payload

v3.85.2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 25d Productivity & Wikis

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

cms content-management content-management-system express graphql headless

+11 more

headless-cms jamstack javascript mongodb nextjs nodejs payload payloadcms postgresql react typescript

Affected surfaces

deps

Summary

AI summary

Broad release touches 🐛 Bug Fixes, 🤝 Contributors, 3.x, and ⚙️ CI.

Full changelog

v3.85.2 (2026-07-01)

🐛 Bug Fixes

payload bin fails with tsx on node v23.5+ (#17081) (afb0226)
regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88)
prevent type generation script from hanging on storage-r2 (#17020) (b681448)
prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0)
db-mongodb: remove duplicate IDs in nested relationship queries (#17019) (8533dfb)
deps: resolve high severity audit vulnerabilities (#17086) (ac000e5)
deps: override transitive js-cookie to ^3.0.7 (CVE-2026-46625) (#17000) (ef888de)
drizzle: preserve failing sub-table on unique-constraint ValidationError (3.x) (#17015) (6dfac53)
plugin-cloud-storage: split client and server utility exports (#17152) (30bc3fd)
plugin-cloud-storage: prevent draft file reupload from unpublishing the document (3.x) (#17034) (a18ae22)
richtext-lexical: preserve hard line breaks on markdown import (#17061) (c0affcb)
translations: replace Malay strings in Burmese (my) locale (3.x) (#17032) (c3ae01d)
ui: preserve polymorphic upload bulk select relation (#17112) (9691e42)
ui: list relationship cell shows (Untitled) for draft-only titles (#16979) (16152e2)
ui: respect admin.condition on row fields (#16954) (29afa77)

⚙️ CI

backport test service image pinning to ghcr on 3.x (#17162) (d04d47e)
reintroduce audit script (#17122) (f76d670)

🤝 Contributors

Jarrod Flesch (@JarrodMFlesch)
Elliot DeNolf (@denolfe)
Sasha (@r1tsuu)
German Jablonski (@GermanJablo)
Amelia (@LimChorngUan)

Security Fixes

dep: CVE-2026-46625 — override transitive js-cookie to ^3.0.7

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track payload

Get notified when new releases ship.

About payload

Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications.

All releases →