v1.6.0 — safer installs and five new components

Payload Components 1.6.0 adds five installable components and strengthens the CLI's ownership, update, and recovery behavior.

Components

• Collection Query: access-aware Posts queries, filtering, and pagination.
• Contact Form Basic: an accessible form connected to a consumer-owned endpoint.
• Post Hero, Author Card, and Newsletter Callout: file-only article components that preserve host collections and do not run Payload generators.

Installer safety

• Preflight selected updates before changing source; preserve a private recovery backup and support update --recover after interruption.
• Restrict anonymous scaffolded Page reads to published content and refuse malformed ownership state.
• Preserve historical source hashes and bump versions for changed components so existing installs discover fixes.
• Keep localization policy migrations explicit and protect local edits and shared-file ownership.
• Patch HumanFS and qs dependency advisories.

Site and documentation

• Publish an English-only public site while retaining consumer Payload localization support.
• Add installation walkthroughs, component changelog data, and blog/template Markdown routes.
• Derive documentation sitemap dates from source history and reduce catalog client code and duplicate visual-baseline storage.

Validation and upgrading

The release candidate passed the full production-browser gate, Node 20 compatibility, one bare Payload smoke test, and four website smoke shards. Packed-artifact checks install and reinstall the new components through the built CLI.

Existing installs can review available component upgrades with payload-components list and the update dry run. Legacy localized installs require explicit acceptance of the semantic localization policy after migrating affected content; the CLI does not migrate your database. See the CLI reference and release operations guide.

MIT and community-first. Thanks to the contributors who helped review and extend this release.

Verified publication

Published from production commit b6a3fbc94b6dbca95dc7b64ce10704b65a6eee38; npm latest is 1.6.0 and records that exact git commit. Both production deployments passed.

• Publishing workflow: full release gate, packed-artifact checks, npm publication, and GitHub Packages mirror passed.
• Actual npm-tarball install/reinstall verification passed for Hero Basic and all five new components.
• Live registry verification passed. All 82 production items installed through raw shadcn public URLs, with file and dependency delivery checked; #15 records the reproducible evidence.