)
• next: sync modular dashboard widgets when server component re-renders (#15439) (5495b47)
• plugin-ecommerce: variant creation blocked by variants in trash (#15449) (3f01682)
• plugin-mcp: create and update resource tools now support point fields (#15381) (a28261d)
• ui: extra padding rendering in list view when no description exists (#15507) (3ff6be4)
• ui: remove slug field from rsc exports (#15480) (8f66035)

⚡ Performance

• next: avoid re-calculating permissions in some server functions, pass missing args (#15428) (9c8be5c)

📚 Documentation

• jobs queue improvements (#15318) (3d357b3)

🎨 Styles

• run lint-staged commands in correct order (#15446) (731037e)

🧪 Tests

• trash e2e URL regex too strict and blocks query parameters (#15498) (57e759c)
• additional admin e2e coverage for templates (#15477) (63d63be)
• reorganize helpers into shared/e2e/int subdirectories (#15479) (b901231)
• enable figma adapter testing (#15467) (f4920d8)
• improve script to reset tests (#15328) (399b579)
• richText fields serialization (#15465) (fc99048)
• update suites selected by default in runTestsWithSummary (#15463) (603897d)
• trash auth e2e tests have race condition on navigation (#15468) (9bd5123)

⚙️ CI

• cache propagation workaround (#15469) (df0a75d)

🏡 Chores

• fix eslint config lookup in formatting hooks (#15516) (38a88b3)
• remove duplicative agents.md, document ai tool compatibility (#15472) (6216f56)
• remove template lockfiles (#15494) (362bf2f)
• replace magic strings with centralized constants (#15475) (8422668)
• claude post-write hook causes error when IDE checks output and doesn't apply formatting correctly (#15445) (033b943)
• claude: add playwright mcp (#15447) (f15b9a3)
• plugin-multi-tenant: use beforeNav instead of beforeNavLinks for tenant selector (#15499) (5d7d544)

🤝 Contributors

• sanbrien (@sanbrien)
• Neha Prasad (@naaa760)
• Kendell (@kendelljoseph)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Jake (@jacobsfletch)
• Kurt Tomlinson (@kurttomlinson)
• Colum Kelly (@columk1)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@JessRynkar)
• Elliot DeNolf (@denolfe)

v3.74.0 (2026-01-30)

🚀 Features

• thread override access in doc level hooks (#15421) (85d5263)
• extend strictDraftTypes to all draft operations (#15292) (9239164)
• add support for custom UnpublishButton component (#15400) (94254da)
• storage-r2: client uploads using R2 multipart api (#14733) (5c38902)
• ui: allows opting out of popup closing logic (#15407) (fb2b602)
• ui: allows customizing Popup component portal className (#15406) (0f55464)

---

Override Access in Document-Level Hooks - Access the overrideAccess value inside collection and global hooks. Useful when hook logic needs to know whether access control was bypassed, such as when querying related documents up a hierarchy. #15421

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeChange: [
      ({ overrideAccess, req }) => {
        if (overrideAccess) {
          // Access control was bypassed
        }
      },
    ],
  },
}

---

Extended strictDraftTypes to All Operations - When strictDraftTypes: true is enabled, TypeScript now enforces draft type safety across all Local API operations (not just queries). The draft option is forbidden for collections/globals without drafts enabled, preventing silent runtime behavior where draft flags are ignored. #15292

import { buildConfig } from 'payload'

export default buildConfig({
  typescript: {
    strictDraftTypes: true, // Enables compile-time draft enforcement
  },
  // ...
})

⚠️ Note: Generic collection slugs may require explicit type assertions when using draft options.

---

Custom UnpublishButton Component - Customize the UnpublishButton in collection and global configs, following the same pattern as PublishButton and SaveButton. Previously hardcoded. #15400

export const Posts: CollectionConfig = {
  slug: 'posts',
  admin: {
    components: {
      edit: {
        UnpublishButton: '/components/CustomUnpublishButton',
      },
    },
  },
}

---

R2 Multipart Client Uploads (storage-r2) - Upload large files directly from the client using R2's multipart API. Files are split into smaller parts and uploaded separately, avoiding Cloudflare Worker memory limits. #14733

---

Popup Prevent Close Attribute (ui) - Add interactive elements inside popups without triggering close behavior by adding the data-popup-prevent-close attribute. #15407

<Popup>
  <button data-popup-prevent-close onClick={handleClick}>
    Click me without closing
  </button>
</Popup>

---

Popup Portal className (ui) - Customize the Popup component's portal container with the new portalClassName prop. #15406

<Popup portalClassName="my-custom-portal-class">
  {/* content */}
</Popup>

🐛 Bug Fixes

• isolate payload-preferences by auth collection (#15425) (2dc2e7c)
• traverseFields returning wrong parentPath dot notation for non-localised tabs (#15394) (99b051e)
• widgets and other features failing with transitive dependency imports (#15392) (5561799)
• replace deprecated scmp with crypto.timingSafeEqual (#15322) (2511c02)
• find afterRead hooks should behave like findByID (#15357) (3e27155)
• remove depth from count operation types (#15356) (dfc1600)
• publish button incorrectly shown after saving draft when access denied (#15319) (e833fe6)
• next: version view throws useLocale() server error (#15380) (2ce26fa)
• next: ensure query preset from url is applied (#15323) (592f404)
• next: ensure save preset button is not shown when there are no changes (#15320) (e9af097)
• plugin-cloud-storage: prevent infinite loop when cropping media (#15393) (345a9c7)
• plugin-cloud-storage: adds beforeChange hook to generate url on create (#15401) (d269d39)
• richtext-slate: localized indicator not displaying in label (#15412) (126f713)
• ui: use the formatAdminUrl function to generate unpublish url (#15375) (453e8a6)
• ui: restore default columns after clearing query preset (#15360) (029699d)
• ui: prevent globals crash with arrays fields when lock state user is undefined in handleDocumentLocking (#15259) (ea76ca0)
• ui: getEntityConfig did not respect globalSlug if collectionSlug is undefined (#15362) (b54059c)

📚 Documentation

• clarify beforeValidate and beforeChange hook data behavior (#15300) (ba9605e)
• add payload.logger.error usage guidelines to CLAUDE.md (#15398) (cdbfda2)
• updated redirects plugin integration docs and postgres connection troubleshooting (#15383) (9b2221e)
• improve select jsdocs and empty select docs (#15336) (4181a12)

🧪 Tests

• make integration tests for the fields and select suites faster (#15434) (26ba779)

📝 Templates

• deps: bump Next.js versions (#15365) (5658ec2)

🔨 Build

• add node-gyp for native module rebuilds (#15396) (50c087f)

⚙️ CI

• enable retries for int and unit tests (#15397) (8b21263)
• cache e2e prod preparation to run once instead of per-shard, various improvements and flake fixes (#15368) (2b3b9d5)
• automatically shard int tests (#15367) (1041b15)
• disable playwright tracing for first test runs, to improve performance and reduce flakes (#15337) (ab603c3)
• automatically shard e2e tests (#15366) (2f19f8f)
• add missing value property to outputs (#15338) (479b057)
• bump monorepo Node.js version from 23.11.0 to 24.13.0 (#15364) (d95c365)
• add linked PR feature to popular-issues action (#15355) (614f13c)

🏡 Chores

• export getSafeFileName utility (#15424) (6b45fee)
• replace rmdirSync to rmSync (#15420) (17c0a3f)
• claude: add respond-to-discussion-features claude command (#15391) (1f7fe63)
• deps: bump form-data, tar, wrangler, and @opennextjs/cloudflare dependencies (#15435) (5875cd0)
• deps: bump tsx (#15363) (7043e3f)
• plugin-multi-tenant: removes basePath arg (#15202) (bd80784)
• ui: move unpublish actions into document controls dropdown (#15417) (99d61db)

🤝 Contributors

• Ricardo Tavares (@rjgtav)
• Patrik (@PatrikKozak)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• Jarrod Flesch (@JarrodMFlesch)
• Tobias Odendahl (@tak-amboss)
• Paul (@paulpopus)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Georg Schelkshorn (@GeorgS)
• Muhammad Hassaan Farooq (@Muhammad-Hassaan-Farooq)
• RajeshKumar11 (@RajeshKumar11)

v3.73.0 (2026-01-23)

🚀 Features

• next.js 16 support (#14456) (18ca83b)
• db-sqlite: add busyTimeout option (#15317) (0c235c3)
• db-sqlite: add WAL mode support (#15278) (3357aa6)
• drizzle: predefined migration for blocksAsJSON: true (#15257) (1b7b13d)
• live-preview: expose requestHandler arg to hooks (#15302) (4f3c31f)
• plugin-mcp: adds select API with CRUD tools (#15301) (268b33a)
• ui: use native useEffectEvent if available (#15304) (f0458fb)

Feature Details

🔥 Next.js 16 Support - Full compatibility with Next.js 16, including Turbopack HMR and build support. Requires Next.js >16.1.1-canary.35 or 16.2.0+. Templates will be updated after Next.js 16.2.0 is released. Stable Next.js 16.1.* is not supported, as we depend on fixes released in the Next.js canary. Support for cache components will follow in a future release #14456

WAL Mode Support (db-sqlite) - Enable SQLite Write-Ahead Logging for improved concurrent read/write performance. Configurable synchronous mode and journal size limit. #15278

Busy Timeout Option (db-sqlite) - Set maximum wait time in milliseconds when the database is locked, preventing SQLITE_BUSY errors in high-concurrency scenarios. #15317

Predefined Migration for blocksAsJSON (drizzle) - Migrate existing projects to use blocksAsJSON: true with a single command. Automatically updates your Payload config and generates the required migration. #15257

pnpm payload migrate:create --file @payloadcms/db-postgres/blocks-as-json

Request Handler in Live Preview Hooks (live-preview) - The useLivePreview hook (React and Vue) now accepts a requestHandler argument, allowing customization of data fetching. Useful when your frontend proxies requests or uses external middleware. #15302

Select API for MCP Tools (plugin-mcp) - Find, Create, and Update tools for Globals and Collections now support the select API, reducing token usage and aligning with Payload's existing query capabilities. #15301

Native useEffectEvent (ui) - Uses React's native useEffectEvent when available (React 19.2.0+), falling back to the existing polyfill for older versions. #15304

🐛 Bug Fixes

• select hasMany prevent duplicate values (#15218) (f4e8990)
• orderable fractional indexing case-sensitivity issue with PostgreSQL (#14867) (ef27ad9)
• find distinct sort on a different field (#15233) (e95f26d)
• conditional tabs breaking in Next.js 16 due to unstable tab id (#15270) (f5a7a00)
• correct previousValue and value in afterChange when using seo-plugin (#15253) (b6b6bab)
• db-mongodb: fix projection handling for relationship fields in GraphQL queries with select (#14850) (ace3447)
• drizzle: d1 sqlite IN querying of id when any other join is present in the query (#15290) (4f5a9c2)
• next: relationship fields with maxDepth: 0 show "Untitled - ID" in diff view (#15305) (65238c5)
• plugin-mcp: auto-detect basePath from Payload config routes (#15189) (dbc06f6)
• richtext-lexical: internal links render as href="#" in versions view (#15308) (ab4102c)
• sdk: correct return types with select (#15289) (db40d7b)
• ui: diff view columns have unequal widths for nested fields causing text misalignment (#15330) (db72a65)
• ui: upsertPreferences did not return preferences when creating new preferences (#15321) (94d5728)
• ui: pass the locale to reorder endpoint in orderable table (#14839) (d6bb3de)

📚 Documentation

• add jsdocs to query presets api (#15306) (3dbaed8)
• small md fix (#15299) (9a1eb77)
• remove csv as a language for code blocks (#15265) (259eac4)

📝 Templates

• upgrade website template and examples tailwind to v4 (#11197) (e77f9b6)

⚙️ CI

• prevent rate limiting in release-commenter action (#15298) (71b35fa)

🏡 Chores

• removes never implemented readDrafts access arg on globals (#15297) (12b679f)
• export fractional indexing utilities (#15286) (02800b0)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Alessio Gravili (@AlessioGr)
• Kendell (@kendelljoseph)
• David Murdoch (@dsm23)
• Rafau (@RafalFilipek)
• Aaron Claes (@AaronClaes)
• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Jens Becker (@jhb-dev)
• Paul (@paulpopus)
• Vladyslav Prosolupov (@vladyslavprosolupov)
• Jessica Rynkar (@jessrynkar)

v3.72.0 (2026-01-16)

🚀 Features

• adds experimental option localizeStatus and allows unpublish per-locale functionality (#14667) (d77af00)
• plugin-mcp: add depth parameter support to all MCP find resource tools (#14931) (c979fb3)

---

Localized Status (Experimental) - Each locale can now track and manage its own publication status independently. Publish or unpublish individual locales without affecting others, with locale-aware UI and version history. Requires enabling at both config and collection level. #14667

// payload.config.ts
export default buildConfig({
  experimental: {
    localizeStatus: true,
  },
  // ...
})

// collections/Posts.ts
export const Posts: CollectionConfig = {
  slug: 'posts',
  versions: {
    drafts: {
      localizeStatus: true,
    },
  },
}

⚠️ Migration Required: If you have existing version data, run the provided migration helper to convert _status fields from strings to locale objects. See PR #14667 for full migration guide.

---

Depth Parameter Support (plugin-mcp) - MCP resource tools now support a depth parameter (0-10) to control relationship population depth. Use depth: 0 for lightweight ID-only responses or higher values for fully populated relationship data. Significantly reduces token count when reading documents. #14931

---

🐛 Bug Fixes

• thumbnailURL hook, virtually populate from thumbnail size (#15232) (beeb269) (https://github.com/payloadcms/payload/commit/4f452ac))
• select in findByID with draft: true may return a wrong version (#14742) (49c9fa9)
• use window.location.origin as fallback for API URL copy (#15220) (a46e3a2)
• folder creation errors when collection uses translation function labels (#15216) (1a3aeb8)
• correct image size URLs in beforeChange (#15214) (da12eed)
• db-mongodb: hasMany relationship filtering with equals operator returns no results (#15204) (1756c0d)
• deps: bump undici to 7.18.2 to mitigate chained decompression (#15221) (591f9d2)
• plugin-ecommerce: issue with slug map ignoring variants and threading through cart data (#15234) (4b6529f)
• plugin-ecommerce: translations not being mapped correctly (#15205) (3337403)
• templates: prevent jobs run if secret unset (#15207) (8f50f83)
• translations: correct Russian translations for UI states in general section (#14953) (454042e)
• ui: truncates long JSON cells in list view (#9214) (6827978)

📚 Documentation

• fix beforeChange field hook documentation to reflect actual behaviour (#14798) (533ae92)

🧪 Tests

• fix race condition in language switcher helper (#15206) (f98d915)
• add @payloadcms/storage-s3 clientUploads integration test suite (#15194) (4dce061)
• fields with defaultValue ​​should not be overwritten in upsert (#15197) (c684c6b)

⚙️ CI

• announce releases in discord general channel (#15201) (734453d)

🏡 Chores

• adds generate-translations claude skill (#15215) (f1f2be6)
• enforce no-console rule for @payloadcms/ui (#15195) (54db43d)
• plugin-redirects: add Swedish translation (#15213) (e19f432)
• translations: fixes to Swedish translation (#15212) (d3b12a1)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Vincent Vu (@rubixvi)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Kendell (@kendelljoseph)
• Elliot DeNolf (@denolfe)
• Jens Becker (@jhb-dev)
• Patrik (@PatrikKozak)
• spiner2000 (@spiner2000)
• Marcus Forsberg (@marcusforsberg)
• Jessica Rynkar (@jessrynkar)
• Said Akhrarov (@akhrarovsaid)
• Jeffery To (@jefferyto)

v3.71.1 (2026-01-13)

🐛 Bug Fixes

• ui: remove debug console.log from Form component (#15191) (5529f9b)

🤝 Contributors

• Patrik (@PatrikKozak)

v3.71.0 (2026-01-13)

🚀 Features

• supersedes option to job queue concurrency controls (#15179) (9aeb843)
• add support for custom Status component in document controls (#11154) (ef863e6)
• add exclusive concurrency controls for workflows and tasks (#15177) (35fe09d)
• add bulkOperations.singleTransaction config option (#14387) (92da9fa)
• add support for additional IANA timezones, custom UTC offsets and overriding the timezone field (#15120) (a8785ba)
• ability to cancel current job from within workflow or task handlers (#15119) (1bd3146)
• add typescript.strictDraftTypes flag for opt-in draft query type safety (#14388) (58faafd)
• drizzle: include collection and global slugs in validation errors (#15147) (910d274)
• plugin-ecommerce: new hooks, cart logic moved to the server and fixed several bugs (#15142) (dcd4030)
• plugin-ecommerce: add new method refreshCart in useCart (#14765) (#14767) (529726e)
• plugin-import-export: refactor plugin and add import functionality (#14782) (13e6035)
• plugin-mcp: add draft parameter support to MCP find resource tool (#14924) (744a593)
• plugin-mcp: adds tools that can find and update globals (#15091) (f6d9873)
• plugin-nested-docs: add req parameter to GenerateURL and GenerateLabel types in nested docs (#14617) (6821a09)
• plugin-redirects: add Japanese translations (#15080) (c5b57f7)
• plugin-search: enables skipping of document syncing (#14928) (dfcf15c)
• sdk: automatically fallback to generated types attempt (#15167) (ae50d39)
• sdk: add proper error handling (#15148) (bfe2154)

---

Feature Details

Job Queue Concurrency Supersedes - Newer jobs can automatically delete older pending jobs with the same concurrency key. Enables "last queued wins" behavior for scenarios where only the latest state matters. #15179

concurrency: {
  key: ({ input }) => `generate:${input.documentId}`,
  exclusive: true,
  supersedes: true,  // Newer jobs delete older pending ones (not yet completed and did not start processing yet)
}

Exclusive Concurrency Controls - Prevents race conditions when multiple jobs operate on the same resource. Jobs with the same concurrency key will not run in parallel. Requires enableConcurrencyControl: true (will default to true in v4.0). #15177

export default buildConfig({
  jobs: {
    enableConcurrencyControl: true,
    workflows: [{
      slug: 'syncDocument',
      concurrency: ({ input }) => `sync:${input.documentId}`,
      handler: async ({ job }) => {
        // Only one job per documentId runs at a time
      }
    }]
  }
})

Job Cancellation from Handlers - Throw JobCancelledError from within a task or workflow handler to stop the job without retrying. #15119

Custom Status Component - Replace the Status section in document or global edit views without replacing the entire Edit view. Useful for custom locale publishing logic or additional status indicators. #11154

admin: {
  components: {
    edit: {
      Status: '/components/Status/index.tsx#Status',
    },
  },
},

Bulk Operations Single Transaction (db-mongodb) - Handle database transaction limitations when processing large numbers of documents in bulk operations. Useful for DocumentDB and Cosmos DB which have cursor limitations within transactions. #14387

Additional IANA Timezones & Custom UTC Offsets - Support for additional IANA timezone names via DateTimeFormat API validation, custom UTC offsets in ±HH:mm format, and the ability to override the timezone field configuration. #15120

{
  name: 'eventTime',
  type: 'date',
  timezone: {
    supportedTimezones: [
      { label: 'UTC+5:30 (India)', value: '+05:30' },
      { label: 'UTC-8 (Pacific)', value: '-08:00' },
      { label: 'UTC+0', value: '+00:00' },
    ],
  },
}

Override the timezone field:

{
  name: 'publishedAt',
  type: 'date',
  label: 'Published At',
  timezone: {
    override: ({ baseField }) => ({
      ...baseField,
      admin: {
        ...baseField.admin,
        disableListColumn: true, // Hide from list view columns
      },
    }),
  },
}

Strict Draft Types (typescript) - Opt-in strictDraftTypes flag for correct type safety when querying drafts. When enabled, find operations with draft: true will correctly type required fields as optional. Will become default in v4.0. #14388

export default buildConfig({
  typescript: {
    strictDraftTypes: true,  // defaults to false
  },
})

Validation Error Context (drizzle) - Unique constraint ValidationErrors now include data.collection or data.global for better error context when debugging. #15147

Server-Side Cart Logic (plugin-ecommerce) - Cart logic moved to the server with new REST API endpoints. New hooks: onLogin (merge guest cart with user cart), onLogout (clear session), clearSession, mergeCart, and refreshCart. Support for custom cart item matchers and MongoDB-style $inc operator for quantity changes. #15142

/**
 * Custom cart item matcher that includes fulfillment option.
 */
const fulfillmentCartItemMatcher: CartItemMatcher = ({ existingItem, newItem }) => {
  const existingProductID =
    typeof existingItem.product === 'object' ? existingItem.product.id : existingItem.product

  const existingVariantID =
    existingItem.variant && typeof existingItem.variant === 'object'
      ? existingItem.variant.id
      : existingItem.variant

  const productMatches = existingProductID === newItem.product

  const variantMatches = newItem.variant
    ? existingVariantID === newItem.variant
    : !existingVariantID

  const existingFulfillment = existingItem.fulfillment as string | undefined
  const newFulfillment = newItem.fulfillment as string | undefined
  const fulfillmentMatches = existingFulfillment === newFulfillment

  return productMatches && variantMatches && fulfillmentMatches
}

refreshCart Method (plugin-ecommerce) - Manually refresh cart state after direct modifications, allowing the UI to stay in sync without being blocked by addItem's uniqueness validation. #14767

Import Functionality (plugin-import-export) - Complete plugin refactor with new import functionality. Config is now per-collection with required collections array. Supports disabling import/export per collection and custom collection overrides. #14782 ⚠️ BREAKING CHANGE

importExportPlugin({
  overrideExportCollection: (collection) => {
    collection.admin.group = 'System'
    collection.upload.staticDir = path.resolve(dirname, 'uploads')
    return collection
  },
  overrideImportCollection: (collection) => {
    collection.admin.group = 'System'
    collection.upload.staticDir = path.resolve(dirname, 'uploads')
    return collection
  },
  collections: [
    {
      slug: 'posts',
      import: false, // disables import functionality, export enabled by default
    },
    {
      slug: 'pages',
      export: ({ collection }) => {
        collection.admin.group = 'System'
        collection.upload.staticDir = path.resolve(dirname, 'uploads')
        return collection
      },
      disableJobsQueue: true, // disable jobs queue for this collection only
    },
  ],
  debug: true,
})

Draft Parameter for MCP Find (plugin-mcp) - Query draft/unpublished documents via the MCP plugin's find tool using the new draft boolean parameter. #14924

Globals Support (plugin-mcp) - New MCP tools to find and update globals. #15091

Request Parameter in Nested Docs (plugin-nested-docs) - req parameter added to generateURL and generateLabel functions for more flexibility (e.g., reading current locale). #14617

Skip Sync (plugin-search) - Conditionally skip syncing documents to the search index based on locale, document properties, or other criteria. #14928

skipSync: async ({ locale, doc, collectionSlug, req }) => {
  if (!locale) return false

  const tenant = await req.payload.findByID({
    collection: 'tenants',
    id: doc.tenant.id,
  })

  return !tenant.allowedLocales.includes(locale)
}

Automatic Type Inference (sdk) - The SDK automatically uses your generated types via module augmentation—no need to manually pass GeneratedTypes. #15167

import { PayloadSDK } from '@payloadcms/sdk'

const sdk = new PayloadSDK({}) // Types inferred automatically from payload-types.ts

Proper Error Handling (sdk) - The SDK now throws PayloadSDKError on failed API requests with status, errors, response, and message properties. #15148

import { PayloadSDKError } from '@payloadcms/sdk'

try {
  await sdk.create({ collection: 'posts', data: { ... } })
} catch (err) {
  if (err instanceof PayloadSDKError) {
    console.log(err.status)  // 400
    console.log(err.errors)  // [{ name: 'ValidationError', message: '...', data: {...} }]
  }
}

Japanese Translations (plugin-redirects) - Localized admin UI strings for Japanese users. #15080

🐛 Bug Fixes

• wrong construction of urlToUse leads to false alert with logger.error (#15190) (ec6bba5)
• adds missing transactions to login and logout operations (#15134) (dd494be)
• set basePath from next config as env variable (#15154) (a8bfade)
• throw error on empty relationTo array and allow disabling lockDocuments on all collections (#14871) (9521ec6)
• add distinct validate to richtext field type definition (#15069) (d68e75a)
• exclude files from being sent to the form-state action (#15174) (aaea133)
• full image urls stored in DB (#15089) (d462f9b)
• field schema map paths (#10852) (d288752)
• custom OPTIONS endpoints are intercepted and cannot set custom CORS headers (#15153) (c103667)
• upload drawer not loading data for uploads without files (#15150) (00fb6e8)
• cannot read private member #headers error on Node.js 24 when using isolateObjectProperty (#15116) (e214deb)
• db-mongodb: avoid unnecessary $lookup when a join field is not selected (#15149) (e39b1b5)
• db-mongodb: exists operator on fields that have an array value in the db (#15152) (0afe200)
• db-mongodb: find id field from flattened fields (#15110) (40081f4)
• db-postgres: add filenameCompoundIndex baseIndexes for upload collections (#15182) (01f90c9)
• db-postgres: localized and hasMany/polymorphic relationships/uploads inside blocks (#15095) (01e4412)
• drizzle: unique field errors were not thrown as ValidationErrors (#15146) (43c19cb)
• live-preview: remove payload import (#15160) (ec658a4)
• plugin-cloud-storage: should persist external data returned by handleUpload (#15188) (7d80d21)
• plugin-cloud-storage: prevent deleting original file when duplicating (#14961) (9d54267)
• plugin-mcp: handle defaultDepth: 0 in api key authentication (#15014) (e0e058c)
• plugin-multi-tenant: cannot clear selected tenant from dashboard view (#15141) (cd77e5d)
• richtext-lexical,ui: make uploadNode default to alt user-defined values. (#15097) (3290b04)
• storage-*: add range headers to storage adapters (#14890) (ef90811)
• storage-s3: respect upload limits with client uploads (#15176) (4a6189e)
• templates: fix mobile menu auth buttons overflow in ecommerce template (#15020) (6c1109f)
• templates: improve cli detection in cloudflare template (#15098) (5d21ed1)
• templates: add recommended serverExternalPackages to cloudflare (#15094) (0eed581)
• translations: improve Japanese translations for naturalness and consistency (#15077) (88a901c)
• ui: ensure up-to-date upload preview thumbnails in admin panel (#15029) (6f4b272)
• ui: use optional chaining for potentiallyStalePath (#15185) (38cd67a)
• ui: virtual fields with virtual: true show sort chevrons in list view (#15186) (33c3630)
• ui: prevent text overlap in breadcrumbs (#15040) (0e27f19)
• ui: avoid creating hasMany options during IME composition (#15086) (98bc876)
• ui: duplicate document has unused serverURL dependency (#15178) (6d212b8)
• ui: bulk upload error count (#15155) (0a46f4e)
• ui: margins on small screens when using hideGutter in group (#15041) (22f94cd)
• ui: preserve beforeInput/afterInput components in bulk edit (#14954) (c62dc2a)
• ui: prevent wrong scroll target when adding rows in repeated array blocks (#15047) (f13a741)
• ui: crop width and height inputs limited to -1 of max (#15101) (3a6d3bd)

⚡ Performance

• optimized collection create when versions are enabled (#14885) (25813a7)
• graphql: optimized join count when docs are not needed (#14872) (6025eff)

🛠 Refactors

• clean up generated type resolution (#15163) (51d6cd2)
• deprecate returning failed state from job queue handlers (#15102) (070ded7)

📚 Documentation

• clarify available operations for beforeOperation hook (#14774) (8c59762)
• update link for MDN docs on cookies in requests (#15075) (0859f1c)
• updates custom upload component examples (#14678) (d3d8b4e)
• add graphql multi-field sort note (#15123) (14ac061)
• task failure docs (#15096) (81df3d6)

🧪 Tests

• remove silly tests from accessComposition unit tests (#15158) (cc33129)
• fixes flaky form state test (#15128) (251fc68)
• adds assert helpers to the a11y suite (#15132) (daf8061)
• running a11y test suite sequentially (#15130) (536582f)
• update outdated hardcoded postgres connection strings (#15114) (7930f44)
• fixes lexical block test flakes (#15113) (13edb8a)

⚙️ CI

• remove website post release notification (#15133) (5ebda61)
• deps: bumps setup-node version from 4 to 6 (#15122) (fe9119b)

🏡 Chores

• deprecate skip parameter from db-adapters (#15183) (ea15f00)
• add v4 comments for relationTo types (#15187) (d7351d5)
• upgrade to pnpm 10 (#15137) (1c8d515)
• refactor withPayload back to js (#15159) (44af1ad)
• plugin-mcp: adds config.admin.user as an optional default userCollection (#14989) (cdabf79)
• templates: replace arbitrary tailwind values with utilities in ecommerce template (#14654) (67cc734)

⚠️ BREAKING CHANGES

• plugin-import-export: refactor plugin and add import functionality (#14782) (13e6035)

  This PR works to refactor the entire plugin so it's easier for us to work with it going forward and also implements import functionality.

🤝 Contributors

• Sasha (@r1tsuu)
• Jeffery To (@jefferyto)
• Alessio Gravili (@AlessioGr)
• tapartdev (@tapartdev)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Elmo (@Spreizu)
• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• roboin (@Robot-Inventor)
• Tobias Odendahl (@tak-amboss)
• Rick Geersing (@RickGeersing)
• Dan Ribbens (@DanRibbens)
• Riley Langbein (@rilrom)
• David Wensley (@wensleyio)
• Bernhard Frick (@baer95)
• Said Akhrarov (@akhrarovsaid)
• Kendell (@kendelljoseph)
• Jiayi Wang (@Jeromestein)
• Jake (@jacobsfletch)
• Jens Becker (@jhb-dev)
• Sean Zubrickas (@zubricks)
• Anton Timmermans (@atimmer)
• Ricardo Tavares (@rjgtav)
• Marcin Gierada (@teastudiopl)
• Colum Kelly (@columk1)
• Elliot DeNolf (@denolfe)
• Jonathan Elmgren (@jonathanelmgren)
• Thomas Coldwell (@thomas-coldwell)

v3.70.0 (2026-01-05)

🚀 Features

• support qs-esm sort arrays in REST API (#15065) (2ccf898)
• richtext-lexical: adds docs page for lexical blocks, adds new lexical block component types and styles (#14971) (329115c)

Multi-Column REST API Sorting

Sort by multiple columns in the REST API using array syntax, aligning REST API behavior with the Local API. Previously only string-based sorting was supported. #15065

// Sort by multiple fields via REST API query string
// GET /api/posts?sort[0]=createdAt&sort[1]=-title

// Equivalent to Local API:
const posts = await payload.find({
  collection: 'posts',
  sort: ['createdAt', '-title'],
})

Lexical Blocks Documentation & Component Styles (richtext-lexical)

New documentation page for Lexical blocks with comprehensive examples showing usage and customization. Also introduces new block component types and styles for enhanced rich text editing. https://github.com/payloadcms/payload/pull/14971

See the https://payloadcms.com/docs/rich-text/blocks for full details.

🐛 Bug Fixes

• s3 plugin uploads files before validation (#14988) (502947b)
• add beforeDocumentControls to globals generate importmap (#15036) (4468197)
• warning during Next.js build "the request of a dependency is an expression" (#15007) (cd87ab4)
• next: turbopack build version check not working for 16.1.1 canaries (#15005) (ab68a2f)
• plugin-mcp: pin modelcontextprotocol/sdk dependency version to 1.24.0 (#15017) (1a9d665)
• storage-*: allow prefix to always exist as a field via alwaysInsertFields flag (#14949) (23a8689)
• ui: invalid sass imports to support windows - add Stylelint to prevent regression (#15028) (c66e953)

🧪 Tests

• fix console logs not appearing on vitest (#15008) (e3879bf)
• ensure vitest vscode extension env variables match CI (#15009) (f6248f9)
• migrate from jest to vitest eslint plugin, remove remaining jest references (#14997) (418375c)

🏡 Chores

• adds comment in image component (#14663) (6459ebc)
• bump nodemailer to 7.0.12 (security) (#15062) (aa61b31)
• narrow down files affected by vitest lint rules (#15000) (b97a063)
• claude: fix typo in claude skills access control advanced file (#15060) (5cbdca1)
• deps: bump dnd-kit (#15083) (07c36a3)

⚠️ BREAKING CHANGES

@payloadcms/storage-s3

Only users with custom hooks on S3 upload fields are affected — standard plugin usage is unchanged.

• External upload process for the S3 plugin has moved from beforeChange to afterChange as a result of fix: s3 plugin uploads files before validation (#14988)

This change was necessary to ensure that files uploaded to S3 have passed all validations and been saved to the document, preventing orphaned external files.

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Sean Zubrickas (@zubricks)
• Vincent Vu (@rubixvi)
• Paul (@paulpopus)
• Jessica Rynkar (@jessrynkar)
• Jonathan Elmgren (@jonathanelmgren)
• Patrikbjoh (@Patrikbjoh)
• Anders Semb Hermansen (@andershermansen)
• Riley Langbein (@rilrom)
• Elliot DeNolf (@denolfe)

v3.69.0 (2025-12-19)

🚀 Features

• modular dashboards - widgets (#13683) (f111624)
• adds cursor rules and AGENTS.md to templates (#14889) (19fcf99)

---

Modular Dashboards with Widgets

Introduces customizable admin dashboards with draggable, resizable widgets. Build personalized dashboard layouts with full keyboard accessibility for reordering and resizing. Future updates will add widget fields (props) for configurable widgets and dashboard presets for sharing layouts. #13683

https://github.com/user-attachments/assets/6c08d8d6-c989-4845-b56f-6d3fbd30b1af

See the RFC discussion for background and roadmap.

AI Development Resources (templates)

All templates now ship with AGENTS.md and .cursor/rules/ directory for improved AI-assisted development with tools like Copilot and Cursor. #14889

See more about AGENTS.md

🐛 Bug Fixes

• basePath not working properly with admin routes (#14967) (fa6b503)
• get field by path for blocks (#14984) (519a3c6)
• improves upload security for PDFs and SVGs (#14929) (61298c6)
• missing range headers (#14887) (ec7c192)
• next: status component incorrectly shows as published status on new documents saved as drafts when readVersions permissions are false (#14950) (394c024)
• plugin-mcp: adds collection and strategy to user (#14981) (042d7eb)
• plugin-multi-tenant: relationTo arrays inflating filterOptions where query size (#14944) (98b6791)
• richtext-lexical: blocksFeature with relationship exposes other tenants (#14985) (3025377)
• storage-s3: encode filename in generated URL (#14438) (86855e1)
• ui: use portals for popup to prevent clipping, improve keyboard navigation (#14910) (af09932)

🛠 Refactors

• replace deprecated url.parse api usage (#14980) (446cbb1)

📚 Documentation

• fix duplicate anchor links (#14976) (4c91d04)
• update screenshot for fields/rich-text (#14979) (2117dbf)

🧪 Tests

• migrate to vitest (#14337) (4e45432)
• move mongodb to different port to avoid port conflicts (#14993) (b4abd04)
• improve database test setup (#14982) (e3c512a)
• multi-tenant login tiles (#14940) (47f63fa)

🏡 Chores

• storage-s3: add int tests for filename encoding (#14970) (ef710e3)

🤝 Contributors

• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)
• German Jablonski (@GermanJablo)
• Kendell (@kendelljoseph)
• Jake (@jacobsfletch)
• Jessica Rynkar (@jessrynkar)
• Paul (@paulpopus)
• Jens Becker (@jhb-dev)
• Patrik (@PatrikKozak)

v3.68.5 (2025-12-15)

🐛 Bug Fixes

• next: omit server url from route matching (#14919) (38c2f89)

🛠 Refactors

• add relative flag to formatAdminURL util (#14925) (4f12bee)

🤝 Contributors

• Jake (@jacobsfletch)

v3.68.4 (2025-12-14)

🐛 Bug Fixes

• previousValue from hooks should be populated within lexical blocks (#14856) (bb1501e)
• deps: enforce Next.js 15.4.10 (#14908) (7c675fa)
• next: properly construct local req url (#14907) (471cd1b)
• ui: show localized locale name for publish specific locale button (#14906) (848ea65)
• ui: relationship add button unsafe permissions property access (#14903) (127e41a)

📚 Documentation

• remove unused variable from custom field label translation (#14911) (77f96a4)
• update collection access control reference link on collection config page (#14905) (3a1eb77)

⚠️ BREAKING CHANGES

• deps: enforce Next.js 15.4.10 (#14908) (7c675fa)

  Address CVE-2025-67779.

🤝 Contributors

• Jake (@jacobsfletch)
• Riley Langbein (@rilrom)
• Jeffery To (@jefferyto)
• Aaron Claes (@AaronClaes)
• kat (@puzzlesremixed)
• Jessica Rynkar (@jessrynkar)

v3.68.3 (2025-12-11)

⚠️ Security Issue

• deps: bump minimum next version to 15.4.9 (#14898) (2ba4ee0)

A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) affect React 19 and frameworks that use it, like Next.js.

Full details here: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn you of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Resolution

You are strongly encouraged to upgrade your own apps to the nearest patched versions of Next.js and deploy immediately.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add next@15.4.9

For a full breakdown of the vulnerable packages and their patched releases, see https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app.

🐛 Bug Fixes

• passes serverURL through to all formatAdminURL calls (#14869) (b82356b)

🤝 Contributors

• Jake (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)

v3.68.2 (2025-12-10)

🐛 Bug Fixes

• next: use fileURLToPath for cross-platform path resolution (#14877) (e86098d)

Fixes Windows users getting ENOENT errors on dev startup.

• next: unhandled error in renderListView server function when no user present (#14878) (10a8f0f)
• next: merge user serverExternalPackages in withPayload (#14881) (dcecc46)

🛠 Refactors

• replace generic Error('Unauthorized') with UnauthorizedError (#14879) (c9a8aa0)
• next: remove unnecessary react hooks from DefaultTemplate rsc (#14876) (7a94cc1)

🏡 Chores

• translations: improve Vietnamese translations (#14886) (25ef7d1)

🤝 Contributors

• Rot4tion (@Rot4tion)
• Alessio Gravili (@AlessioGr)
• Maxim Seshuk (@maximseshuk)

v3.68.1 (2025-12-09)

🏡 Chores

• do not suggest vulnerable Next.js release in turbopack build error message (#14873) (9e0f593)

🤝 Contributors

• Alessio Gravili (@AlessioGr)

v3.68.0 (2025-12-09)

🚀 Features

• support turbopack build on Next.js canaries (#14845) (5ad4ebd)

---

Turbopack Build Support (next) - Automatically enables Turbopack Build compatibility when using Next.js ≥ 16.1.0-canary.3. The withPayload wrapper now detects supported versions and enables transitive dependency externalization, unlocking significantly faster production builds with Turbopack. #14845

---

🐛 Bug Fixes

• adds read and readDistinct to hook mapping (#14853) (0da0da8)
• undefined drafts error in collections with join fields (#14855) (3a29cec)
• use hasDraftsEnabled utility instead of direct check (#14843) (9c9c7c5)
• file objects being serialized to plain objects in upload form state (#14818) (d86c174)
• db-mongodb: correctly pass through collation config in the adapter to be applied in queries via locales (#11242) (db59cb4)
• plugin-multi-tenant: simplified getTenantOptions function and added access control for regular users (#14620) (f7cc078)
• storage-*: upload filename respects prefix (#14566) (ccfaee0)
• ui: component AddNewRelation saves relationTo as first collection instead of selected collection (#14836) (8c5c1fb)
• ui: list drawer per-page dropdown resets to 10 instead of showing saved limit (#14830) (db13a60)

📚 Documentation

• add note about returning a query from a readVersions access control (#14822) (0860837)

🧪 Tests

• speed up mongo test resets by preserving indexes (#14861) (d97a822)

🔨 Build

• add build:all:force to clean all then build all (d90bccb)
• bump swc-related dependencies (#14834) (617311a)

⚙️ CI

• remove prepack and prepublishonly scripts (#14832) (20914cc)
• add internal-debug release mode (#14820) (ce934b4)

🏡 Chores

• claude: create triage command (#14791) (d50b60e)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Alessio Gravili (@AlessioGr)
• Riley Langbein (@rilrom)
• Jarrod Flesch (@JarrodMFlesch)
• Adrian Maj (@AdrianMaj)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jeffery To (@jefferyto)
• Rot4tion (@Rot4tion)

v3.67.0 (2025-12-05)

🚀 Features

• add groupBy support to query presets (#14808) (2b7aa7a)
• plugin-ecommerce: add ability to enable guest carts with reworked access config (#14565) (90c92f4)

---

GroupBy Support for Query Presets - Query presets now save and restore groupBy state when switching between presets. Previously, groupBy settings would persist across preset switches and weren't saved as part of the preset configuration. #14808

<img width="711" height="684" alt="Preset creation with group-by added" src="https://github.com/user-attachments/assets/5fe6ee88-6ed7-40f6-b190-df6b2e89460c" />

---

Guest Carts (plugin-ecommerce) - Enable guest users to create and manage carts without authentication. Carts created by guests are secured with a generated secret stored in local storage. Configure with allowGuestCarts (enabled by default). Also adds isLoading status to all hooks for conditional UI state. #14565

// Before
ecommercePlugin({
  access: {
    adminOnly,
    adminOnlyFieldAccess,
    adminOrCustomerOwner,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
  }
})

// After
ecommercePlugin({
  access: {
    adminOnlyFieldAccess,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
    isAdmin,
    isDocumentOwner,
  }
})

🐛 Bug Fixes

• add missing beforeInput and afterInput properties to UploadAdmin type (https://github.com/payloadcms/payload/issues/14775) (https://github.com/payloadcms/payload/commit/22a0255)
• add missing afterOperation and beforeOperation hook calls (https://github.com/payloadcms/payload/issues/14778) (https://github.com/payloadcms/payload/commit/e9cd2a5)
• sanitized versions type was incorrect (https://github.com/payloadcms/payload/issues/14810) (https://github.com/payloadcms/payload/commit/51c951f)
• plugin-multi-tenant: moves getGlobalViewRedirect from utilities to rsc exports (https://github.com/payloadcms/payload/issues/14817) (https://github.com/payloadcms/payload/commit/1340818)
• ui: autosave not queued while background process is in flight (https://github.com/payloadcms/payload/issues/14805) (https://github.com/payloadcms/payload/commit/14f042f)
• ui: ensure block error css only gets applied to the affected block (https://github.com/payloadcms/payload/issues/14826) (https://github.com/payloadcms/payload/commit/7520140)
• ui: missing translation support in SelectMany component (https://github.com/payloadcms/payload/issues/14819) (https://github.com/payloadcms/payload/commit/8fa91a5)

⚡ Performance

• cpa: use AST for templates (https://github.com/payloadcms/payload/issues/14648) (https://github.com/payloadcms/payload/commit/bad6680)

⚙️ CI

• clean up bug report template for auto-labeling (https://github.com/payloadcms/payload/commit/ebee8e1)

🏡 Chores

• claude: add coding patterns and best practices section (https://github.com/payloadcms/payload/issues/14829) (https://github.com/payloadcms/payload/commit/c5d8e68)
• deps: bump @types/react and @types/react-dom to 19.2.1 (https://github.com/payloadcms/payload/issues/14815) (https://github.com/payloadcms/payload/commit/d56796b)
• deps: bump next to 15.4.8 in root and test dirs (https://github.com/payloadcms/payload/issues/14811) (https://github.com/payloadcms/payload/commit/1c3417d)

⚠️ BREAKING CHANGES

• plugin-ecommerce: add ability to enable guest carts with reworked access config (https://github.com/payloadcms/payload/issues/14565) (https://github.com/payloadcms/payload/commit/90c92f4)

This PR introduce a breaking change into the plugin as it was necessary in order to provide more secure guest carts.

🤝 Contributors

• Paul (@paulpopus)
• Jake (@jacobsfletch)
• Jessica Rynkar (@jessrynkar)
• Elliot DeNolf (@denolfe)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Jens Becker (@jhb-dev)

v3.66.0 (2025-12-03)

⚠️ Security Issue

A critical-severity vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks that use it, including Next.js (CVE-2025-66478).

You are strongly encouraged to immediately upgrade your own apps to the nearest patched versions of React and Next.js.

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of React or Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add react@19.2.1 next@15.4.8

To do this manually:

1. In your package.json:
   • Bump react to 19.2.1
   • Bump next to 15.4.8
2. Reinstall node modules, e.g. pnpm i
3. Redeploy your app

Here's a full breakdown of the vulnerable packages and their patched releases:

| Vulnerable package | Patched release | | ------------- | ------------- | | React | 19.0, 19.1, 19.2 19.0.1, 19.1.2, and 19.2.1 | | Next.js | 14.3.0-canary, 15.x, and 16.x (App Router) 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7 |

See https://github.com/payloadcms/payload/issues/14807 for more details.

🚀 Features

• support custom slugify functions (#14117) (59a1607)
• accessibility testing and improvements (#14454) (42cbd70)
• support external JSON schema file references in type generation (#14749) (cb3a078)
• cpa: assume adapter for with-cloudflare-d1 template (#14799) (4f03016)
• richtext-lexical: add align support to upload nodes (#14720) (a21c47b)

Feature Details

Custom Slugify Functions - Override the default slug field behavior with your own slugify function. Useful for special character encoding, additional language support, or custom slug formatting. Also deprecates fieldToUse in favor of useAsSlug for consistency with useAsTitle. #14117

import type { CollectionConfig } from 'payload'
import { slugField } from 'payload'
import slugify from 'slugify';

export const MyCollection: CollectionConfig = {
  // ...
  fields: [
    // ...
    slugField({
      slugify: ({ valueToSlugify }) => slugify(valueToSlugify, {
        // ...additional `slugify` options here
      })
    })
  ]
}

Accessibility Testing and Improvements - Adds automated accessibility testing infrastructure including axe a11y scans, focus indicator checks, and horizontal scroll overflow detection. Covers all fields, major views, components, plugins, and Lexical editor. See the a11y report discussion for tracked issues. #14454

External JSON Schema References in Type Generation - Enables $ref pointers to external .json schema files in typescriptSchema field config. External references are resolved relative to process.cwd(). #14749

// payload.config.ts
{
  typescript: {
    schema: [
      ({ jsonSchema }) => {
        jsonSchema.definitions.MyType = {
          $ref: './schemas/my-type.json'
        }
        return jsonSchema
      },
    ]
  }
}

Auto-detect D1 Adapter (cpa) - The with-cloudflare-d1 template now automatically assumes the D1 database adapter, eliminating the database selection prompt during project creation. #14799

Upload Node Alignment (richtext-lexical) - Adds alignment support to upload nodes in the Lexical editor. Upload/media blocks can now be aligned left, center, or right using the FORMAT_ELEMENT_COMMAND. #14720

🐛 Bug Fixes

• remove "all" from JSDoc comment on supported http methods in endpoints (#14777) (8c8def9)
• should exclude svg files from file buffer mime validation (#14751) (015b363)
• deps: bump minimum react and next versions (#14807) (2dfe464)
• plugin-import-export: incorrect user type in Export causing runtime type mismatch (#14790) (61f5aee)
• plugin-multi-tenant: tenant modal not appearing when autosave is off (#14806) (b96e928)
• plugin-multi-tenant: auto assign tenant when autosave is enabled (#14745) (b0674fa)
• richtext-lexical: copying and pasting a single block in Lexical results in an error due to duplicate ID (#14738) (cd9addf)
• richtext-lexical: export serverInlineBlock modules (#14739) (becceb7)
• translations: translate slug field actions (#14784) (5542e56)
• ui: prevent NaN page parameter in polymorphic relationship pagination (#14795) (bbdfdb8)
• ui: reduce spacing between checkbox and first column when few columns shown (#14776) (6ae1bc8)

📚 Documentation

• documents block field image aspect ratio (#14679) (b6a336e)
• document default password reset URL (#14688) (a68423b)
• adds strongly typed examples (#14513) (abe8563)

🧪 Tests

• deflake sort e2e (#14746) (a07cf47)

📝 Templates

• update with-cloudflare-d1 to the latest OpenNext and wrangler (#14509) (5150388)

⚙️ CI

• auto-label issues (#14792) (ee632d4)

🏡 Chores

• claude: enable obra/superpowers plugin (#14789) (32df641)

⚠️ BREAKING CHANGES

• deps: bump minimum react and next versions (#14807) (2dfe464)e

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Jake (@jacobsfletch)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jessica Rynkar (@jessrynkar)
• Tobias Odendahl (@tak-amboss)
• Ricardo Tavares (@rjgtav)

v3.65.0 (2025-11-25)

❗️Breaking Change

This release disables Turbopack Build support. Please use Webpack to build your app for now. You can do so by using pnpm build on Next.js 15 and pnpm build --webpack on Next.js 16.

🚀 Features

• add augmentable interfaces for collection and global custom properties (#14729) (850c252)
• allow to specify payload instance cache key in handleEndpoints (#14675) (efa2fd2)
• db-mongodb: add afterCreateConnection and afterOpenConnection hooks (#14649) (af6ba86)
• plugin-mcp: add localization support to MCP resource operations (#14334) (a3f490b)
• plugin-mcp: adds a PayloadRequest to custom tool, prompt, and resource handlers (#14644) (0d14b06)
• ui: extract block selector from blocks drawer (#14697) (b9b11f0)

Type-Safe Custom Properties - Add augmentable interfaces for collection and global custom properties: CollectionCustom, CollectionAdminCustom, GlobalCustom, and GlobalAdminCustom. Enables type-safe plugin configuration at the collection/global level with full autocomplete support, matching the existing FieldCustom pattern. #14729

// Augment interfaces in your plugin or project
declare module 'payload' {
  export interface CollectionAdminCustom {
    disabledFields?: string[]
  }

  export interface CollectionCustom {
    myPluginConfig?: {
      enabled: boolean
      settings: Record<string, any>
    }
  }
}

// Now get full type safety in collections
export const Posts: CollectionConfig = {
  slug: 'posts',
  admin: {
    custom: {
      disabledFields: ['status'] // ✅ Type-safe!
    }
  },
  custom: {
    myPluginConfig: {
      enabled: true,
      settings: {}
    }
  }
}

Payload Instance Cache Key - Specify payloadInstanceCacheKey in handleEndpoints and createPayloadRequest to control which cached Payload instance is used for custom endpoints. Useful for multi-tenant scenarios or when managing multiple Payload instances. #14675

MongoDB Connection Lifecycle Hooks (db-mongodb) - Add afterCreateConnection and afterOpenConnection hooks to the MongoDB adapter for performing setup logic after connection/pool initialization. Enables use cases like connection pooling in serverless environments. #14649

export const databaseAdapter = mongooseAdapter({
  // ...
  afterOpenConnection: async (adapter) => {
    const client = adapter.connection.getClient()
    attachDatabasePool(client);
  },
})

MCP Localization Support (plugin-mcp) - Add full localization support to MCP resource operations (create, update, find, delete). All MCP tools now accept locale and fallbackLocale parameters, bringing feature parity with Payload's REST API for multilingual content management. #14334

// Create content in English
{ "name": "createPosts", "arguments": { "title": "Hello", "locale": "en" }}

// Add Spanish translation
{ "name": "updatePosts", "arguments": { "id": "123", "title": "Hola", "locale": "es" }}

// Retrieve all translations
{ "name": "findPosts", "arguments": { "id": "123", "locale": "all" }}

PayloadRequest in MCP Handlers (plugin-mcp) - Custom tool, prompt, and resource handlers now receive a PayloadRequest object, enabling access to the Payload instance and consistent access control patterns without additional lookups. #14644

// Previously
handler: async (args: Record<string, unknown>) => {}

// Now with req parameter
handler: async (args: Record<string, unknown>, req: PayloadRequest, _extra) => {
  // Access payload instance, user, locale, etc.
  const { payload, user, locale } = req
}

Reusable Block Selector Component (ui) - Extract BlockSelector component from BlocksDrawer and export for external use. Includes new onSelect callback for custom side effects when blocks are selected. #14697

🐛 Bug Fixes

• trigger login hooks after reset password (#14711) (32560e9)
• ensure restoreAsDraft only updates the published doc when draft is false (#14658) (3f3f5db)
• remove init of transaction for global doc access (#14693) (c455f58)
• count versions should allow querying on localized fields (#14695) (e1168a0)
• prevent upload mimeType error when useTempFiles is true (#14689) (fe8a3e8)
• autoRefresh not working due to stale closure and missing in client config (#14612) (8a3c6dc)
• type TypeWithVersion missing latest property (#14676) (9b6e1a3)
• graphql version error in production (#14622) (cd5b344)
• corrects outgoing localized data from afterRead (#14603) (87137fe)
• relationships should not fallback if fallbackLocale is false (#14641) (9f55254)
• hide turbopack warnings (#14640) (03f19bc)
• logout-inactivity route gets stuck on loading indicator when inactivity and isLoggedIn are true (#14596) (7a31c02)
• tighten up error visibility handling (#14606) (c74a40f)
• claude: properly structure claude plugin (#14432) (3198bbe)
• db-*: do not exit process on error during connect (#14647) (ab03163)
• db-mongodb,drizzle: prevent race condition in transaction session cleanup (#14651) (a7cf30d)
• drizzle: postgres 18 support (#14700) (294ebf5)
• next: remove turbopack build support to fix bundle size regression (#14696) (c484a05)
• next: prevent transaction race condition in renderDocument parallel operations (#14652) (802a21a)
• plugin-multi-tenant: fix infinite sync tenant network calls (#14604) (8901c7b)
• richtext-lexical: block names were not loaded (#14698) (c7a87c0)
• ui: ensures modal closes on route change (#14718) (a044a08)
• ui: query preset crash with empty filters in postgres/sqlite (#14722) (42a4384)
• ui: app header overflow on mobile (#14704) (91d3e04)
• ui: shows minRowsProp instead of minRows (#14681) (e40a4b7)
• ui: publish label regression from 14690 (#14692) (ba5834b)
• ui: publish button shows locale-specific text without localized fields (#14690) (caf68e4)
• ui: equals filter shows no results when value is cleared (#14673) (220a18f)
• ui: select/relationship field values have no tooltip on hover (#14662) (bc23084)
• ui: bulk uploads silently skips files without filenames (#14621) (8f14359)
• ui: relationship field label not updated when document is updated from other drawer (#14609) (0cc06a1)
• ui: duplicate should duplicate as draft by default (#14619) (fb05840)

⚡ Performance

• up to 5000% faster permissions calculation (#14631) (0d9ec91)
• plugin-mcp: removes 'override' config (#14598) (89ab526)

🛠 Refactors

• db-mongodb,drizzle: reduce race condition window between retrieving and using a session (#14653) (bd9f15f)
• ui: strongly type render-list server action (#14611) (337409b)

📚 Documentation

• clarify draft parameter and _status field interaction (#14723) (00d9156)
• add info about imports and ui best practices (#14702) (38f370a)
• adds examples for sending email attachments (#14665) (61547f9)
• updates node version in docker file (#14664) (276685d)

🧪 Tests

• deflakes localization e2e suite (#14639) (6e364fa)
• fix auth e2e test suite flakiness (#14655) (78d5be6)
• adjust test targeting to wait for input (#14614) (36f3cad)
• fix flaky toast assertions in draft validation tests (#14615) (62508ca)

🏡 Chores

• getLocalizedPaths should filter fields with locale-like names (#14661) (fd7c94c)
• updates MCP docs (#14625) (61c61fe)
• claude: further improve payload skill (#14705) (89be107)
• db-mongodb: export transform function (#14677) (51898f5)

⚠️ BREAKING CHANGES

• plugin-mcp: removes 'override' config (#14598) (89ab526)

  • Removes override from the plugin config
  • Updates documentation

🤝 Contributors

• Patrik (@PatrikKozak)
• MrLijan (@MrLijan)
• Jessica Rynkar (@jessrynkar)
• Alessio Gravili (@AlessioGr)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)
• Elliot DeNolf (@denolfe)
• Jacob Fletcher (@jacobsfletch)
• Violet Rosenzweig (@6TELOIV)
• Kendell (@kendelljoseph)
• Dan Ribbens (@DanRibbens)
• Steven Ceuppens (@stevenceuppens)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Zvonimir Bušić (@ZvonimirBusic)

v3.64.0 (2025-11-13)

🚀 Features

• add support for UTC timezone in date fields (#14586) (8b34e40)
• next: turbopack build support, fix incorrect handling of external packages (#14475) (3a975d7)
• plugin-mcp: adds MCP context to req.payloadAPI (#14595) (860bdf2)
• plugin-mcp: adds custom auth config (#14538) (73a18dc)
• plugin-redirects: support translations (#14548) (ad8f0b2)

UTC Timezone Support - Add support for 'UTC' as a timezone value in date fields. Previously unsupported due to validation against Intl API runtime values. Also fixes issue where having only one timezone would make it selected by default. #14586

import { buildConfig } from 'payload'

const config = buildConfig({
  admin: {
    timezones: {
      supportedTimezones: [
        {
          label: 'UTC',
          value: 'UTC',
        },
      ],
      defaultTimezone: 'UTC',
    },
  },
})

Turbopack Build Support - Full support for Turbopack builds (now default in Next.js 16). Properly externalizes database adapter entry points to prevent production failures. Resolves issues with direct dependency externalization causing runtime errors. #14475

MCP Context Detection - Detect when Payload API calls originate from MCP context using req.payloadAPI === 'MCP'. Enables conditional logic in hooks based on MCP usage. #14595

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeRead: [
      ({ doc, req }) => {
        if (req.payloadAPI === 'MCP') {
          doc.title = `${doc.title} (MCP Hook Override)`
        }
        return doc
      },
    ],
  },
}

Custom Auth Configuration - Override default API key authentication with custom authorization logic using overrideAuth. Provides granular control over MCP access permissions. #14538

import { type MCPAccessSettings, mcpPlugin } from '@payloadcms/plugin-mcp'

plugins: [
  mcpPlugin({
    overrideAuth: (req) => {
      return {
        posts: { find: true },
        products: { find: true, update: true },
      } as MCPAccessSettings
    },
  })
]

Redirect Plugin Translation Support - Enable translations for plugin fields, eliminating need for verbose field overrides configuration. Configure field labels in multiple languages directly through i18n config. #14548

export default buildConfig({
  i18n: {
    translations: {
      en: {
        'plugin-redirects': {
          fromUrl: 'Source URL (Custom)',
        },
      },
      de: {
        'plugin-redirects': {
          fromUrl: 'Quell-URL',
          internalLink: 'Interner Link',
        },
      },
    },
  },
  plugins: [redirectsPlugin({ collections: ['pages'] })],
})

🐛 Bug Fixes

• previous value undefined for nested fields in afterChange (#14582) (d60ea6e)
• default values inconsistent between Local and REST APIs (#14556) (8f7ef35)
• findGlobalVersionByID id type (#14534) (99ed0e5)
• localized block fields (#14587) (2295c89)
• add secondary PDF mimeType validation and tests (#14529) (ce479ab)
• unlock access not being correctly denied when using a where query (#14585) (f63e34e)
• error when calling jobs.handleSchedules when there are no schedules defined (#14519) (072cb97)
• changing the language of the admin panel does not work for "radio" and "select" fields. (#14569) (bb520d6)
• inject custom translations into supportedLanguages in sanitization (#14549) (d7f1ea2)
• db-mongodb: localization transforms on nested localized fields (#14600) (6070d8d)
• db-mongodb: findVersions/findGlobalVersions not respecting limit of 0 (#14573) (43dcf84)
• graphql: avoid errors with sort as empty string (#14594) (fad476d)
• next: turbopack error when using db-d1-sqlite package (#14558) (bd6decf)
• next, ui: show status "changed" in List View (#14555) (565680d)
• plugin-form-builder: expose formSubmissionID as a variable to be used in emails (#14429) (ad74386)
• plugin-mcp: correctly uses local access controls (#14457) (fc2becf)
• richtext-lexical: urls being wrongly encoded by incomplete URL validation (#14557) (2cb0c59)
• storage-r2: respect data.prefix in handleUpload path construction (#14485) (454d0d3)
• ui: error on inserting new documents on uploads with hasMany (#14567) (fd44d2b)
• ui: save button becomes disabled after failed save with draft validation (#14584) (6fda71a)
• ui: invalid req.locale shows incorrect data (#14537) (f29a07f)

⚡ Performance

• ui: don't return full documents on bulk UI operations (#14145) (4430739)

🛠 Refactors

• richtext-slate: deprecate slate editor (#14536) (1a4ce44)

📚 Documentation

• updates Jobs queue docs (#14552) (dff3d1b)

🧪 Tests

• move draft validation tests from form-state to field error states test suite (#14599) (e1f07ff)
• run cpa against create-next-app latest and canary (#14583) (cca97c6)
• 21x faster versions int suite (#14510) (844f99f)

📝 Templates

• update next.js 15.4.4 to 15.4.7 (#14533) (d3b934c)

⚙️ CI

• fix ERR_PNPM_ADDING_TO_ROOT in create-payload-app int (#14581) (6789939)

🏡 Chores

• add .worktrees to .gitignore (87f2bd9)
• fix serverExternalPackages errors in monorepo (#14535) (e76da3f)

🤝 Contributors

• Kendell (@kendelljoseph)
• Jarrod Flesch (@JarrodMFlesch)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Jessica Rynkar (@jessrynkar)
• Sasha (@r1tsuu)
• Sam (@damnsamn)
• Alessio Gravili (@AlessioGr)
• Tobias Odendahl (@tak-amboss)
• Elliot DeNolf (@denolfe)
• Jens Becker (@jhb-dev)
• Sean Zubrickas (@zubricks)

v3.63.0 (2025-11-07)

🚀 Features

• add support for polymorphic uploads (#14363) (df40d0e)
• adds new UI option Duplicate In [Select Locales] (#13803) (53d8557)

Polymorphic Uploads

Upload fields can now reference multiple upload collections, similar to polymorphic relationships. This enables more flexible media management where a single field can accept different types of files from various collections. Works seamlessly with bulk upload and hasMany options. #14363

import type { CollectionConfig } from 'payload'

export const ExampleCollection: CollectionConfig = {
  slug: 'example-collection',
  fields: [
    {
      name: 'media',
      type: 'upload',
      relationTo: ['images', 'documents', 'videos'], // references multiple upload collections
    },
  ],
}

Can also be combined with hasMany:

import type { CollectionConfig } from 'payload'

export const ExampleCollection: CollectionConfig = {
  slug: 'example-collection',
  fields: [
    {
      name: 'media',
      type: 'upload',
      relationTo: ['images', 'documents', 'videos'], // references multiple upload collections
      hasMany: true, // allows multiple uploads
    },
  ],
}

🐛 Bug Fixes

• use TSiblingData for previousSiblingDoc in FieldHook (#14503) (339a0c3)
• support generic types for kv.get (#14494) (f6194c6)
• group-by sticky pagination not rendering for virtual relationship fields (#14470) (648021c)
• ensure importMap is reliably generated during HMR (fixes Next.js 16 issue) (#14474) (61a7095)
• hmr not working in next.js 16 (#14462) (0231a8d)
• disable lockedDocuments if the kv adapter uses a collection (#14453) (827c9a1)
• drizzle: postgesql where in jsonb (#13742) (207295b)
• graphql: sort by multiple fields (#14486) (b925d34)
• next: withPayload wrapper next.js 16 support (#14473) (c0de75e)
• next: version._status field queried/returned for entities without drafts (#14423) (a22dff3)
• plugin-cloud-storage: file sizes use correct mime type (#11633) (2410296)
• richtext-lexical: prevent unnecessary requests for inline blocks (#14522) (69408f0)
• richtext-lexical: bulk upload drawer rendered at the wrong depth if already in a drawer (#14472) (4fd8d03)
• ui: virtual fields disappearing from filter/groupBy dropdowns with access control (#14514) (a3c0e84)
• ui: safely access fieldPermissions (#14458) (2393721)
• ui: simplify UI orderable collections table by allowing only ascending order (#14433) (eba6cfc)

⚡ Performance

• ui: avoid unnecessary remounting of DraggableSortable (#14463) (91e64b3)

🛠 Refactors

• use formatNames utility for interface name generation (#14481) (39bead7)

📚 Documentation

• hooks terminology update (#13847) (245576b)
• plugin-mcp: clarify example (#14325) (c8d6cf0)

🧪 Tests

• use new chromium headless browser for playwright, bump playwright (#14464) (2bb5535)
• multi-tenant flake (#14447) (80d7781)

📝 Templates

• remove payload cloud template, remove cloud plugin from templates (#14479) (76ba2df)
• remove outdated cloning and payload cloud information (#14484) (d4d9622)

🔨 Build

• add kv-redis to publishList (#14416) (6420927)

⚙️ CI

• speed up workflow reruns, remove run_number from build cache key (#14448) (f67d031)
• add kv and plugin-mcp to valid PR scopes (be0943a)

🏡 Chores

• standardize query param parsing (#14498) (3c9f56e)
• enables folders on website template (#14116) (219fba2)
• bump kv-redis version (ff670c0)
• claude: update claude PostToolUse hook to only format on write (9f2adeb)
• claude: set some sane defaults (#14445) (aa14d86)
• claude: add analyze-issue command (#14435) (f1456a0)

🤝 Contributors

• Sasha (@r1tsuu)
• Elliot DeNolf (@denolfe)
• Chris Rieckmann (@c-riq)
• Sam Wheeler (@swheeler7)
• Alessio Gravili (@AlessioGr)
• Slava Nossar (@slavanossar)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Tobias Odendahl (@tak-amboss)
• Kendell (@kendelljoseph)
• Jessica Rynkar (@jessrynkar)
• German Jablonski (@GermanJablo)
• Sean Zubrickas (@zubricks)
• Violet Rosenzweig (@6TELOIV)

v3.62.1 (2025-11-03)

🐛 Bug Fixes

The KV implementation was requiring all postgres users to have to create a new migration. The following fix prevents that.

• disable lockedDocuments if the kv adapter uses a collection (#14453) (6930aaf)

v3.62.0 (2025-10-30)

🚀 Features

Jobs Access Control

Adds role-based access control for job queue and cancel operations, allowing you to restrict who can manage background jobs in your application. Both operations now support overrideAccess parameter and respect custom access control functions defined in your jobs configuration. #14404

// Configure access control
jobs: {
  access: {
    queue: ({ req }) => req.user?.roles?.includes('admin'),
    cancel: ({ req }) => req.user?.roles?.includes('admin'),
  }
}

// Use in Local API
await payload.jobs.cancel({
  where: { workflowSlug: { equals: 'sync' } },
  overrideAccess: false,
  req,
})

Per-Field Timezone Configuration

Date fields can now have individual timezone settings, allowing different date fields to support their own list of supported timezones with custom default values. This enables more flexible date handling across your application. #14410

{
  name: 'date',
  type: 'date',
  timezone: {
    defaultTimezone: 'America/New_York',
    supportedTimezones: [
      { label: 'New York', value: 'America/New_York' },
      { label: 'Los Angeles', value: 'America/Los_Angeles' },
      { label: 'London', value: 'Europe/London' },
    ],
  },
}

You can also enforce a specific timezone by specifying just one with a default value:

{
  name: 'date',
  type: 'date',
  timezone: {
    defaultTimezone: 'Europe/London',
    supportedTimezones: [
      { label: 'London', value: 'Europe/London' },
    ],
  },
}

KV Storage Adapters

Introduces a new key-value storage system with multiple adapter options (Database, In-Memory, Redis) for enhanced data persistence and performance. This provides the foundation for the upcoming Realtime API and other features requiring fast key-value access. #9913

Access the KV store via payload.kv with the following interface:

interface KVAdapter {
  /**
   * Clears all entries in the store.
   * @returns A promise that resolves once the store is cleared.
   */
  clear(): Promise<void>

  /**
   * Deletes a value from the store by its key.
   * @param key - The key to delete.
   * @returns A promise that resolves once the key is deleted.
   */
  delete(key: string): Promise<void>

  /**
   * Retrieves a value from the store by its key.
   * @param key - The key to look up.
   * @returns A promise that resolves to the value, or `null` if not found.
   */
  get(key: string): Promise<KVStoreValue | null>

  /**
   * Checks if a key exists in the store.
   * @param key - The key to check.
   * @returns A promise that resolves to `true` if the key exists, otherwise `false`.
   */
  has(key: string): Promise<boolean>

  /**
   * Retrieves all the keys in the store.
   * @returns A promise that resolves to an array of keys.
   */
  keys(): Promise<string[]>

  /**
   * Sets a value in the store with the given key.
   * @param key - The key to associate with the value.
   * @param value - The value to store.
   * @returns A promise that resolves once the value is stored.
   */
  set(key: string, value: KVStoreValue): Promise<void>
}

Configure the adapter using the kv property:

buildConfig({
  kv: adapter()
})

Database KV adapter (default) - Uses your existing database with a hidden payload-kv collection:

import { databaseKVAdapter } from 'payload'

buildConfig({
  kv: databaseKVAdapter({
    kvCollectionOverrides: {
      slug: 'custom-kv',
      ...(process.env.DEBUG === 'true' && {
        admin: { hidden: false },
        access: {},
      }),
    },
  }),
})

In Memory KV adapter - Fast memory-based storage for development:

import { inMemoryKVAdapter } from 'payload'

buildConfig({
  kv: inMemoryKVAdapter(),
})

Redis KV Adapter - Production-ready Redis integration:

pnpm add @payloadcms/kv-redis

import { redisKVAdapter } from '@payloadcms/kv-redis'

buildConfig({
  kv: redisKVAdapter({
    keyPrefix: "custom-prefix:", // defaults to 'payload-kv:'
    redisURL: "redis://127.0.0.1:6379" // defaults to process.env.REDIS_URL
  }),
})

Configurable Toast Position

Toast notifications can now be positioned anywhere on the screen (top-left, top-center, top-right, bottom-left, bottom-center, bottom-right), giving you control over where important messages appear to your users. This is particularly useful for applications with large screens or specific UI layouts. #14405

The position configuration is a direct pass-through of the Sonner library's position options, with 'bottom-right' remaining the default.

Feature PRs

• add access control for jobs queue and cancel operations (#14404) (0a37edb)
• timezone config can now be added on a per field basis (#14410) (a3df837)
• add KV storage adapters (#9913) (ffb9a2e)
• make toast position configurable (#14405) (d5fab43)
• ui: export useQueue React hook (#14396) (612880d)

🐛 Bug Fixes

• globals with versions return _status field when access denied (#14406) (b766ae6)
• custom dashboard component causes runtime error on create-first-user and account views (#14393) (d5f4e72)
• claude: remove invalid frontmatter fields (#14411) (118d005)
• db-*: findMigrationDir in projects without src folder (#14381) (059185f)
• db-mongodb: migration fails for cosmosDB (#14401) (10a640c)
• db-mongodb: type error with prodMigrations (#14394) (8e5e23a)
• db-mongodb: duplicate ids in sanitizeQueryValue (#11905) (36bb188)
• db-postgres: hasMany relationship/number/text fields inside blocks are incorrectly returned when using select (#14399) (850cc38)
• drizzle: number fields in generated schema with defaultValue (#14365) (8996b35)
• plugin-multi-tenant: remove unused syncTenants from useEffect deps (#14362) (906a3dc)
• richtext-lexical: do not run json.parse if value is undefined or null (#14385) (09a6140)
• richtext-lexical: prevent TS CodeBlocks from sharing Monaco model (useId) (#14351) (5caebd1)
• storage-*: update the client cache to use a map instead with cache keys per bucket config (#14267) (38f2e1f)
• ui: where builder crashing with invalid queries (#14342) (6c83046)

🛠 Refactors

• deprecate job queue depth property (#14402) (1341f69)
• ui: simplify ConfigProvider, improve useControllableState types and defaultValue fallback (#14409) (255320e)

⚙️ CI

• add claude as valid scope (560f2f3)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Alessio Gravili (@AlessioGr)
• Paul (@paulpopus)
• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Ossaid Qadri (@imossaidqadri)
• Philipp Schneider (@philipp-tailor)
• Kholiavko Roman (@kholiavko-roman)
• Jacob Fletcher (@jacobsfletch)
• Séalan Cronin (@sealan)
• Jarrod Flesch (@JarrodMFlesch)
• Justus Blönnigen (@technicaldirector)

v3.61.1 (2025-10-24)

🐛 Bug Fixes

• ui: ask before closing doc drawer with edits (#14324) (c1d017a)
• filteredLocales in the client config are stale (#14326) (5a37909)
• db-*: querying joins with $exists on mongodb and improve performance when querying multiple times on postgres (#14315) (1f166ba)
• db-postgres: regression in migrations in the _rels table (#14341) (a2b1c9b)
• plugin-search: add locale to key in syncedDocsSet (#14289) (c29e1f0)
• ui: account for array values in transformWhereToNaturalLanguage (#14339) (f2cabe7)
• ui: preview button not responding to conditional URL (#14277) (ad0e7b2)
• ui: use depth: 0 for publish specific locale request (#14313) (b68715e)

📚 Documentation

• various grammar and typo fixes (#14170) (c96d50d)
• adds example for name or label on groups field (#14323) (6d88f7d)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Boyan Bratvanov (@bratvanov)
• Sasha (@r1tsuu)
• Sean Zubrickas (@zubricks)
• Said Akhrarov (@akhrarovsaid)
• Paul (@paulpopus)

v3.61.0 (2025-10-23)

🚀 Features

• @payloadcms/plugin-mcp Released (BETA) - New plugin that enables Payload to function as an MCP server, allowing AI models to interact with your collections through a standardized protocol. The plugin provides built-in tools for CRUD operations on collections and supports custom tools. #13674
  • MCP Documentation
  • GitHub Discussion for feedback

🐛 Bug Fixes

• user updatedAt modified during session operations (#14269) (a1671ec)
• document header text clipping (#14291) (db973e9)
• typescript requires fields when draft: true despite passing draft: true (#14271) (1016cd0)
• blocks access control not respecting update access whether on collection or on a per field basis (#14226) (88cb687)
• allow slugField to accept localized argument and fixed slug generation with custom field names (#14234) (2ced43d)
• db-postgres: limit index and foreign key names length (#14236) (a63b4d9)
• drizzle: folders with trash enabled don't display documents in polymorphic joins (#14223) (6d3aaaf)
• plugin-form-builder: display full textarea content in form submissions (#14161) (24dad01)
• plugin-multi-tenant: block references issue (#14320) (4f8b7d2)
• plugin-search: exclude skipped drafts in reindex handler (#14224) (0dc782c)
• richtext-lexical: ensure block node form displays up-to-date value when editor remounts (#14295) (f8e6b65)
• richtext-lexical: node replacements ignored for block, inline block, upload, unknown and relationship nodes (#14249) (1561853)
• richtext-lexical, ui: ui errors with Slash Menu in Lexical and SearchBar component in RTL (#14231) (fed3bba)
• ui: document locked modal blocks interaction after clicking Go Back (#14287) (5782a41)
• ui: change password button being hidden and unlock button being shown incorrectly on account page (#14220) (bcb4d8e)

⚡ Performance

• richtext-lexical: decrease size of field schema, minor perf optimizations (#14248) (e25ce1c)
• richtext-lexical: do not return i18n from editor adapter (#14228) (54224c3)

🛠 Refactors

• richtext-lexical: ensure classNames of all nodes can be customized (#14294) (e1ef1d2)

📚 Documentation

• improve slate to lexical migration docs (#14309) (6838c56)
• db indexes - code example missing const (#14171) (3b37f4a)
• add explanation about re-renders in useFormFields (#14288) (8cdb5dc)
• add jsdocs to RichText adapter (#14246) (8b0ac01)
• clarify admin.timezones list configuration with example (#14238) (de5f3db)
• fix link to slug-overrides in text.mdx (#14211) (8136a84)
• add mention of the useUploadHandlers error and steps to remedy it with a mention to monorepos (#14233) (8663024)

🔨 Build

• add plugin-mcp to publishList (#14319) (894cf0c)
• add README sync for top-level -> packages/payload (#14316) (2aba827)

🏡 Chores

• extract snapshot logic, correct types in version ops (#14290) (c2dcd12)
• bump pino to v9.14.0 and pino-pretty (#14283) (b252658)
• refresh CLAUDE.md (#14268) (05a869d)
• cleanup, short-circuit .split calls (#14245) (d57be12)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Kendell (@kendelljoseph)
• Alessio Gravili (@AlessioGr)
• Patrik (@PatrikKozak)
• Boyan Bratvanov (@bratvanov)
• Paul (@paulpopus)
• German Jablonski (@GermanJablo)
• Bogdan Covrig (@bogdaaamn)
• Romain Pironneau (@romainpi)
• Sasha (@r1tsuu)
• Ahmed Abdellahi Abdat (@ahmed-abdat)
• Said Akhrarov (@akhrarovsaid)

v3.60.0 (2025-10-16)

🚀 Features

• accept multiple locales in fallbackLocale (#13822) (623a1b8)
• adds settingsMenu to admin navigation sidebar (#14139) (ee8b3cf)
• plugin-multi-tenant: allow collection access to be overridden via callback (#14127) (c40eec2)
• plugin-multi-tenant: allow hasMany on tenant field overrides (#14120) (fb93cd1)
• plugin-multi-tenant: user collection access overrides (#14119) (38b7a60)
• richtext-lexical: add collection filtering to UploadFeature, refactor relationship hooks (#14111) (6defba9)
• richtext-lexical: client-side block markdown shortcuts, code block (#13813) (07a1eff)

Localization

• Multiple fallback locales - fallbackLocale now accepts an array of locales for queries and locale configs. Payload will check each locale in order until finding a value, eliminating the need for manual fallback handling. #13822

  /** Local API **/
    await payload.findByID({
      id,
      collection,
      locale: 'en',
      fallbackLocale: ['fr', 'es'],
    })
  
  /** REST API **/
    await fetch(`${baseURL}/api/${collectionSlug}?locale=en&fallbackLocale[]=fr&fallbackLocale[]=es`)
  
  /** GraphQL **/
    await restClient.GRAPHQL_POST({
      body,
      query: { locale: 'en', fallbackLocale: ['fr', 'es']},
    })
  
  /** Locale Configs **/
    locales: [
      {
        code: 'en',
        label: 'English',
        fallbackLocale: ['fr', 'es'],
      },
    ]
  

Admin UI

• Settings menu in navigation - New admin.components.settingsMenu config option adds a gear icon above the logout button. Click to open a popup menu with custom admin-level utilities and actions that don't fit into collection or global navigation. #14139

  <img width="174" height="239" alt="Screenshot 2025-10-14 at 11 43 37 AM" src="https://github.com/user-attachments/assets/5dca8ea7-ed99-4bc1-89c2-bc6da7d8f323" />

Multi-Tenant Plugin

• Collection access overrides - New accessResultOverride callback allows modifying multi-tenant access control results per operation (read, create, update, delete, readVersions, unlock). Enables custom logic like allowing shared content across tenants. #14127

  multiTenantPlugin<ConfigType>({
    collections: {
      posts: {
        accessResultOverride: async ({ accessResult, accessKey, req }) => {
          // here is where you can change the access result or return something entirely different
          if (accessKey === 'read') {
            return {
              or: [
                {
                  isShared: {
                    equals: true,
                  }
                },
                accessResult
              ]
            }
          } else {
            return accessResult
          }
        }
      }
    }
  })
  

• Multiple tenants per document - Tenant field overrides now support hasMany relationships, allowing documents to belong to multiple tenants. #14120

• User collection access overrides - New usersAccessResultOverride callback enables customizing access control on the users collection, overriding default tenant privacy when needed. #14119

  usersAccessResultOverride: ({
    accessKey: 'read', // 'create', 'read', 'update', 'delete', 'readVersions', 'unlock'
    accessResult: AccessResult, // the `AccessResult` type
    ...args, // AccessArgs
  }) => {
    // this is where you could adjust what gets returned here.
    if (accessKey === 'read') {
      return true // over simplified example
    }
  
    // default to returning the result from the plugin
    return accessResult
  }
  

Lexical Rich Text

• Upload collection filtering - UploadFeature now supports disabledCollections and enabledCollections to control which collections appear in the upload drawer. Also refactors enabled relationships logic with cleaner useEnabledRelationships hook. #14111

• Client-side markdown shortcuts & code blocks - Blocks with admin.jsx now support markdown shortcuts on the client (previously server-only). Includes pre-made CodeBlock component for use in BlocksFeature. Also fixes readOnly handling across nested fields. #13813

  https://github.com/user-attachments/assets/cfc0d2a8-ffb3-4926-b097-ad9c2b133586

🐛 Bug Fixes

• findDistinct by explicit ID paths in relationships and virtual fields (#14215) (2b1b6ee)
• hasMany / polymorphic relationships to custom number IDs (#14201) (a3b3865)
• hide fields with read: false in list view columns, filters, and groupBy (#14118) (bcd40b6)
• validate Point Field to -180 to 180 for longitude and -90 to 90 for latitude (#14206) (13a1d90)
• urls in upload sizes are not encoded (#14205) (747a049)
• restoring trashed drafts with empty required fields fails validation (#14186) (3317207)
• db-d1-sqlite: add missing blocksAsJSON property (#14103) (f14a38e)
• db-mongodb: documents not showing in folders with useJoinAggregations: false (#14155) (e613a78)
• db-mongodb: improve check for ObjectId (#14131) (32e2be1)
• graphql: bump tsx version to get around esbuild vulnerability (#14207) (d7ec48f)
• next: custom views not overriding built-in single-segment routes (#14066) (691f810)
• plugin-multi-tenant: object reference mutations in addFilterOptionsToFields (#14150) (e62f1fe)
• richtext-lexical: state key collisions when multiple TextStateFeatures are registered (#14194) (f01a6ed)
• richtext-lexical: editor throws an error if OrderedList is registered but not UnorderedList or CheckList (#14149) (1fe75e0)
• richtext-lexical: editing a copied inline block also modifies the original (#14137) (5bacb38)
• richtext-lexical: correctly type field property of RenderLexical (#14141) (cd94f8e)
• richtext-lexical: improve type autocomplete and assignability for lexical nodes (#14112) (a46faf1)
• sdk: pagination is not passed to search params (#14126) (ee9f160)
• storage-gcs: bump @google-cloud/storage for vulnerability (#14199) (1077aa7)
• storage-r2: uploads with prefix don't work, add test/storage-r2 (#14132) (4fd4cb0)
• templates: encoding and decoding slugs in website template (#14216) (cacf523)
• templates: ecommerce seeding issue (#14196) (d65b8c6)

🛠 Refactors

• richtext-lexical: add jsdoc to deprecated HTMLConverterFeature (#14193) (0b718bd)

📚 Documentation

• revert sentry docs change (#14113) (8844eaf)
• incorrect pg driver injection example in Sentry integration docs (#14088) (95dbaed)

🧪 Tests

• allows running Jest tests through Test Explorer in VSCode and other improvements (#13751) (0d92a43)

⚙️ CI

• notify website repo on release [skip ci] (#14140) (a36e5d2)
• add website dispatch event, testing for releases [skip ci] (#14138) (b0d31ba)
• add missing labels to bug report template [skip ci] (#14134) (3069e5b)
• update generate-template-variations script to cover cloudflare template (#14105) (e78057b)

🏡 Chores

• better audit dependencies script (#14189) (f9e75a4)
• ignore agent local files [skip ci] (#14184) (7ecb5a0)
• drizzle: bump drizzle-orm and drizzle-kit for vulnerabilities (#14200) (4afa286)
• email-nodemailer: bump nodemailer dependencies to latest (#14121) (077c6f5)

🤝 Contributors

• Sasha (@r1tsuu)
• Patrik (@PatrikKozak)
• Paul (@paulpopus)
• Jessica Rynkar (@jessrynkar)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Elliott W (@elliott-w)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Diogo Gaspar (@shadowoff09)

v3.59.1 (2025-10-07)

🐛 Bug Fixes

• revert drizzle-orm (#14108) (ee78eb2)
• plugin-multi-tenant: not setting cookie properly on login (#14107) (5590535)
• ui: update memory user when autoLogin enabled (#14018) (c2fa629)

⚙️ CI

• update activity notification channels (72be9d3)

🏡 Chores

• update lock (7e12880)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)

v3.59.0 (2025-10-07)

🚀 Features

• slug field (#14007) (b09ae67)
• support any depth for relationships in findDistinct (#14090) (e4f8478)
• adds disableGroupBy to fields admin props (#14017) (537f58b)
• allow findDistinct on fields nested to relationships and on virtual fields (#14026) (9d6cae0)
• bundle types (#14020) (9bcb7b0)
• cpa: add cloudflare template to create-payload-app command (#14091) (e8140ed)
• db-*: adds support for readReplicas in D1 adapter config (#14040) (5a6f361)
• db-mongodb,drizzle: add atomic array operations for relationship fields (#13891) (7eacd39)
• next: export views, pass all props to custom dashboard view (#14094) (abebd24)
• plugin-nested-docs: pass collection config as an arg to generateURL and generateLabel (#14086) (db6ec30)
• ui: add support for disabling join field row types (#12738) (cd546b3)
• ui: live preview conditions (#14012) (2be6bb3)

🐛 Bug Fixes

• add detection for --experimental-https flag (#14085) (3cf3f93)
• missing cross-env in deploy:database (#14076) (709ee58)
• support USE_HTTPS for local hmr (#14053) (feaa395)
• update packages list for pnpm payload info (#14030) (4b6b0c5)
• autosave: true doesn't work on payload.update with where (#14001) (5d86d5c)
• db-d1-sqlite: avoid bound parameter limit when querying relationships and inserting rows (#14099) (444ca0f)
• db-mongodb: localized blocks with fallback and versions (#13974) (1e654c0)
• db-postgres: drizzle doesn't recognize types from the generated types (#14058) (ef84b20)
• db-postgres: querying multiple hasMany text or number fields (#14028) (95bdffd)
• db-postgres: joins count with hasMany relationships (#14008) (1510e12)
• drizzle: generate DB schema syntax is deprecated (#14031) (ef57d24)
• graphql: error querying hasMany relationships when some document was deleted (#14002) (48e9576)
• next: force inactive live preview after passing conditions (#14048) (ca3f054)
• next: prevent locale upsert when not authenticated (#13621) (ece5a95)
• plugin-ecommerce: variants validateOptions errors with SQLite when creating a new variant (#14054) (3b9e759)
• plugin-multi-tenant: rm chalk dep (#14003) (d017499)
• plugin-search: handle trashed documents in search plugin sync (#13836) (de352a6)
• richtext-lexical: field.admin overrides were ignored in RenderLexical helper (#14024) (810da54)
• richtext-lexical: slash menu arrows keys not respected when block nearby (#14015) (54b6f15)
• sdk: incorrect fetch initialization on cloudflare (#14009) (a5c8b5b)
• storage-r2: upload with the correct contentType (#13988) (066997d)
• storage-uploadthing: hide key field from filters and columns (#14004) (2ce6e13)
• templates: ignore wrangler when bundling to fix template styles (#14067) (c135bf0)
• templates: added missing CLOUDFLARE_ENV in cloudflare template when optimizing database (#14064) (9fcd1fa)
• templates: don't use remote bindings in cloudflare template when developing locally (#14063) (9d3e540)
• templates: ecommerce wrong links in readme and docs and issue with missing graphql dependency (#14045) (e4f90a2)
• templates: correct typo in footer text (#14021) (a938ad6)
• translations: refine Persian (fa) translations for clarity and natural tone (#14082) (990603c)
• translations: fixes to Icelandic translations (#14038) (7088d25)
• translations: fixes to Swedish translation (#13994) (4b193da)
• ui: phantom fields when duplicating rows with rows (#14068) (08f6d99)
• ui: invalid time value error when document locking with autosave enabled (#14062) (394000d)
• ui: undefined access with polymorphic joins and fix joins test config (#14057) (cb7a24a)
• ui: popup list controls overlap with table in list view (#13967) (1e23882)
• ui: upload dropzone error when collectionConfig is undefined (#14043) (62fcf18)
• ui: saving empty code editor throw error (#14019) (bffb9ef)
• ui: add support back for custom live preview components (#14037) (d826159)
• ui: array fields not respecting width styles in row layouts (#13986) (accd95e)

⚡ Performance

• graphql: select only the requested columns (#13711) (c819083)
• templates: added cloudflare cache headers for static files (#14069) (c59df45)

📚 Documentation

• readme changes - add one-click deployment options and improve templates section (#14092) (a88e3c5)
• update README.md (#11297) (c8661da)
• adds comprehensive virtual field configuration documentation (#13942) (10e5042)
• db-mongodb: fix note on indexing localized fields (#14071) (9c08fb8)

📓 Examples

• fix revalidation hook in localization example (#14014) (267ea9e)

⚙️ CI

• update pr-title commit scopes (#14055) (fa28dca)
• add linked PRs to new issue notifications (#14059) (bbff65c)

🏡 Chores

• ci changes to add compatibility for mongodb alternates (#13898) (9ceee8e)
• update d1 cloudflare template package versions (#13977) (7601835)
• eslint: set reportUnusedDisableDirectives to error (#14011) (209b1f1)
• templates: bump sharp version in ecommerce template (#14089) (836e0f7)

🤝 Contributors

• Jacob Fletcher (@jacobsfletch)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Alessio Gravili (@AlessioGr)
• Dan Ribbens (@DanRibbens)
• Nate Caminata (@ncaming)
• Marwin Hormiz (@marwinhormiz)
• rfwn࿐ (@rfwn)
• Jeffery To (@jefferyto)
• Ricardo Tavares (@rjgtav)
• Patrik (@PatrikKozak)
• Kamal (@kamal0620040)
• Elliot DeNolf (@denolfe)
• gursh (@gurshdev)
• Said Akhrarov (@akhrarovsaid)
• Jarrod Flesch (@JarrodMFlesch)
• Riley Langbein (@rilrom)
• Valur Sverrisson (@Valur)
• Marcus Forsberg (@marcusforsberg)
• Aurimar Lopes (@AurimarL)
• Jan Beck (@jancbeck)
• Tobias Odendahl (@tak-amboss)

v3.58.0 (2025-09-30)

🚀 Features

Ecommerce plugin and template (#8297) (ef4874b)

The Ecommerce Template and Plugin is now ready in beta, you can get started by running the Payload CPA command below

pnpx create-payload-app my-project -t ecommerce

Full docs are available on our website

Payload SDK package (#9463) (92a5f07)

Allows querying Payload REST API in a fully type safe way. Has support for all necessary operations, including auth, type safe select, populate, joins properties and simplified file uploading. Its interface is very similar to the Local API.

import { PayloadSDK } from '@payloadcms/sdk'
import type { Config } from './payload-types'

// Pass your config from generated types as generic
const sdk = new PayloadSDK<Config>({
  baseURL: 'https://example.com/api',
})

// Find operation
const posts = await sdk.find({
  collection: 'posts',
  draft: true,
  limit: 10,
  locale: 'en',
  page: 1,
  where: { _status: { equals: 'published' } },
})

New Cloudflare D1 SQLite adapter, R2 storage adapter and Cloudflare template (#12537) (99043ee)

You can now deploy directly to Cloudflare using our 1-click template or click the deployment button below

🐛 Bug Fixes

• ensure blocks filterOptions are awaited (#13960) (41aa201)
• sanitize collection labels to inherit defaults when only a partial config is provided (#13944) (1752043)
• avoid relying on Function.prototype.name to detect react components (#13931) (4652bd0)
• next: static live preview url corrupt after save (#13949) (3c4f8a3)
• plugin-multi-tenant: properly localize labels (#13943) (2cc34d1)
• richtext-lexical: editor re-mounting on save due to json key order not being preserved in postgres (#13962) (6a2e814)
• ui: query preset where field not displaying array values (#13961) (9248fc4)
• ui: move collection description below title in document view (#13946) (ae34b6d)

⚙️ CI

• add @payloadcms/sdk to publish list (#13964) (f9743b4)
• add cron to activity notifications [skip ci] (#13959) (6d995ff)
• proper path for activity notifications [skip ci] (2514e4d)
• activity-notifications debug inputs (ba33f2f)
• github activity slack notifications (#13955) (4562df7)

🏡 Chores

• update templates and docs links (#13971) (d7888df)
• rename activity notifications workflow (f7b1b7b)
• sdk: add README (#13975) (2e1fb57)

🤝 Contributors

• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Jarrod Flesch (@JarrodMFlesch)
• Luke Sandberg (@lukesandberg)

v3.57.0 (2025-09-25)

🚀 Features

• adds admin.formatDocURL function to control list view linking (#13773) (1d1240f)
• conditional blocks (#13801) (d8dace6)
• support hasMany virtual relationship fields (#13879) (1072171)
• next: regenerate live preview url on save (#13631) (00a673e)
• plugin-form-builder: allow creating form submissions from the admin panel (#11222) (104a5fc)
• plugin-multi-tenant: improves tenant assignment flow (#13881) (fcb8b5a)
• richtext-lexical: support copy & pasting and drag & dopping files/images into the editor (#13868) (59414bd)
• richtext-lexical: utility render lexical field on-demand (#13657) (1c89291)
• translations: add Tamil translations (#13788) (7975fe3)

🐛 Bug Fixes

• server component readonly state issues with document locking (#13878) (512a8fa)
• make input/output encoding explicit in auth/crypto's encrypt/decrypt (#13710) (7f35213)
• pagination returning duplicate results when timestamps: false (#13920) (062c1d7)
• add missing translation key (#13902) (39143c9)
• findDistinct with polymorphic relationships (#13875) (e99e054)
• admin.hidden not respected for RSCs, render-field server function not respecting field-overrides client-side (#13869) (228e8f2)
• exits handlers loop if response is returned (#13866) (425172c)
• support hasMany: true relationships in findDistinct (#13840) (d0543a4)
• removes select argument from create operation db calls (#13841) (a26d8d9)
• db-postgres: localized relationships inside blocks (#13760) (22ae9fa)
• db-sqlite: exists operator in createJSONQuery (#13907) (f980a86)
• graphql: graphql tab schema not handling tabs correctly (#13850) (83b6e37)
• next: clear bfcache on forward/back (#13913) (f868ed9)
• next: groupBy for polymorphic relationships (#13781) (9c20eb3)
• plugin-import-export: collectionSlug field regression from hidden field changes (#13917) (96c6612)
• plugin-multi-tenant: ensure relationship filter filters based on doc.tenant (#13925) (cbbf98e)
• plugin-multi-tenant: improve Norwegian translation for "tenant" (#13923) (dea91f3)
• plugin-search: transaction state errors in parallel reindex operations (#13915) (79b2557)
• plugin-search: returns doc instead of empty return (#13916) (68882aa)
• plugin-seo: allow number ids & resolved relations for image auto-generation (#13906) (abbe38f)
• richtext-lexical: remove unexpected spaces in link html converter (#13924) (c230005)
• richtext-lexical: richtext field duplicates description custom component (#13880) (66f5d14)
• richtext-lexical: prevent disallowed headings to be pasted (#13765) (207caa5)
• translations: adjust some zh translations (#13867) (ae7b75a)
• translations: correct Ukrainian language translations (#13639) (5b5eaeb)
• translations: missing noLabelGroup translation key for Tamil translations (#13896) (cb23aaf)
• ui: opening relationship field with appearance: "drawer" inside rich text inline block closes drawer (#13830) (7bbd07c)
• ui: corrects url for publish specific url (#13922) (662bab2)
• ui: array field state to return empty array instead of 0 (#11283) (3f5c989)
• ui: folder filters hidden behind results (#13908) (5c81342)
• ui: custom folder slug in browse-by (#13909) (4975b8d)
• ui: query folder children with depth and select (#13910) (984f1b3)
• ui: revert-to-published button showing on new drafts (#13897) (82d98ab)
• ui: bulk upload with locale param (#13865) (667c4f1)
• ui: ensures visible list view thumbnails with enableListViewSelectAPI (#13864) (82aade2)
• ui: respect editorOptions, prevent field from flashing on save (#13848) (5241113)
• ui: set prefetch false on Link buttons (#13846) (33228d9)

⚡ Performance

• graphql: use depth 0 in auth/apiKey for graphQL requests (#13895) (9a59562)
• ui: use select API in RelationshipProvider to speed up load times in RelationshipCell (#13832) (77cac30)

🛠 Refactors

• richtext-lexical: new upload node design (#13901) (bea77f2)
• translations: correct i18n translation for Norwegian (#13854) (b7f6e3c)

📚 Documentation

• corrects link for experimental features topic (#13862) (b1e5bd9)
• clarify JWT token encryption / decryption in configuration docs (#13816) (0a5b7b0)

⚙️ CI

• remove v2 issue template (f39c7bf)

🏡 Chores

• revert docs label change (c33c037)
• update documentation issue template (ae95d58)
• consolidate canAccessAdmin logic (#13849) (42b5935)
• deps: bump @faceless-ui/modal to v3.0.0 (#13842) (9a8e3f8)

🤝 Contributors

• Alessio Gravili (@AlessioGr)
• Elliot DeNolf (@denolfe)
• Dan Ribbens (@DanRibbens)
• roboin (@Robot-Inventor)
• Jacob Fletcher (@jacobsfletch)
• Anders Semb Hermansen (@andershermansen)
• Jie Wang (@escwxyz)
• aptt (@apttx)
• Ricardo Tavares (@rjgtav)
• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Sasha (@r1tsuu)
• Jessica Rynkar (@jessrynkar)
• Паламар Роман (@VeiaG)
• Anil Shebin S J (@AnilShebin)
• German Jablonski (@GermanJablo)
• Jens Becker (@jhb-dev)
• Sean Zubrickas (@zubricks)
• Kwan Jun Wen (@junwen-k)

v3.56.0 (2025-09-17)

🚀 Features

• pass args to task onSuccess and onFail callbacks (#13269) (3acdbf6)
• crons for all bin scripts, new jobs:handle-schedules script, more reliable job system crons (#13564) (cdeb828)
• expose multipart/form-data parsing options (#13766) (8282031)
• global beforeOperation hook (#13768) (3af546e)
• ui: export FieldPathContext (#13806) (a3acfeb)

🐛 Bug Fixes

• add missed pagination property to findVersions and findGlobalVersions and handle it properly (#13763) (a955392)
• skip validation when trashing documents with empty required fields (#13807) (3b13867)
• versions created with incomplete data when using select parameter (#13809) (faed3aa)
• error accessing sanitizedPermissions during docAccess operation: "Cannot read properties of undefined" (#13800) (c7795fa)
• typo in the description of the isTemp field of query presets (#13728) (e75bfb0)
• fully sanitize unauthenticated client config (#13785) (e2632c8)
• client config context inheritance (#13790) (dfb0021)
• db-mongodb: support 2x and more relationship sorting (#13819) (24ace70)
• db-mongodb: localized arrays inside blocks with versions (#13804) (09dec43)
• examples: secure mt example users collection (#13810) (9a841df)
• live-preview: client-side live preview failed to populate localized fields (#13794) (b34e5ea)
• live-preview: reset cache per subscription and ignore invalid preview messages (#13793) (b62a30a)
• next: unnamed, unlabeled groups displayed without label in version view (#13831) (8d3b146)
• next: sparse block and arrays diffs were not rendered correctly (#13829) (433c513)
• next: exclude permissions from page response when unauthenticated (#13796) (8113d3b)
• next: richtext field is read-only for expired lock (#13789) (4278e72)
• next: login redirect crashes page (#13786) (13af91f)
• next: resolve filterOptions by path (#13779) (8a7124a)
• translations: use correct Dutch terms for "clear" and "close" (#13748) (fce94d6)
• ui: pass locale arg in query params for folder operations (#13837) (c0684e3)
• ui: correct field path in inline create drawer for auth fields (#13815) (91e7f0c)
• ui: populate nested fields for enableListViewSelectAPI (#13827) (dc732b8)
• ui: cross-domain server-side live preview throws postMessage error (#13825) (731c4fb)
• ui: undefined operators for virtual field with unsupported field types (#13820) (5c02d17)
• ui: prevent form validation after draft submit error (#12918) (a2c31fa)
• ui: show loading state in relationship field during search and pagination (#13805) (555228b)
• ui: safely access preferences when loading list view (#13771) (4482eaf)

📚 Documentation

• improvements and fixes to blocks documentation (#13782) (3c5aa1b)

📝 Templates

• fix experimental-build-mode compile generating invalid code (#13828) (ba2ab2f)

⚙️ CI

• adjust audit-dependencies cron time (898e937)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jonathan Elmgren (@jonathanelmgren)
• Sasha (@r1tsuu)
• Jacob Fletcher (@jacobsfletch)
• Patrik (@PatrikKozak)
• Slava Nossar (@slavanossar)
• Philipp Schneider (@philipp-tailor)
• Elliot DeNolf (@denolfe)
• Amelia (@LimChorngUan)
• BrannanKovachev (@BrannanKovachev)
• Robbe Vaes (@Robbe95)
• Robbert Stevens (@robbertstevens)
• Anders Semb Hermansen (@andershermansen)
• German Jablonski (@GermanJablo)

v3.55.1 (2025-09-10)

🐛 Bug Fixes

• presentational-field types incorrectly exposing hooks (#11514) (285fc8c)
• graphql: pass collectionSlug to nested join fields in tabs, collapsible and group resolvers (#13752) (e52b757)
• next: error after logging in and navigating to different page in production (#13758) (e40c821)
• ui: listSearchableFields can resolve to multiple fields with the same name when using tabs (#13668) (ffed540)

📝 Templates

• ensure blank template installs matching react-dom version (#13757) (15e462b)

🤝 Contributors

• Dallas Opelt (@DallasO)
• Alessio Gravili (@AlessioGr)
• German Jablonski (@GermanJablo)
• timeo-schmidt (@timeo-schmidt)
• Elliot DeNolf (@denolfe)

v3.55.0 (2025-09-09)

🚀 Features

• adds disableListColumn and disableListFilter to imageSize admin props (#13699) (e1ea074)
• unauthenticated client config (#13714) (e49005f)
• adds new experimental.localizeStatus option (#13207) (0f6d748)
• live-preview: client-side live preview: simplify population, support hooks and lexical block population (#13619) (6e203db)
• richtext-lexical: upgrade lexical from 0.34.0 to 0.35.0 (#13715) (7a8bcdf)
• richtext-lexical: upgrade lexical from 0.28.0 to 0.34.0 (#13622) (1a1696d)
• richtext-lexical: add options to hide block handles (#13647) (fdab271)
• ui: save collection folder tab preferences (#13702) (6a0637e)
• ui: adds admin.autoRefresh root config property (#13682) (f288cf6)

🐛 Bug Fixes

• ensure client-side live preview correctly updates for globals (#13718) (03f7102)
• set X-Payload-HTTP-Method-Override as allowed cross origin header (#13717) (a4a0298)
• update user session on reset (#13667) (d9e1832)
• prevent enabling trash on folders (#13675) (be47f65)
• db-sqlite: convert Date to ISO 8601 string in queries (#11694) (917c66f)
• next: version diff view not handling all field permissions correctly (#13721) (911f17a)
• next: display deleted relations and uploads in version diff views (#12955) (bbcdea5)
• next: version diff view shows correct document title in step nav (#13713) (794bf82)
• plugin-multi-tenant: hide watchTenant column field (#13740) (a0112d7)
• plugin-multi-tenant: skip baseFilter if user has access to all tenants (#13633) (65b3845)
• plugin-nested-docs: prevent phantom breadcrumb row (#13628) (a231a05)
• plugin-nested-docs: crumbs not syncing on non-versioned collections (#13629) (4600c94)
• plugin-search: update with db adapter on create (#13670) (1293019)
• richtext-lexical: fix picture closing tag in html converter (#13100) (24e436b)
• richtext-lexical: add internationalization support for default style label in textStateFeature (#13662) (0c44c3b)
• storage-vercel-blob: filename is incorrectly stored encoded when addRandomSuffix is true (#13746) (b2f9d4e)
• templates: URI encode the cacheTag in getMediaUrl utility - Website template (#13558) (008a52d)
• ui: consistent searchbar across folders and lists (#13712) (09e3174)
• ui: cannot filter by virtual relationship fields in WhereBuilder (#13686) (7e98fbf)
• ui: undefined permissions passed in create-first-user view (#13671) (5146fc8)
• ui: don't populate on auto save (#13649) (7794541)
• ui: use consistent row ids when duplicating array and block rows (#13679) (b8d7ccb)
• ui: field.admin.condition data attribute missing document ID when document is being edited (#13676) (a115868)
• ui: await for publish success to update the UI (#13673) (9b10933)
• ui: sidebar missing sticky top offset (#13652) (1c68ed5)
• ui: should not show publish specific locale button when no localized fields exist (#13459) (ac691b6)
• ui: json field type ignoring editorOptions (#13630) (426f99c)

⚡ Performance

• plugin-search: reindex collections in parallel, up to 80% faster (#13608) (b99c324)
• ui: opt-in to the select api in the list view (#13697) (d2d2df4)

📚 Documentation

• missing comma in custom-strategies example (#13701) (27cfe77)
• plugin-form-builder: add RadioField documentation (#13529) (4e972c3)

🧪 Tests

• increase timeout in uploads cors test (#13743) (a528a55)

⚙️ CI

• deps: bump the github_actions group across 3 directories with 4 updates (#13654) (cfb70f0)

🏡 Chores

• add AGENTS.md (#13688) (d109b44)
• ui: prevent loading orphaned documents when viewing root collection folders (#13684) (9f0573d)

🤝 Contributors

• Patrik (@PatrikKozak)
• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Jacob Fletcher (@jacobsfletch)
• Ilham Saputrajati (@ilhamsj)
• Cedric Delacombaz (@cdelacombaz)
• Said Akhrarov (@akhrarovsaid)
• Aapo Laakkio (@ApsiV11)
• Anders Semb Hermansen (@andershermansen)
• German Jablonski (@GermanJablo)
• Yazal Ulloa (@yazalulloa)
• Elliot DeNolf (@denolfe)
• Jessica Rynkar (@jessrynkar)
• reiv (@reiv)
• Riley Langbein (@rilrom)