What payloadcms/payload shipped

V4.0.0-beta.7 and v3.93.0 are out, both with vital security updates. Also this week: refresh tokens for auth collections, retained upload originals now keep the uploaded filename, and fixes for cross-tenant bulk actions and MongoDB hasMany joins.

V4.0.0-beta.7 and v3.93.0 are out, and both contain vital security updates, so updating soon is encouraged. New this week: auth.refreshTokens lets login return a refresh token that can be traded for a new one even after expiry, and retained upload originals no longer get an -original suffix, so uploads keep their filename and file roles come from document fields. Fixes include cross-tenant bulk actions no longer affecting every tenant a user can access, shared localized draft changes marking all locales as draft, req.user._strategy being set for custom auth strategies, and MongoDB joins across multiple collections on hasMany relationships.

V4.0.0-beta.6 is out. New this week: auth.passwordHashIterations for environments that limit PBKDF2, refreshCount and refreshedAt for refresh token sessions, lexical 0.53.0, and a fix for findDistinct on the D1 SQLite adapter.

This week's work on Payload includes v4.0.0-beta.6 and a set of features and fixes. A new root config option, auth.passwordHashIterations, lets you set the PBKDF2 iteration count so password hashing works in environments that limit it, such as Cloudflare Workers. Sessions for collections with auth.refreshTokens now track refreshCount and refreshedAt so only the previous refresh token is accepted after a refresh. Lexical is upgraded to 0.53.0 with no database migration needed, though custom features may need changes. createdBy is now stamped on a global's first save even with field defaults or named groups, publishing all locales keeps the active branch during locale validation, select clear buttons respond to touch on iOS, and findDistinct is registered on the D1 SQLite adapter so Group by

This week: storage adapters now store the processed bytes for direct-client uploads instead of a zero-byte or stale file, reset password runs your password field validation, hidden fields are excluded from GraphQL mutation inputs, and plugins can replace each other's options.

This week's changes in the repository: Storage adapters for Vercel Blob, GCS and R2 now upload processed direct-client files from the temporary file holding the processed bytes, so a processed upload no longer leaves a zero-byte object behind while the document reports the processed size. The cloud storage plugin stores those bytes for cropped and mislabeled uploads, and Vercel Blob keeps image-size filenames separate with addRandomSuffix. Reset password now runs the collection's password field validation, including overrides such as minLength and custom validate. Fields marked hidden are excluded from generated GraphQL mutation inputs, definePlugin reads options when a plugin runs, and the lexical link drawer preserves unsaved link fields and nested upload drawers through parent autosave.

New this week: v4.0.0-beta.2 and v3.91.0 shipped. Locale all writes now validate each locale. TanStack Start custom API routes no longer 404. Rich text edit views open faster. The email adapter moved to nodemailer 10 for security advisories, a breaking upgrade.

This week Payload shipped v4.0.0-beta.2 and v3.91.0. Localized fields written with locale all now validate each string instead of the locale-keyed object, and validator context is scoped to match. TanStack Start REST requests no longer 404 when routes.api is customized. The client field schema map now builds in linear time, keeping the first edit view open fast in configs with many rich text fields. The email adapter upgraded to nodemailer 10 to resolve security advisories, which is a breaking change if you pass your own transport.

V4.0.0-beta.0 is out. Admin UI redesign, TanStack support, dashboard components, accessibility, hierarchies, tags, grid view, improved file uploads UI, upload file versioning, rewritten MCP, and upgrade codemods. Publishing now validates every locale. Deprecated APIs flagged for

V4.0.0-beta.0 is out. This beta brings an admin UI redesign, TanStack support, dashboard components, accessibility work, hierarchies, tags, grid view, improved file uploads UI, upload file versioning, a rewritten MCP, and upgrade codemods. The v4 release flow on main has switched from canary to beta, so beta is now the only publishable prerelease line. Publishing now validates every locale before it publishes a localized document, so publish no longer succeeds when another locale has invalid or missing data. APIs and types flagged for removal in 4.0, along with several deprecated UI props, have been removed; the v4 migration guide covers the breaking changes. Try it with create-payload-app@beta.

V3.90.0 ships with critical security fixes. Upgrade immediately. This release also adds database copy and batch processing methods, optimizes MongoDB queries, and fixes keyboard navigation and focus order across the admin UI.

V3.90.0 is now available with critical security fixes that require immediate upgrade. This release introduces database copy and batch processing methods to support content branching, optimizes MongoDB queries for collections with join fields, and ships significant accessibility improvements including keyboard navigation, focus order, and table interaction fixes to meet WCAG 2.2 AA compliance.

V4 now enforces access control by default in the Local API and publishes active locale by default. Consolidating request creation APIs and adding a v3→v4 migration codemod.

This week in Payload: the v4 Local API now defaults overrideAccess to false, enforcing access control instead of bypassing it by default. The Publish button respects locale boundaries without config. We consolidated request creation around a single canonical function and added an upgrade codemod to help move projects from v3 to v4, including Next.js version bumps. Plus fixes for draft access checks, form state preservation, and MongoDB adapter warnings.

V3.90.0 and v3.90.1 released with critical security fixes. Upgrade immediately. Also: nested relationship access control fix, dependency vulnerabilities resolved, Vitest 5.0.0, Playwright 1.63.0.

Payload v3.90.0 and v3.90.1 are now available with critical security fixes that require immediate upgrade. This release addresses high-severity vulnerabilities in consumer-facing dependencies, fixes access control behavior for nested relationship queries, and updates testing infrastructure with Vitest 5.0.0 and Playwright 1.63.0. All users are encouraged to upgrade promptly.