v3.90.0 (2026-09-18) ⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible. These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack su…
v4.0.0-canary.37 (2026-09-24) 🚀 Features default overrideAccess to false in the Local API (#17869) (744bfcf) publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003) codemod: add agent-assisted upgrade command (#17825) (c44404c) tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50) 🐛 Bug Fixes update deprecated mongodb new option (#182…
v3.90.2 (2026-09-23) 🐛 Bug Fixes await slugify func to match type (#18181) (3fad98e) next: remove invalid libsql tracing include (#18238) (972a4fb) next: support next.config trailingSlash (#18207) (05e49da) plugin-cloud-storage: forward alwaysInsertFields when the plugin is enabled (#18222) (f5d261d) plugin-mcp: create/update tools crash the MCP endpoint under TypeScript 6 ("use strict" prologue)…
v3.90.1 (2026-09-18) 🐛 Bug Fixes do not carry parent where queries into nested relationship fields (#18212) (d5ead4b) 🏡 Chores bump templates to payload 3.90.0 (#18209) (c8407d0) backport telemetry updated to v3 (#18133) (500971d) 🤝 Contributors Jarrod Flesch (@JarrodMFlesch) German Jablonski (@GermanJablo) Jessica Rynkar (@JessRynkar)
v3.89.0 (2026-09-10) 🚀 Features ui: add warning type to Banner (#17750) (6e5f386) 🐛 Bug Fixes avoid buffering large client uploads into memory (#17872) (e896688) "No client field found for ..." 500 error in version diff (#18001) (88f0622) upgrade next to 16.3.3 across core and templates (#17933) (24164d8) db-mongodb: avoid unnecessary aggregation when no joins are selected (#17785) (9a309af) drizz…
v3.88.0 (2026-08-11) 🐛 Bug Fixes prevent multipart content-type backtracking (#17679) (a742140) ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#17595) (c6477b8) 🛠 Refactors plugin-mcp: better access control defaults for api keys collection (#17751) (025581d) 📝 Templates bump next.js to 16.3.0 (#17683) (ee155b7) 🤝 Contributors Jarrod Flesch (@JarrodMFlesch) Ales…
v3.87.1 (2026-08-06) 🐛 Bug Fixes connect to the correct Next.js dev HMR endpoint per version (#17644) (291ac66) db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #17609) (#17608) (f039324) deps: bump undici (#17630) (9e2c11e) plugin-mcp: bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611) (0cb605d) richtext-lexical: preserve link drawer form s…
v3.87.0 (2026-07-31) 🚀 Features storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#17319) (3c00a39) 🐛 Bug Fixes preserve parent localization through tabs 3.x (#17591) (9c8d636) replace image-size with image-dimensions dependency for upload dimensions (#17571) (2a99a01) forward locale in count and countGlobalVersions (3.x) (#17547) (e042561) pass id to delete…
v3.86.0 (2026-07-10) 🚀 Features collection-level disableBulkDelete (#17207) (ca02cdc) plugin-form-builder: v3 backport to support translations (#17255) (2cde8c8) ui: add livePreview.openByDefault config option (#17213) (f23b693) 🐛 Bug Fixes coerce schedulePublish doc.value to collection ID type before update (#17238) (7de11b2) escape regex metacharacters in isURLAllowed pathname allow-list (#17237…
v3.85.2 (2026-07-01) 🐛 Bug Fixes payload bin fails with tsx on node v23.5+ (#17081) (afb0226) regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88) prevent type generation script from hanging on storage-r2 (#17020) (b681448) prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0) db-mongodb: remove duplicate IDs in nested relationsh…
v3.85.1 (2026-06-09) 🐛 Bug Fixes fix draft save and duplicate behaviour on upload-enabled collections (#16853) (fad992c) bin scripts cannot import dependencies without explicit "type": "module" (backport) (#16848) (6707e85) add type declarations for css export (TypeScript 6 compat) (#16348) (6c81355) follow redirects when fetching uploaded files for MIME type detection (#16708) (ac46214) plugin-im…
v3.85.0 (2026-05-26) 🚀 Features plugin-import-export: out of beta and added support for collection-level and field-level hooks (#16556) (cf9252d) 🐛 Bug Fixes bump uuid package to 13.0.2 (#16545) (274af06) stop workflows retrying forever when no retries are configured (#16465) (caf9150) db-mongodb: bump mongoose to 8.22.1 for GHSA-wpg9-53fq-2r8h (#16688) (4baba91) plugin-cloud-storage: propagate cu…
db-mongodb/2.0.1
v3.84.1 (2026-04-23) Retargeting create-payload-app to pull from 3.x branch. ⚙️ CI adjust 3.x branch references (#16358) (b6131f7) 🤝 Contributors Elliot DeNolf (@denolfe)
v4.0.0-beta.0
v3.84.0 (2026-04-22) 🚀 Features allow client components to also be used as custom collection views (#16312) (8fe5f04) email-nodemailer: add email recipient override config (#16311) (1c1ed97) plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036) plugin-form-builder: add support for multi part uploads (#15268) (aa01a45) plugin-mcp: add support for server in…
v3.83.0 (2026-04-15) 🚀 Features expand plugin API (#16247) (54189e1) add profiling utilities for performance analysis (#16198) (9391c20) add internal plugin priority and slug api for cross-plugin discovery (#16244) (5f5694f) hide slug field buttons when field is read-only (#14824) (67c2c47) cpa: add --agent flag for coding agent skill installation (#16278) (9f9f343) drizzle: add uuidv7 support (#1…
v3.82.1 (2026-04-09) 🐛 Bug Fixes next: use correct config key for disabling turbo server fast refresh (#16215) (11adc9d) plugin-nested-docs: await populateBreadcrumbs in resaveChildren (#15582) (0554b50) ⚡ Performance storage-s3: avoid getObject call if ETag matches (#15295) (7ccc3f0) 📚 Documentation fix incorrect select syntax example in querying docs (#14590) (be6c443) 📝 Templates bump to 3.82.0…
v3.82.0 (2026-04-08) 🚀 Features disambiguate media files by prefix via query parameter (#15844) (05ddec1) add missing disableErrors to globals findOne operation (#14913) (c8332e7) improve default slugify utility by triming whitespace first (#14421) (fdaa051) add typescript.postProcess hook for type generation (#16103) (67b5dc3) plugin-redirects: add Portuguese translation (#15269) (122f4c1) plugin…
v3.81.0 (2026-04-01) 🚀 Features add LLM eval suite for Payload conventions and code generation (#15710) (db4b00e) next: prevent admin panel errors when cacheComponents is enabled (#16020) (1ecd7dd) 🐛 Bug Fixes update file-type, ajv and jose packages (#16118) (d09ed54) add field-level access control to internal auth fields (#16119) (4ae5577) where querying by a join field with relationship nested t…