Skip to content

fix(deps): update dependency payload to v3.69.0 #889

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
github-actions wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency payload to v3.69.0 #889

github-actions wants to merge 1 commit into from

Conversation

@github-actions
Copy link
Contributor

@github-actions github-actions bot commented Oct 4, 2025 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
payload (source) dependencies minor 3.57.0 -> 3.69.0

Release Notes

payloadcms/payload (payload)

v3.69.0

Compare Source

🚀 Features
Modular Dashboards with Widgets

Introduces customizable admin dashboards with draggable, resizable widgets. Build personalized dashboard layouts with full keyboard accessibility for reordering and resizing. Future updates will add widget fields (props) for configurable widgets and dashboard presets for sharing layouts. #​13683

Screen.Recording.2025-11-28.at.17.13.14.mov

See the RFC discussion for background and roadmap.

AI Development Resources (templates)

All templates now ship with AGENTS.md and .cursor/rules/ directory for improved AI-assisted development with tools like Copilot and Cursor. #​14889

See more about AGENTS.md

🐛 Bug Fixes
  • basePath not working properly with admin routes (#​14967) (fa6b503)
  • get field by path for blocks (#​14984) (519a3c6)
  • improves upload security for PDFs and SVGs (#​14929) (61298c6)
  • missing range headers (#​14887) (ec7c192)
  • next: status component incorrectly shows as published status on new documents saved as drafts when readVersions permissions are false (#​14950) (394c024)
  • plugin-mcp: adds collection and strategy to user (#​14981) (042d7eb)
  • plugin-multi-tenant: relationTo arrays inflating filterOptions where query size (#​14944) (98b6791)
  • richtext-lexical: blocksFeature with relationship exposes other tenants (#​14985) (3025377)
  • storage-s3: encode filename in generated URL (#​14438) (86855e1)
  • ui: use portals for popup to prevent clipping, improve keyboard navigation (#​14910) (af09932)
🛠 Refactors
📚 Documentation
🧪 Tests
🏡 Chores
🤝 Contributors

v3.68.5

Compare Source

🐛 Bug Fixes
🛠 Refactors
🤝 Contributors

v3.68.4

Compare Source

🐛 Bug Fixes
📚 Documentation
  • remove unused variable from custom field label translation (#​14911) (77f96a4)
  • update collection access control reference link on collection config page (#​14905) (3a1eb77)
⚠️ BREAKING CHANGES
🤝 Contributors

v3.68.3

Compare Source

⚠️ Security Issue

A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) affect React 19 and frameworks that use it, like Next.js.

Full details here: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn you of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Resolution

You are strongly encouraged to upgrade your own apps to the nearest patched versions of Next.js and deploy immediately.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add next@15.4.9

For a full breakdown of the vulnerable packages and their patched releases, see https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app.

🐛 Bug Fixes
🤝 Contributors

v3.68.2

Compare Source

🐛 Bug Fixes
  • next: use fileURLToPath for cross-platform path resolution (#​14877) (e86098d)

Fixes Windows users getting ENOENT errors on dev startup.

  • next: unhandled error in renderListView server function when no user present (#​14878) (10a8f0f)
  • next: merge user serverExternalPackages in withPayload (#​14881) (dcecc46)
🛠 Refactors
  • replace generic Error('Unauthorized') with UnauthorizedError (#​14879) (c9a8aa0)
  • next: remove unnecessary react hooks from DefaultTemplate rsc (#​14876) (7a94cc1)
🏡 Chores
🤝 Contributors

v3.68.1

Compare Source

🏡 Chores
  • do not suggest vulnerable Next.js release in turbopack build error message (#​14873) (9e0f593)
🤝 Contributors

v3.68.0

Compare Source

🚀 Features

Turbopack Build Support (next) - Automatically enables Turbopack Build compatibility when using Next.js ≥ 16.1.0-canary.3. The withPayload wrapper now detects supported versions and enables transitive dependency externalization, unlocking significantly faster production builds with Turbopack. #​14845

🐛 Bug Fixes
  • adds read and readDistinct to hook mapping (#​14853) (0da0da8)
  • undefined drafts error in collections with join fields (#​14855) (3a29cec)
  • use hasDraftsEnabled utility instead of direct check (#​14843) (9c9c7c5)
  • file objects being serialized to plain objects in upload form state (#​14818) (d86c174)
  • db-mongodb: correctly pass through collation config in the adapter to be applied in queries via locales (#​11242) (db59cb4)
  • plugin-multi-tenant: simplified getTenantOptions function and added access control for regular users (#​14620) (f7cc078)
  • storage-*: upload filename respects prefix (#​14566) (ccfaee0)
  • ui: component AddNewRelation saves relationTo as first collection instead of selected collection (#​14836) (8c5c1fb)
  • ui: list drawer per-page dropdown resets to 10 instead of showing saved limit (#​14830) (db13a60)
📚 Documentation
  • add note about returning a query from a readVersions access control (#​14822) (0860837)
🧪 Tests
🔨 Build
⚙️ CI
🏡 Chores
🤝 Contributors

v3.67.0

Compare Source

🚀 Features
  • add groupBy support to query presets (#​14808) (2b7aa7a)
  • plugin-ecommerce: add ability to enable guest carts with reworked access config (#​14565) (90c92f4)

GroupBy Support for Query Presets - Query presets now save and restore groupBy state when switching between presets. Previously, groupBy settings would persist across preset switches and weren't saved as part of the preset configuration. #​14808

Preset creation with group-by added

Guest Carts (plugin-ecommerce) - Enable guest users to create and manage carts without authentication. Carts created by guests are secured with a generated secret stored in local storage. Configure with allowGuestCarts (enabled by default). Also adds isLoading status to all hooks for conditional UI state.
#​14565

// Before
ecommercePlugin({
  access: {
    adminOnly,
    adminOnlyFieldAccess,
    adminOrCustomerOwner,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
  }
})

// After
ecommercePlugin({
  access: {
    adminOnlyFieldAccess,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
    isAdmin,
    isDocumentOwner,
  }
})

🐛 Bug Fixes

⚡ Performance

⚙️ CI

🏡 Chores

⚠️ BREAKING CHANGES

This PR introduce a breaking change into the plugin as it was necessary
in order to provide more secure guest carts.

🤝 Contributors

v3.66.0

Compare Source

⚠️ Security Issue

A critical-severity vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks that use it, including Next.js (CVE-2025-66478).

You are strongly encouraged to immediately upgrade your own apps to the nearest patched versions of React and Next.js.

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of React or Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add react@19.2.1 next@15.4.8

To do this manually:

  1. In your package.json:
    • Bump react to 19.2.1
    • Bump next to 15.4.8
  2. Reinstall node modules, e.g. pnpm i
  3. Redeploy your app

Here's a full breakdown of the vulnerable packages and their patched releases:

Vulnerable package Patched release
React 19.0, 19.1, 19.2 19.0.1, 19.1.2, and 19.2.1
Next.js 14.3.0-canary, 15.x, and 16.x (App Router) 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

See https://github.com/payloadcms/payload/issues/14807 for more details.

🚀 Features
Feature Details

Custom Slugify Functions - Override the default slug field behavior with your own slugify function. Useful for special character encoding, additional language support, or custom slug formatting. Also deprecates fieldToUse in favor of useAsSlug for consistency with useAsTitle. #​14117

import type { CollectionConfig } from 'payload'
import { slugField } from 'payload'
import slugify from 'slugify';

export const MyCollection: CollectionConfig = {
  // ...
  fields: [
    // ...
    slugField({
      slugify: ({ valueToSlugify }) => slugify(valueToSlugify, {
        // ...additional `slugify` options here
      })
    })
  ]
}

Accessibility Testing and Improvements - Adds automated accessibility testing infrastructure including axe a11y scans, focus indicator checks, and horizontal scroll overflow detection. Covers all fields, major views, components, plugins, and Lexical editor. See the a11y report discussion for tracked issues. #​14454

External JSON Schema References in Type Generation - Enables $ref pointers to external .json schema files in typescriptSchema field config. External references are resolved relative to process.cwd(). #​14749

// payload.config.ts
{
  typescript: {
    schema: [
      ({ jsonSchema }) => {
        jsonSchema.definitions.MyType = {
          $ref: './schemas/my-type.json'
        }
        return jsonSchema
      },
    ]
  }
}

Auto-detect D1 Adapter (cpa) - The with-cloudflare-d1 template now automatically assumes the D1 database adapter, eliminating the database selection prompt during project creation. #​14799

Upload Node Alignment (richtext-lexical) - Adds alignment support to upload nodes in the Lexical editor. Upload/media blocks can now be aligned left, center, or right using the FORMAT_ELEMENT_COMMAND. #​14720

Upload alignment support

🐛 Bug Fixes
  • remove "all" from JSDoc comment on supported http methods in endpoints (#​14777) (8c8def9)
  • should exclude svg files from file buffer mime validation (#​14751) (015b363)
  • deps: bump minimum react and next versions (#​14807) (2dfe464)
  • plugin-import-export: incorrect user type in Export causing runtime type mismatch (#​14790) (61f5aee)
  • plugin-multi-tenant: tenant modal not appearing when autosave is off (#​14806) (b96e928)
  • plugin-multi-tenant: auto assign tenant when autosave is enabled (#​14745) (b0674fa)
  • richtext-lexical: copying and pasting a single block in Lexical results in an error due to duplicate ID (#​14738) (cd9addf)
  • richtext-lexical: export serverInlineBlock modules (#​14739) (becceb7)
  • translations: translate slug field actions (#​14784) (5542e56)
  • ui: prevent NaN page parameter in polymorphic relationship pagination (#​14795) (bbdfdb8)
  • ui: reduce spacing between checkbox and first column when few columns shown (#​14776) (6ae1bc8)
📚 Documentation
🧪 Tests
📝 Templates
  • update with-cloudflare-d1 to the latest OpenNext and wrangler (#​14509) (5150388)
⚙️ CI
🏡 Chores
⚠️ BREAKING CHANGES
🤝 Contributors

v3.65.0

Compare Source

❗️Breaking Change

This release disables Turbopack Build support. Please use Webpack to build your app for now. You can do so by using pnpm build on Next.js 15 and pnpm build --webpack on Next.js 16.

🚀 Features
  • add augmentable interfaces for collection and global custom properties (#​14729) (850c252)
  • allow to specify payload instance cache key in handleEndpoints (#​14675) (efa2fd2)
  • db-mongodb: add afterCreateConnection and afterOpenConnection hooks (#​14649) (af6ba86)
  • plugin-mcp: add localization support to MCP resource operations (#​14334) (a3f490b)
  • plugin-mcp: adds a PayloadRequest to custom tool, prompt, and resource handlers (#​14644) (0d14b06)
  • ui: extract block selector from blocks drawer (#​14697) (b9b11f0)

Type-Safe Custom Properties - Add augmentable interfaces for collection and global custom properties: CollectionCustom, CollectionAdminCustom, GlobalCustom, and GlobalAdminCustom. Enables type-safe plugin configuration at the collection/global level with full autocomplete support, matching the existing FieldCustom pattern. #​14729

// Augment interfaces in your plugin or project
declare module 'payload' {
  export interface CollectionAdminCustom {
    disabledFields?: string[]
  }

  export interface CollectionCustom {
    myPluginConfig?: {
      enabled: boolean
      settings: Record<string, any>
    }
  }
}

// Now get full type safety in collections
export const Posts: CollectionConfig = {
  slug: 'posts',
  admin: {
    custom: {
      disabledFields: ['status'] // ✅ Type-safe!
    }
  },
  custom: {
    myPluginConfig: {
      enabled: true,
      settings: {}
    }
  }
}

Payload Instance Cache Key - Specify payloadInstanceCacheKey in handleEndpoints and createPayloadRequest to control which cached Payload instance is used for custom endpoints. Useful for multi-tenant scenarios or when managing multiple Payload instances. #​14675

MongoDB Connection Lifecycle Hooks (db-mongodb) - Add afterCreateConnection and afterOpenConnection hooks to the MongoDB adapter for performing setup logic after connection/pool initialization. Enables use cases like connection pooling in serverless environments. #​14649

export const databaseAdapter = mongooseAdapter({
  // ...
  afterOpenConnection: async (adapter) => {
    const client = adapter.connection.getClient()
    attachDatabasePool(client);
  },
})

MCP Localization Support (plugin-mcp) - Add full localization support to MCP resource operations (create, update, find, delete). All MCP tools now accept locale and fallbackLocale parameters, bringing feature parity with Payload's REST API for multilingual content management. #​14334

// Create content in English
{ "name": "createPosts", "arguments": { "title": "Hello", "locale": "en" }}

// Add Spanish translation
{ "name": "updatePosts", "arguments": { "id": "123", "title": "Hola", "locale": "es" }}

// Retrieve all translations
{ "name": "findPosts", "arguments": { "id": "123", "locale": "all" }}

PayloadRequest in MCP Handlers (plugin-mcp) - Custom tool, prompt, and resource handlers now receive a PayloadRequest object, enabling access to the Payload instance and consistent access control patterns without additional lookups. #​14644

// Previously
handler: async (args: Record<string, unknown>) => {}

// Now with req parameter
handler: async (args: Record<string, unknown>, req: PayloadRequest, _extra) => {
  // Access payload instance, user, locale, etc.
  const { payload, user, locale } = req
}

Reusable Block Selector Component (ui) - Extract BlockSelector component from BlocksDrawer and export for external use. Includes new onSelect callback for custom side effects when blocks are selected. #​14697

🐛 Bug Fixes
⚡ Performance
🛠 Refactors
  • db-mongodb,drizzle: reduce race condition window between retrieving and using a session (#​14653) (bd9f15f)
  • ui: strongly type render-list server action (#​14611) (337409b)
📚 Documentation
🧪 Tests
🏡 Chores
⚠️ BREAKING CHANGES

  • plugin-mcp: removes 'override' config (#​14598) (89ab526)

    • Removes override from the plugin config
    • Updates documentation
🤝 Contributors

v3.64.0

Compare Source

🚀 Features

UTC Timezone Support - Add support for 'UTC' as a timezone value in date fields. Previously unsupported due to validation against Intl API runtime values. Also fixes issue where having only one timezone would make it selected by default. #​14586

import { buildConfig } from 'payload'

const config = buildConfig({
  admin: {
    timezones: {
      supportedTimezones: [
        {
          label: 'UTC',
          value: 'UTC',
        },
      ],
      defaultTimezone: 'UTC',
    },
  },
})

Turbopack Build Support - Full support for Turbopack builds (now default in Next.js 16). Properly externalizes database adapter entry points to prevent production failures. Resolves issues with direct dependency externalization causing runtime errors. #​14475

MCP Context Detection - Detect when Payload API calls originate from MCP context using req.payloadAPI === 'MCP'. Enables conditional logic in hooks based on MCP usage. #​14595

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeRead: [
      ({ doc, req }) => {
        if (req.payloadAPI === 'MCP') {
          doc.title = `${doc.title} (MCP Hook Override)`
        }
        return doc
      },
    ],
  },
}

Custom Auth Configuration - Override default API key authentication with custom authorization logic using overrideAuth. Provides granular control over MCP access permissions. #​14538

import { type MCPAccessSettings, mcpPlugin } from '@&#8203;payloadcms/plugin-mcp'

plugins: [
  mcpPlugin({
    overrideAuth: (req) => {
      return {
        posts: { find: true },
        products: { find: true, update: true },
      } as MCPAccessSettings
    },
  })
]

Redirect Plugin Translation Support - Enable translations for plugin fields, eliminating need for verbose field overrides configuration. Configure field labels in multiple languages directly through i18n config. #​14548

export default buildConfig({
  i18n: {
    translations: {
      en: {
        'plugin-redirects': {
          fromUrl: 'Source URL (Custom)',
        },
      },
      de: {
        'plugin-redirects': {
          fromUrl: 'Quell-URL',
          internalLink: 'Interner Link',
        },
      },
    },
  },
  plugins: [redirectsPlugin({ collections: ['pages'] })],
})
🐛 Bug Fixes
  • previous value undefined for nested fields in afterChange (#​14582) (d60ea6e)
  • default values inconsistent between Local and REST APIs (#​14556) (8f7ef35)
  • findGlobalVersionByID id type (#​14534) (99ed0e5)
  • localized block fields (#​14587) (2295c89)
  • add secondary PDF mimeType validation and tests (#​14529) (ce479ab)
  • unlock access not being correctly denied when using a where query (#​14585) (f63e34e)
  • error when calling jobs.handleSchedules when there are no schedules defined (#​14519) (072cb97)
  • changing the language of the admin panel does not work for "radio" and "select" fields. (#​14569) (bb520d6)
  • inject custom translations into supportedLanguages in sanitization (#​14549) (d7f1ea2)
  • db-mongodb: localization transforms on nested localized fields (#​14600) (6070d8d)
  • db-mongodb: findVersions/findGlobalVersions not respecting limit of 0 (#​14573) (43dcf84)
  • graphql: avoid errors with sort as empty string (#​14594) (fad476d)
  • next: turbopack error when using db-d1-sqlite package (#​14558) (bd6decf)
  • next, ui: show status "changed" in List View (#​14555) (565680d)
  • plugin-form-builder: expose formSubmissionID as a variable to be used in emails (#​14429) (ad74386)
  • plugin-mcp: correctly uses local access controls ([#​14457](

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 7736be6 to 784b421 Compare October 9, 2025 05:09
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.58.0 fix(deps): update dependency payload to v3.59.1 Oct 9, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 784b421 to 6d0b56e Compare October 27, 2025 08:29
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.59.1 fix(deps): update dependency payload to v3.61.1 Oct 27, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 6d0b56e to 0b2f5d4 Compare November 3, 2025 08:30
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.61.1 fix(deps): update dependency payload to v3.62.0 Nov 3, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 0b2f5d4 to 5e8fe7a Compare November 10, 2025 08:30
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.62.0 fix(deps): update dependency payload to v3.63.0 Nov 10, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 5e8fe7a to 045543d Compare November 17, 2025 08:30
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.63.0 fix(deps): update dependency payload to v3.64.0 Nov 17, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 045543d to c7f7c09 Compare November 24, 2025 08:30
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from c7f7c09 to 7d36daf Compare December 1, 2025 08:32
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.64.0 fix(deps): update dependency payload to v3.65.0 Dec 1, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 7d36daf to 378b847 Compare December 8, 2025 08:31
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.65.0 fix(deps): update dependency payload to v3.67.0 Dec 8, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from 378b847 to ec63dfd Compare December 15, 2025 08:32
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.67.0 fix(deps): update dependency payload to v3.68.4 Dec 15, 2025
@github-actions github-actions bot force-pushed the renovate/payload-cms branch from ec63dfd to 9cab600 Compare December 22, 2025 08:30
@github-actions github-actions bot changed the title fix(deps): update dependency payload to v3.68.4 fix(deps): update dependency payload to v3.69.0 Dec 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant