Skip to content

payload

Productivity & Wikis

A free, open‑source headless CMS that runs natively inside a Next.js app folder, combining front‑end and back‑end in one place.

TypeScript Latest v3.86.0 · 16d ago Security brief →

Features

  • Runs natively as part of a Next.js project (/app folder)
  • Fully extensible admin UI built with React Server Components
  • TypeScript‑first with automatic type generation for data models

Recent releases

View all 24 releases →
No immediate action
v3.86.0 New feature

disableBulkDelete + form‑builder + UI preview

Upgrade now
v3.85.2 Bug fix
Dependencies

Bug fixes: MongoDB, Cloud Storage, Drizzle, UI, CI

No immediate action
v3.85.1 Maintenance

Bug fixes + docs + CI

No immediate action
v3.85.0 Mixed

plugin‑import‑export graduation + bugfixes

v3.84.0 New feature
Notable features
  • Client components usable as custom collection views
  • Email recipient override configuration
  • Locale-aware currency formatting and symbol positioning
Full changelog

v3.84.0 (2026-04-22)

🚀 Features

  • allow client components to also be used as custom collection views (#16312) (8fe5f04)
  • email-nodemailer: add email recipient override config (#16311) (1c1ed97)
  • plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036)
  • plugin-form-builder: add support for multi part uploads (#15268) (aa01a45)
  • plugin-mcp: add support for server instructions (#15858) (c852d85)

🐛 Bug Fixes

  • unique value errors are not displayed properly for localized fields (#16069) (f6e9073)
  • correct slugifyTitle hook example in documentation (#16306) (48db8c1)
  • handle multipart uploads without content-length (#16301) (c150ef8)
  • plugin-ecommerce: verify PaymentIntent succeeded before creating… (#15902) (500e39d)
  • richtext-lexical: internal links export as text in markdown transformer (#16302) (3dc6041)
  • storage-*: simplify key handling for signed urls and composite prefixes (#16291) (6139508)
  • templates: remove tilde SCSS imports and add Sass loadPaths for Windows (#16295) (7ca8b05)
  • ui: json and richText fields expose unsupported operators in WhereBuilder (#16353) (a507fcc)
  • ui: bulk edit ignores fields in named tabs and shows incorrect labels for unlabeled containers (#16340) (e5bc6be)

📚 Documentation

🧪 Tests

  • add tests for autosave creating new versions and losing draft status on reload (#16335) (60d8678)
  • add more integration tests to CI (#15419) (8a470c1)

📝 Templates

  • bump plugin template to latest payload version (#16305) (9de13c2)

⚙️ CI

  • disable audit-dependencies slack notification (#16329) (eeee018)
  • use SLACK_CHANNEL env var for activity notifications (#16323) (a7cc58b)
  • use artifacts for e2e prep so job retries don't fail on cache eviction (#16310) (bc590bd)

🏡 Chores

  • change other instances of port 3000 being hardcoded in tests (#16290) (7f0b069)
  • templates: fix link to one-click deployment (#16337) (5a39afc)
  • templates: strengthen types in preview url gen (#14947) (fcbc987)
  • templates: remove unused image-3 from website templates (#16155) (f0735b1)

🤝 Contributors

  • Patrik (@PatrikKozak)
  • Sasha (@r1tsuu)
  • Jake Fletcher (@jacobsfletch)
  • Elliot DeNolf (@denolfe)
  • German Jablonski (@GermanJablo)
  • Marcin Gierada (@teastudiopl)
  • Anton Ambarov (@AntonAmbarov)
  • Paul (@paulpopus)
  • Jens Becker (@jhb-dev)
  • Neha Prasad (@nehaaprasad)
  • Jarrod Flesch (@JarrodMFlesch)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
43,672
Forks
3,945
Languages
TypeScript CSS JavaScript
Downloads/week
45,375 ↓3%
NPM Maintainers
10
Contributors
499
TypeScript
Types included ✓

Install & Platforms

Install via
npm

Community & Support

Alternative to

WordPress

Beta — feedback welcome: [email protected]