Shipped · Databases

What payloadcms/payload shipped

The public repository of Payloadcms · github.com/payloadcms/payload

Written by FoxPlug from the repository's own releases; not affiliated with Payloadcms. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/payloadcms/payload; Payloadcms did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow payload's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week the v4 beta line opened with a large batch of changes, including an admin UI redesign, TanStack support, and upload file versioning, so anyone trying the beta should read the migration notes before upgrading. Publishing also now validates every locale, which changes when a publish can succeed for localized documents. Many deprecated APIs and props were removed, so existing code that relied on them needs updating.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V4.0.0-beta.0 is out. Admin UI redesign, TanStack support, dashboard components, accessibility, hierarchies, tags, grid view, improved file uploads UI, upload file versioning, rewritten MCP, and upgrade codemods. Publishing now validates every locale. Deprecated APIs flagged for

Post for LinkedIn

V4.0.0-beta.0 is out. This beta brings an admin UI redesign, TanStack support, dashboard components, accessibility work, hierarchies, tags, grid view, improved file uploads UI, upload file versioning, a rewritten MCP, and upgrade codemods. The v4 release flow on main has switched from canary to beta, so beta is now the only publishable prerelease line. Publishing now validates every locale before it publishes a localized document, so publish no longer succeeds when another locale has invalid or missing data. APIs and types flagged for removal in 4.0, along with several deprecated UI props, have been removed; the v4 migration guide covers the breaking changes. Try it with create-payload-app@beta.

Week of September 28, 2026

What shipped

Why it matters

This week focuses on security patches, database operations for content branching, and accessibility improvements throughout the admin UI. The collection of accessibility fixes addresses keyboard navigation, focus order, and table interactions that impact all users of the admin panel.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V3.90.0 ships with critical security fixes. Upgrade immediately. This release also adds database copy and batch processing methods, optimizes MongoDB queries, and fixes keyboard navigation and focus order across the admin UI.

Post for LinkedIn

V3.90.0 is now available with critical security fixes that require immediate upgrade. This release introduces database copy and batch processing methods to support content branching, optimizes MongoDB queries for collections with join fields, and ships significant accessibility improvements including keyboard navigation, focus order, and table interaction fixes to meet WCAG 2.2 AA compliance.

Week of September 21, 2026

What shipped

Why it matters

This week brings breaking changes that enforce better defaults: access control is now required by default, and publish behavior respects locale boundaries without configuration. A new codemod command eases v3-to-v4 migrations. Several fixes improve draft handling, form state preservation, and compatibility across database adapters.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V4 now enforces access control by default in the Local API and publishes active locale by default. Consolidating request creation APIs and adding a v3→v4 migration codemod.

Post for LinkedIn

This week in Payload: the v4 Local API now defaults overrideAccess to false, enforcing access control instead of bypassing it by default. The Publish button respects locale boundaries without config. We consolidated request creation around a single canonical function and added an upgrade codemod to help move projects from v3 to v4, including Next.js version bumps. Plus fixes for draft access checks, form state preservation, and MongoDB adapter warnings.

Week of September 14, 2026

What shipped

Why it matters

Critical security patches in v3.90.0 and v3.90.1 require immediate attention from users running v3. Access control fixes for nested relationships and dependency vulnerability resolutions improve stability and safety across all installations.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

V3.90.0 and v3.90.1 released with critical security fixes. Upgrade immediately. Also: nested relationship access control fix, dependency vulnerabilities resolved, Vitest 5.0.0, Playwright 1.63.0.

Post for LinkedIn

Payload v3.90.0 and v3.90.1 are now available with critical security fixes that require immediate upgrade. This release addresses high-severity vulnerabilities in consumer-facing dependencies, fixes access control behavior for nested relationship queries, and updates testing infrastructure with Vitest 5.0.0 and Playwright 1.63.0. All users are encouraged to upgrade promptly.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-12.

Is this your repo? Ask us to remove this page.