v4.0.0-beta.7 (2026-11-04) ⚠️ Contains vital security updates. We encourage updating as soon as possible. 🚀 Features add refresh tokens (#19040) (1410829) add sessionExpiration to addSessionToUser (#19046) (ec35164) add auth.passwordHashIterations for environments that limit PBKDF2 (#19070) (28f19dc) ui: add combobox slots and consistent search (#19162) (c332a5b) 🐛 Bug Fixes enforce pasteURL restr…
v3.93.0 (2026-11-04) ⚠️ Contains vital security updates. We encourage updating as soon as possible. 🚀 Features add auth.passwordHashIterations for environments that limit PBKDF2 (3.x) (#19074) (488f183) 🐛 Bug Fixes enforce block child read access in queries (21bdbbf) restrict blocks to each field's configured types (cfa60ea) enforce pasteURL restrictions on remote URL uploads (9071e58) apply xml r…
v4.0.0-beta.6 (2026-10-29) 🚀 Features support custom CLI error exit codes (#19079) (4bb6ed2) ui: always restore versions as drafts (#18892) (7d76f23) 🐛 Bug Fixes cpa: generate v4-compatible storage and sharp config (#19120) (e3ef5b2) db-d1-sqlite: register findDistinct on sqliteD1Adapter (#19128) (3784f7e) deps: bump sharp to 0.35.5 (#19117) (c17d081) drizzle: lazily load drizzle kit tooling (#176…
v3.92.1 (2026-10-27) 🐛 Bug Fixes localizeStatus PG migration db.execute signature (#16889) (05f4000) upload processed client files from temp file for upload-thing storage (#19010) (ea3778b) run the password field's validation on reset password (3.x) (#18980) (779f06f) graphql: port virtual fields should be nullable in GraphQL schema (#17256) (1a028cb) plugin-cloud-storage: store processed bytes fo…
v4.0.0-beta.5 (2026-10-27) 🐛 Bug Fixes pass extra uploadReference fields as clientData (#19033) (cdb8ec4) public upload receipts with signed adapterData (#19032) (3355177) let plugins replace another plugin's options (#18762) (aebbf75) run the password field's validation on reset password (#19006) (0c74c77) graphql: exclude hidden fields from mutation inputs (#18862) (e442a3f) ui: preserve diagona…
v3.92.0 (2026-10-22) 🐛 Bug Fixes bump minimum node version to 22.23.4 (#18957) (7440041) bump undici to 7.30.1 (3.x) (#18950) (e091098) pass document id to field access (#18269) (3165b35) set error names explicitly to survive minification (3.x) (#18775) (4173db9) validate each locale when writing localized fields with locale all (3.x) (#18500) (8ef7658) db-mongodb: support limit 0 in joins across…
v4.0.0-beta.4 (2026-10-22) 🚀 Features accessibility improvements related to contrast (#18354) (f597932) ui: open recents widget on recently viewed when nothing is pinned (#18747) (133be0f) 🐛 Bug Fixes bump undici to 7.30.1 (#18949) (20aa089) bump minimum node version to 24.22.1 (#18946) (26f56ad) cancel unused file transformer streams (#18952) (494de46) align global version restoration with collec…
v4.0.0-beta.3 (2026-10-19) 🚀 Features support cache components (#18702) (4d05bcd) 🐛 Bug Fixes stabilize a11y flaky e2e tests (#18632) (edb4335) validate each locale when writing localized fields with locale all (#18502) (e10d8a6) next: render admin at request time with cache components (#18694) (401f12e) tanstack-start: prevent subtree remounts on router refresh (#18806) (d5b01b4) ui: hide fields…
v4.0.0-beta.2 (2026-10-16) 🚀 Features tanstack-start: update to stable TanStack Start (#18700) (32c06ff) 🐛 Bug Fixes show file sizes with one decimal by default (#18683) (81d3070) prevent duplicate hierarchy fields when collection config is reloaded (#18710) (3da270a) email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18737) (50295c7) richtext-lexical: hide placeholders in…
v3.91.0 (2026-10-15) 🚀 Features plugin-mcp: add missing properties to find tools, clean up object inputs (#18436) (0f6c5b0) 🐛 Bug Fixes return 404 for version operations when versions are disabled (#18057) (d72c669) prevent join field where mutation during query validation (#18511) (5060fee) bump minimum node version to 20.18.1 (#18467) (fe030c5) dev HMR reload not working when Next.js basePath is…
v4.0.0-beta.1 (2026-10-13) 🐛 Bug Fixes codemod: default upgrade tag to beta (#18649) (8246dda) ui: hide required-fields info button (#18696) (028f076) 📚 Documentation fix topic order and title (#18648) (0cb6d0c) cleans up headings that contained code blocks (#18641) (b103a85) Add @beta to create-payload-app instruction (#18646) (ea766b6) 📝 Templates theme selector type error with @radix-ui/react-s…
v4.0.0-beta.0 (2026-10-09) More details to come next week To try this out: npx create-payload-app@beta 🚀 Features Admin UI redesign TanStack support Dashboard components Accessibility Hierarchies Tags Grid View Improved File Uploads UI File upload versions Rewritten MCP Upgrade scripts (codemods) Foundational improvements 📚 Documentation Beta version documentation can be found at https://payloadcm…
v4.0.0-canary.39 (2026-10-08) 🚀 Features remove deprecated APIs flagged for 4.0 (#18607) (2165d19) validate all locales by default (#17879) (cc74a1e) remove deprecated AdminContext properties and DiffMethod type (#18598) (b221c7a) add upload file versioning (#18548) (ec3d99e) 🐛 Bug Fixes return 404 for version operations when versions are disabled (#18618) (1a89873) replace remaining http-status i…
v4.0.0-canary.38 (2026-10-07) 🚀 Features bump min. next.js version to 16.4 (#18569) (9bc6cae) add new payload.validate() operation for on-demand validation of documents (#17557) (019deca) manage LLM instructions in the admin (#18373) (4d0796c) include configured LLM instructions in CLI and MCP schemas (#18372) (4d7a5ba) improve PR demo scrolling and publishing (#18542) (32b5694) add file transform…
v3.90.0 (2026-09-18) ⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible. These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack su…
v4.0.0-canary.37 (2026-09-24) 🚀 Features default overrideAccess to false in the Local API (#17869) (744bfcf) publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003) codemod: add agent-assisted upgrade command (#17825) (c44404c) tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50) 🐛 Bug Fixes update deprecated mongodb new option (#182…
v3.90.2 (2026-09-23) 🐛 Bug Fixes await slugify func to match type (#18181) (3fad98e) next: remove invalid libsql tracing include (#18238) (972a4fb) next: support next.config trailingSlash (#18207) (05e49da) plugin-cloud-storage: forward alwaysInsertFields when the plugin is enabled (#18222) (f5d261d) plugin-mcp: create/update tools crash the MCP endpoint under TypeScript 6 ("use strict" prologue)…
v3.90.1 (2026-09-18) 🐛 Bug Fixes do not carry parent where queries into nested relationship fields (#18212) (d5ead4b) 🏡 Chores bump templates to payload 3.90.0 (#18209) (c8407d0) backport telemetry updated to v3 (#18133) (500971d) 🤝 Contributors Jarrod Flesch (@JarrodMFlesch) German Jablonski (@GermanJablo) Jessica Rynkar (@JessRynkar)
v3.89.0 (2026-09-10) 🚀 Features ui: add warning type to Banner (#17750) (6e5f386) 🐛 Bug Fixes avoid buffering large client uploads into memory (#17872) (e896688) "No client field found for ..." 500 error in version diff (#18001) (88f0622) upgrade next to 16.3.3 across core and templates (#17933) (24164d8) db-mongodb: avoid unnecessary aggregation when no joins are selected (#17785) (9a309af) drizz…
v3.88.0 (2026-08-11) 🐛 Bug Fixes prevent multipart content-type backtracking (#17679) (a742140) ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#17595) (c6477b8) 🛠 Refactors plugin-mcp: better access control defaults for api keys collection (#17751) (025581d) 📝 Templates bump next.js to 16.3.0 (#17683) (ee155b7) 🤝 Contributors Jarrod Flesch (@JarrodMFlesch) Ales…
v3.87.1 (2026-08-06) 🐛 Bug Fixes connect to the correct Next.js dev HMR endpoint per version (#17644) (291ac66) db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #17609) (#17608) (f039324) deps: bump undici (#17630) (9e2c11e) plugin-mcp: bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611) (0cb605d) richtext-lexical: preserve link drawer form s…
v3.87.0 (2026-07-31) 🚀 Features storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#17319) (3c00a39) 🐛 Bug Fixes preserve parent localization through tabs 3.x (#17591) (9c8d636) replace image-size with image-dimensions dependency for upload dimensions (#17571) (2a99a01) forward locale in count and countGlobalVersions (3.x) (#17547) (e042561) pass id to delete…
v3.86.0 (2026-07-10) 🚀 Features collection-level disableBulkDelete (#17207) (ca02cdc) plugin-form-builder: v3 backport to support translations (#17255) (2cde8c8) ui: add livePreview.openByDefault config option (#17213) (f23b693) 🐛 Bug Fixes coerce schedulePublish doc.value to collection ID type before update (#17238) (7de11b2) escape regex metacharacters in isURLAllowed pathname allow-list (#17237…
v3.85.2 (2026-07-01) 🐛 Bug Fixes payload bin fails with tsx on node v23.5+ (#17081) (afb0226) regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88) prevent type generation script from hanging on storage-r2 (#17020) (b681448) prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0) db-mongodb: remove duplicate IDs in nested relationsh…
v3.85.1 (2026-06-09) 🐛 Bug Fixes fix draft save and duplicate behaviour on upload-enabled collections (#16853) (fad992c) bin scripts cannot import dependencies without explicit "type": "module" (backport) (#16848) (6707e85) add type declarations for css export (TypeScript 6 compat) (#16348) (6c81355) follow redirects when fetching uploaded files for MIME type detection (#16708) (ac46214) plugin-im…
v3.85.0 (2026-05-26) 🚀 Features plugin-import-export: out of beta and added support for collection-level and field-level hooks (#16556) (cf9252d) 🐛 Bug Fixes bump uuid package to 13.0.2 (#16545) (274af06) stop workflows retrying forever when no retries are configured (#16465) (caf9150) db-mongodb: bump mongoose to 8.22.1 for GHSA-wpg9-53fq-2r8h (#16688) (4baba91) plugin-cloud-storage: propagate cu…
db-mongodb/2.0.1
v3.84.1 (2026-04-23) Retargeting create-payload-app to pull from 3.x branch. ⚙️ CI adjust 3.x branch references (#16358) (b6131f7) 🤝 Contributors Elliot DeNolf (@denolfe)
v3.84.0 (2026-04-22) 🚀 Features allow client components to also be used as custom collection views (#16312) (8fe5f04) email-nodemailer: add email recipient override config (#16311) (1c1ed97) plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036) plugin-form-builder: add support for multi part uploads (#15268) (aa01a45) plugin-mcp: add support for server in…
v3.83.0 (2026-04-15) 🚀 Features expand plugin API (#16247) (54189e1) add profiling utilities for performance analysis (#16198) (9391c20) add internal plugin priority and slug api for cross-plugin discovery (#16244) (5f5694f) hide slug field buttons when field is read-only (#14824) (67c2c47) cpa: add --agent flag for coding agent skill installation (#16278) (9f9f343) drizzle: add uuidv7 support (#1…