Skip to content

fix(deps): update payloadcms monorepo to v3 - #68

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-payloadcms-monorepo
Open

fix(deps): update payloadcms monorepo to v3#68
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-payloadcms-monorepo

Conversation

@renovate

@renovate renovate Bot commented Feb 14, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@payloadcms/db-mongodb (source) ^1.0.0 → ^3.0.0 age confidence
@payloadcms/richtext-lexical (source) ^0.11.0 → ^3.0.0 age confidence
@payloadcms/richtext-slate (source) ^1.0.0 → ^3.0.0 age confidence

Release Notes

payloadcms/payload (@​payloadcms/db-mongodb)

v3.90.0

Compare Source

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

  • Regenerate your payload types: pnpm payload generate:types
  • If you are using a relational database, you will need to create and run a migration:
pnpm payload migrate:create <migration-name>
pnpm payload migrate
Password changes now revoke other sessions
  • No action needed.
Password reset now clears lockouts; forgot-password is throttled

  • Adds new resetPasswordRequestedAt field to user collections

  • Action required:

    • Regenerate types: pnpm payload generate:types
    • If using a relational database, perform migration:
pnpm payload migrate:create add-reset-password-requested-at
pnpm payload migrate
Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

  • Have publish or unpublish events queued when upgrading.
  • Use multiple admin-capable auth collections.
  • Queue schedulePublish jobs directly or depend on its generated task types.

Action required:

  • Re-create pending scheduled publish and unpublish events after upgrading.
  • Update custom queue code to pass user: { relationTo, value } (value is user ID).
  • Regenerate committed Payload types if applicable.
  • No database migration is required.
Stricter validation for SVG and XML uploads

Affected if you:

  • Upload SVG, XHTML, or XML-family files.
  • Use direct client uploads, particularly with Azure or a custom integration.
  • Depend on path components being retained in new filenames.

Action required:

  • Verify affected upload and XML-delivery workflows.
  • Ensure custom upload clients send the required metadata and returned headers.
  • Set allowRestrictedFileTypes: true in the collections upload property if the previous behavior is explicitly required.
Client uploads hardened across all adapters

Affected if you:

  • Use any client upload adapters with clientUploads: true (S3, GCS, Azure, or custom).

Action required:

  • If using GCS adapter, add x-goog-if-generation-match header to GCS CORS allowed headers.
Azure containers default to private

Affected if you:

  • Use the @payloadcms/storage-azure adapter with allowContainerCreate: true

Action required:

  • If you wish to retain the previous behavior, set containerAccess: 'blob' in your Azure storage config.
disablePayloadAccessControl no longer disables safe outbound fetch

Affected if you:

  • Set disableAccessControl: true in your Payload config.

Action required:

  • Configure a narrow upload.skipSafeFetch allowlist for trusted destinations
  • Use skipSafeFetch: true only when every URL accepted by the collection is trusted.
  • No action is required when files are retrieved from ordinary public endpoints.
External file fetches require a trusted origin

Affected if you:

  • Use upload.disableLocalStorage: true and rely on Payload fetching relative URLs whose endpoint requires a Payload session cookie.
  • Implement externalFileHeaderFilter, particularly if it assumes it runs only once.
  • Use non-HTTP(S) external-file URLs.

Action required:

  • Configure serverURL or add the exact application origin to your CORS or CSRF configuration.
  • Replace non-HTTP(S) external-file URLs with HTTP(S) URLs.
  • Review externalFileHeaderFilter and use the optional context when headers need to vary by destination.
upload: {
  externalFileHeaderFilter: (headers, context) => {
+   if (!context?.isSameOrigin) {
+     delete headers.cookie
+     delete headers.authorization
+   }
+
    return headers
  },
}
Uploaded filename hardening

Affected if you:

  • Use a custom top-level prefix field on an upload collection as ordinary application data.
  • Change an upload’s storage prefix without also replacing its file.

Action required:

  • Rename a custom, non-storage prefix field or update it through trusted server-side code.
  • Submit storage-prefix changes as part of a file replacement. Adapter-managed prefix fields do not require migration.
Multipart uploads are now capped at 50MB by default

Affected if you:

  • Use multipart uploads and rely on uploads being larger than 50MB

Action required:

  • Raise the multipart cap if your application requires support for larger uploads for requests. Adjust the requestSizeLimit in your Payload config:
upload {
+  requestSizeLimit: 75 * 1024 * 1024, // Example 75 MiB for the complete multipart request
}
Form Builder defaults form submission read access to the admin collection

Affected if you:

  • Have more than one auth enabled where the secondary auth collections are expected to be able to read either:
    • form-submission docs
    • forms.emails array field

Action required:

  • Supply an explicit formSubmissionOverrides.access or formOverrides.access to override the new defaults. If you already have overrides configured, they will continue to be respected.
Stricter where validation for polymorphic joins

Polymorphic joins now apply complete where constraints and throw a QueryError when a filter is unsupported.

Unsupported filters include:

  • Localized fields.
  • Fields nested inside arrays or blocks.
  • Paths traversing relationship, upload, or JSON fields, such as owner.email.
  • The near, within, intersects, and all operators.
  • The same field path having incompatible definitions across joined collections, such as number in one collection and text in another.

Affected if you:

  • Use a join whose collection references multiple collections, and
  • Apply an unsupported filter through:
    • A target collection's read access rule.
    • A join where constraint.
    • An Admin baseFilter or baseListFilter used by folder browsing.
  • Use folders with folder-enabled collections whose read access or base filters contain one of these unsupported shapes.

Action required:

  • Review where constraints and read access rules for every collection referenced by a polymorphic join.
  • If using folders, review every folder-enabled collection's read access rules and Admin base filters.
  • Rewrite unsupported filters to use direct, compatible fields while preserving the intended access restrictions.
API keys are no longer readable after initial generation through UI or within Payload operations

If you wish to retain old behavior, set the following in your config:

auth: {
-  useAPIKey: true,
+  useAPIKey: {
+    reveal: true,
+  },
 }
Lexical version bump

Full Details

No application changes or data migration are needed when using Payload's built-in rich text features.

If you maintain custom rich text features, check that they still compile and that custom content loads, copies, and pastes correctly. Lexical removed some older APIs, tightened TypeScript types, and changed how custom nodes are loaded and copied. Tests that inspect the editor's HTML may also need updated selectors or snapshots because Lexical adds some internal markup.

Do not install lexical or @​lexical/* yourself for use with Payload. Remove any direct dependencies you added for the editor and use Payload's re-exports from @payloadcms/richtext-lexical/lexical and @payloadcms/richtext-lexical/lexical/*. Payload supplies the matching versions; mixing versions can break the editor. This is the existing custom feature requirement.

v3.89.0

Compare Source

🚀 Features
🐛 Bug Fixes
🛠 Refactors
📚 Documentation
⚠️ BREAKING CHANGES
🤝 Contributors

v3.88.0

Compare Source

🐛 Bug Fixes
  • prevent multipart content-type backtracking (#​17679) (a742140)
  • ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#​17595) (c6477b8)
🛠 Refactors
  • plugin-mcp: better access control defaults for api keys collection (#​17751) (025581d)
📝 Templates
🤝 Contributors

v3.87.1

Compare Source

🐛 Bug Fixes
📚 Documentation
  • update admin panel location link in custom components docs (#​17624) (57178e3)
⚙️ CI
🤝 Contributors

v3.87.0

Compare Source

🚀 Features
  • storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#​17319) (3c00a39)
🐛 Bug Fixes
📚 Documentation
🧪 Tests
⚙️ CI
  • remove --json from pnpm publish to fix release hang on pnpm v11 (#​17279) (4a82c20)
🏡 Chores
🤝 Contributors

v3.86.0

Compare Source

🚀 Features
🐛 Bug Fixes
  • coerce schedulePublish doc.value to collection ID type before update (#​17238) (7de11b2)
  • escape regex metacharacters in isURLAllowed pathname allow-list (#​17237) (2061859)
  • respect disabled GraphQL config, v3 backport (#​17228) (9e9c35a)
  • allow access to files reuploaded on a draft (#​17209) (f02d22a)
  • plugin-multi-tenant: run tenant delete cleanup inside the request transaction (#​17175) (d128fde)
  • sdk: use qs-esm allowEmptyArrays parameter (#​17208) (c7dc68e)
  • ui: presentational fields skipped in form state when admin.condition is false (#​17224) (f31f26d)
  • ui: prevent slug field error tooltip from hiding lock button (#​15885) (908fba1)
⚙️ CI
🤝 Contributors

v3.85.2

Compare Source

🐛 Bug Fixes
⚙️ CI
🤝 Contributors

v3.85.1

Compare Source

🐛 Bug Fixes
  • fix draft save and duplicate behaviour on upload-enabled collections (#​16853) (fad992c)
  • bin scripts cannot import dependencies without explicit "type": "module" (backport) (#​16848) (6707e85)
  • add type declarations for css export (TypeScript 6 compat) (#​16348) (6c81355)
  • follow redirects when fetching uploaded files for MIME type detection (#​16708) (ac46214)
  • plugin-import-export: fix CSV import of arrays and richText nest… (#​16923) (ccbdcc2)
  • ui: use explicit relative paths for internal SCSS imports v3.x (#​16827) (c039e55)
  • ui: hide entire tabs field when admin.condition is false (#​16809) (79b4e4c)
⚡ Performance
  • ui: skip rendering custom components hidden by admin.condition (#​16819) (0be11b6)
📚 Documentation
⚙️ CI
🤝 Contributors

v3.85.0

Compare Source

🚀 Features
  • plugin-import-export: out of beta and added support for collection-level and field-level hooks (#​16556) (cf9252d)
🐛 Bug Fixes
📚 Documentation
📝 Templates
⚙️ CI
🏡 Chores
🤝 Contributors

v3.84.1

Compare Source

Retargeting create-payload-app to pull from 3.x branch.

⚙️ CI
🤝 Contributors

v3.84.0

Compare Source

🚀 Features
  • allow client components to also be used as custom collection views (#​16312) (8fe5f04)
  • email-nodemailer: add email recipient override config (#​16311) (1c1ed97)
  • plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#​15139) (6731036)
  • plugin-form-builder: add support for multi part uploads (#​15268) (aa01a45)
  • plugin-mcp: add support for server instructions (#​15858) (c852d85)
🐛 Bug Fixes
  • unique value errors are not displayed properly for localized fields (#​16069) (f6e9073)
  • correct slugifyTitle hook example in documentation (#​16306) (48db8c1)
  • handle multipart uploads without content-length (#​16301) (c150ef8)
  • plugin-ecommerce: verify PaymentIntent succeeded before creating… (#​15902) (500e39d)
  • richtext-lexical: internal links export as text in markdown transformer (#​16302) (3dc6041)
  • storage-*: simplify key handling for signed urls and composite prefixes (#​16291) (6139508)
  • templates: remove tilde SCSS imports and add Sass loadPaths for Windows (#​16295) (7ca8b05)
  • ui: json and richText fields expose unsupported operators in WhereBuilder (#​16353) (a507fcc)
  • ui: bulk edit ignores fields in named tabs and shows incorrect labels for unlabeled containers (#​16340) (e5bc6be)
📚 Documentation
🧪 Tests
📝 Templates
⚙️ CI
🏡 Chores
🤝 Contributors

v3.83.0

Compare Source

🚀 Features

Expanded Plugin API — New definePlugin helper introduces opt-in execution ordering, cross-plugin discovery via a slug-keyed plugins map, and module augmentation for type-safe plugin options. The existing (config) => config contract remains unchanged. #​16247

import { definePlugin } from 'payload'

export const seoPlugin = definePlugin<SEOPluginOptions>({
  slug: 'plugin-seo',
  order: 10,
  plugin: ({ config, plugins, collections, generateTitle }) => ({
    ...config,
    // collections and generateTitle come from SEOPluginOptions
  }),
})

Profiling Utilities — Lightweight timeSync and timeAsync wrappers for measuring function execution time during development. Wrap any function to capture its duration, then call printProfileResults for a formatted timing table. Not intended for production use. #​16198

Internal Plugin Priority & Slug API — Plugins can now attach priority, slug, and options properties for execution ordering and cross-plugin discovery. Lower priority runs first; other plugins can find each other by slug via config.plugins without imports. Marked @internal for now. #​16244

Hidden Slug Field Buttons on Read-Only — The Generate and Lock/Unlock buttons on slug fields are now automatically hidden when the field is read-only, removing controls that serve no purpose in that state. #​14824

Agent Flag for CPA (cpa) — create-payload-app now supports a --agent / -a flag (claude, codex, cursor) that downloads the Payload coding skill from GitHub and installs it in the correct directory for your agent. A root-level CLAUDE.md or AGENTS.md is written for discoverability. Use --no-agent to skip. #​16278

CPA agent selection prompt

UUIDv7 Support (drizzle) — New idType: 'uuidv7' option for Postgres and SQLite adapters generates time-ordered UUIDs that are friendlier for B-tree indexes than random v4 UUIDs, while using the same storage column type. IDs are generated in application code so older Postgres versions are supported. #​16113

Custom Email Headers (email-resend) — The Resend adapter now passes custom headers from sendEmail options to the Resend API, enabling features like List-Unsubscribe headers that were previously silently dropped. #​15645

await payload.sendEmail({
  from: "Test <test@domain.com>",
  to: "jimmybillbob@example.com",
  subject: "Email with custom headers",
  html: html,
  headers: {
    "List-Unsubscribe": "<https://domain.com/unsubscribe>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
  },
});

Custom Collection Views (next) — Register custom views at the collection level via admin.components.views[key] with a Component and path. Folders take routing precedence over custom views on upload collections. #​16243

{
  slug: 'products',
  admin: {
    components: {
      views: {
        grid: {
          Component: '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/components/GridView',
          path: '/grid',
          exact: true,
        },
      },
    },
  },
}

Checkbox Label Clarity (plugin-form-builder) — The form builder checkbox field label was changed from "Default Value" to "Checked by default" to eliminate confusion about whether the checkbox toggles a default value or sets the initial checked state. #​15229

Extensible MCP Plugin (plugin-mcp) — External plugins can now extend plugin-mcp by finding it via slug in config.plugins and injecting custom MCP tools into its options. Also exports the MCPPluginConfig type for type-safe tool injection. #​16245

View Override System for Custom Node Rendering (richtext-lexical) — ⚠️ Experimental. Override how any Lexical node type is rendered in the editor via view maps. Supports custom DOM, React components, or HTML strings. Works in both the admin editor and frontend JSX serialization for WYSIWYG consistency. #​14244

export const myViews: LexicalEditorViewMap = {
  default: {
    heading: {
      createDOM() {
        const h2 = document.createElement('h2')
        h2.textContent = 'Custom Heading'
        return h2
      },
    },
    horizontalRule: {
      Component: () => <div className="custom-hr">---</div>,
    },
    link: {
      html: '<a href="#">Custom Link</a>',
    },
  },
}
``

> ❗ **Important**
> 
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/YoungVision-eV/website-cms).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xNjcuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEwMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 4 times, most recently from e933300 to c55944d Compare February 21, 2025 14:09
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from e84830b to 4badad4 Compare July 29, 2025 23:34
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from b866623 to f298878 Compare August 10, 2025 14:49
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from ac8ee56 to c3b07df Compare August 19, 2025 13:42
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from ba24489 to 2c50efc Compare August 28, 2025 16:48
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch from 2c50efc to 4ab29a5 Compare August 31, 2025 09:26
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from 8898b7c to 3f55a2b Compare September 10, 2025 22:42
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch from 3f55a2b to 3d9f2f9 Compare September 17, 2025 17:26
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from cc96513 to fcc687d Compare September 30, 2025 18:58
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from 429bdd1 to eafe103 Compare October 8, 2025 04:08
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 9e9f3d5 to e3351b8 Compare October 23, 2025 16:51
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from b63e383 to ef3e00c Compare October 31, 2025 04:11
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch from ef3e00c to d175a20 Compare November 3, 2025 19:04
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 256ee26 to fbc4ff8 Compare December 19, 2025 21:55
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from fae6910 to 0e4f35f Compare January 5, 2026 20:56
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 81c17a9 to 2f39d02 Compare January 19, 2026 15:08
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 60570ce to 7b96de4 Compare January 30, 2026 17:40
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 4 times, most recently from 48eb6f7 to 275f712 Compare February 12, 2026 11:45
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch from 275f712 to 0cc9332 Compare February 19, 2026 08:17
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 9d182e9 to f727ae7 Compare March 5, 2026 14:13
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from a19a358 to 1cb49c5 Compare March 16, 2026 17:33
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from 704a7cd to 8e81e95 Compare March 27, 2026 01:04
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from de446e3 to 9b73fc1 Compare April 1, 2026 01:34
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from a38bef4 to 1afb78e Compare April 9, 2026 19:08
@renovate
renovate Bot force-pushed the renovate/major-payloadcms-monorepo branch from 1afb78e to 5f15c29 Compare April 16, 2026 11:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

1 min review dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants