Release history
payload releases
Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications.
All releases
21 shown
v3.84.1
Maintenance
Minor fixes and improvements.
Full changelog
v3.84.0
New feature
Notable features
- Client components usable as custom collection views
- Email recipient override configuration
- Locale-aware currency formatting and symbol positioning
Full changelog
v3.84.0 (2026-04-22)
🚀 Features
- allow client components to also be used as custom collection views (#16312) (8fe5f04)
- email-nodemailer: add email recipient override config (#16311) (1c1ed97)
- plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036)
- plugin-form-builder: add support for multi part uploads (#15268) (aa01a45)
- plugin-mcp: add support for server instructions (#15858) (c852d85)
🐛 Bug Fixes
- unique value errors are not displayed properly for localized fields (#16069) (f6e9073)
- correct slugifyTitle hook example in documentation (#16306) (48db8c1)
- handle multipart uploads without content-length (#16301) (c150ef8)
- plugin-ecommerce: verify PaymentIntent succeeded before creating… (#15902) (500e39d)
- richtext-lexical: internal links export as text in markdown transformer (#16302) (3dc6041)
- storage-*: simplify key handling for signed urls and composite prefixes (#16291) (6139508)
- templates: remove tilde SCSS imports and add Sass loadPaths for Windows (#16295) (7ca8b05)
- ui: json and richText fields expose unsupported operators in WhereBuilder (#16353) (a507fcc)
- ui: bulk edit ignores fields in named tabs and shows incorrect labels for unlabeled containers (#16340) (e5bc6be)
📚 Documentation
🧪 Tests
- add tests for autosave creating new versions and losing draft status on reload (#16335) (60d8678)
- add more integration tests to CI (#15419) (8a470c1)
📝 Templates
⚙️ CI
- disable audit-dependencies slack notification (#16329) (eeee018)
- use SLACK_CHANNEL env var for activity notifications (#16323) (a7cc58b)
- use artifacts for e2e prep so job retries don't fail on cache eviction (#16310) (bc590bd)
🏡 Chores
- change other instances of port 3000 being hardcoded in tests (#16290) (7f0b069)
- templates: fix link to one-click deployment (#16337) (5a39afc)
- templates: strengthen types in preview url gen (#14947) (fcbc987)
- templates: remove unused image-3 from website templates (#16155) (f0735b1)
🤝 Contributors
- Patrik (@PatrikKozak)
- Sasha (@r1tsuu)
- Jake Fletcher (@jacobsfletch)
- Elliot DeNolf (@denolfe)
- German Jablonski (@GermanJablo)
- Marcin Gierada (@teastudiopl)
- Anton Ambarov (@AntonAmbarov)
- Paul (@paulpopus)
- Jens Becker (@jhb-dev)
- Neha Prasad (@nehaaprasad)
- Jarrod Flesch (@JarrodMFlesch)
v3.83.0
Breaking risk
Security fixes
- SQL injection vulnerability in drizzle-orm and pg (db-postgres adapter)
v3.82.1
Bug fix
Fixed Next.js Turbo server fast refresh configuration key, improved nested documentation breadcrumb population, optimized S3 storage by avoiding unnecessary getObject calls when ETags match, and corrected documentation examples.
v3.82.0
Mixed
⚠ Upgrade required
- Minimum required Next.js version bumped to 16.2.2
- Updated Node.js requirement to v20
- Warning added regarding Cosmos DB incompatibility
Notable features
- typescript.postProcess hook for type generation
- Exported drag-and-drop components for UI
- Media file disambiguation via query parameter
v3.81.0
Security relevant
Security fixes
- High severity audit vulnerabilities resolved
- Updated file-type, ajv, and jose packages
Notable features
- LLM evaluation suite for code generation conventions
- Next.js cacheComponents compatibility
v3.80.0
New feature
Security fixes
- Resolved high-severity audit vulnerabilities in dependencies (#15961)
Notable features
- disableUnique property on slug fields for multi-tenant scenarios
- Fixed unpublish and draft version handling
- Improved pagination and query performance across databases
v3.79.1
Bug fix
Security fixes
- Use Sec-Fetch-Site header for cookie authentication validation
v3.79.0
New feature
Notable features
- Separate block icon and thumbnail configuration
- Rich text editor upgraded from v0.35.0 to v0.41.0
- i18n translations for modular dashboards
v3.78.0
New feature
Notable features
- TypeScript plugin for component import path validation
- Trash out of beta with granular delete access control
- Widget fields with type generation for dashboards
v3.77.0
New feature
Security fixes
- @modelcontextprotocol/sdk updated to 1.25.2 addressing security vulnerability (#15661)
Notable features
- customID argument on db.create for flexible document ID creation
- Local API depth parameter now passed to req.query.depth for consistency
- MCP plugin migrated to mcp-handler with security update
v3.76.1
Security relevant
Security fixes
- Added CSP headers to SVG uploads to prevent XSS attacks (#15506)
v3.76.0
New feature
Breaking changes
- Dropped support for Next.js versions with known CVEs (#15547)
Notable features
- Export/import limit controls with per-collection configuration
- Live-preview-vue now builds as ESM
v3.75.0
Bug fix
Security fixes
- Safety check added to redirects from external file URL uploads
Notable features
- beforeNav and afterNav component slots
- Full initReq context to server functions and widgets
v3.74.0
New feature
Notable features
- Override access visibility in document-level hooks
- strictDraftTypes enforcement across all Local API operations
- R2 multipart client uploads
v3.73.0
New feature
Notable features
- Full Next.js 16 support
- SQLite WAL mode and busy timeout support
- MCP select API with CRUD tools
v3.72.0
New feature
Breaking changes
- Migration required for existing version data when enabling localizeStatus feature
Security fixes
- Undici dependency bump to 7.18.2 mitigating chained decompression
Notable features
- Localized publication status per locale
- MCP depth parameter for relationship population control
v3.71.1
Bug fix
Removed a debug console.log statement from the Form component that was accidentally left in code.
v3.71.0
New feature
Breaking changes
- Ecommerce plugin cart logic moved to server-side implementation
Notable features
- Job queue concurrency supersedes for automatic cleanup
- Custom Status components in document controls
- IANA timezone and custom UTC offset support
v3.70.0
New feature
Security fixes
- Nodemailer security update to 7.0.12
Notable features
- Multi-column REST API sorting support
- Lexical blocks documentation and new component styles