v3.88.0

v3.88.0 (2026-08-11)

🐛 Bug Fixes

• prevent multipart content-type backtracking (#17679) (a742140)
• ui: tighten clipboard prefix matching to prevent sibling row leakage on copy/paste (#17595) (c6477b8)

🛠 Refactors

• plugin-mcp: better access control defaults for api keys collection (#17751) (025581d)

📝 Templates

• bump next.js to 16.3.0 (#17683) (ee155b7)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Alessio Gravili (@AlessioGr)
• Nate Lentz (@nathanlentz)

v3.87.1

v3.87.1 (2026-08-06)

🐛 Bug Fixes

• connect to the correct Next.js dev HMR endpoint per version (#17644) (291ac66)
• db-mongodb: bump mongoose to 8.24.1 for GHSA-664h-wqgq-64gw (3.x backport of #17609) (#17608) (f039324)
• deps: bump undici (#17630) (9e2c11e)
• plugin-mcp: bump @modelcontextprotocol/sdk to 1.30.0 for GHSA-frvp-7c67-39w9 (3.x) (#17611) (0cb605d)
• richtext-lexical: preserve link drawer form state (#17586) (90fb9e1)
• templates: fix with-cloudflare-d1 build and bump dependencies (#17577) (ca3e899)

📚 Documentation

• update admin panel location link in custom components docs (#17624) (57178e3)

⚙️ CI

• allow changes job to check out repository (#17643) (ec4f979)

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sean Zubrickas (@zubricks)
• Patrik (@PatrikKozak)

v3.87.0

v3.87.0 (2026-07-31)

🚀 Features

• storage-azure: client uploads with chunkLargeFiles can now support files larger than 5gb (#17319) (3c00a39)

🐛 Bug Fixes

• preserve parent localization through tabs 3.x (#17591) (9c8d636)
• replace image-size with image-dimensions dependency for upload dimensions (#17571) (2a99a01)
• forward locale in count and countGlobalVersions (3.x) (#17547) (e042561)
• pass id to delete access control on soft delete in updateByID (#17529) (a539f5b)
• prefer draft titles in by folder view (#17412) (ef8a6a5)
• arrays and blocks should handle null values, v3 backport (#17278) (2a69863)
• db-mongodb: error on null values in arrays and blocks (#17190) (249f8df)
• drizzle: validate companion table name length against 63-char limit (#17563) (fd629f2)
• drizzle: dedupe reused localized block tables (#17430) (3e8191c)
• plugin-multi-tenant: apply tenant on confirm (#17350) (09e01df)
• storage-vercel-blob: allow overwriting existing blob keys (#17385) (fc2572e)
• templates: prevent unauthenticated draft-mode access in website preview route (#17472) (0c2e9a8)
• templates: mark website button as client component for radix-slot context (#17474) (981b282)
• ui: resolve named-tab field permissions in bulk edit field select (3.x backport of #17523) (#17524) (2371624)
• ui: keep folder create drawers open during autosave (#17421) (bf72bda)
• ui: handle undefined field admin components (#17388) (5157c72)

📚 Documentation

• remove deprecated root endpoint property (#17570) (6402daa)
• accessibility banner fix (#17431) (29dd43c)
• fix link in live preview dynamic url section (#17340) (cc81ef0)
• document exported TypeScript type helpers for plugins (#17336) (d4d029f)
• plugin-mcp: fix broken Claude Code link (#17502) (21e24ca)

🧪 Tests

• richtext-lexical: create dev user first in seed to fix flaky e2e (3.x backport of #17507) (#17568) (0f6c1b3)

⚙️ CI

• remove --json from pnpm publish to fix release hang on pnpm v11 (#17279) (4a82c20)

🏡 Chores

• export parse params and related sanitizers (#17314) (f14722a)

🤝 Contributors

• Dan Ribbens (@DanRibbens)
• Paul (@paulpopus)
• Patrik (@PatrikKozak)
• Nate Lentz (@nathanlentz)
• Kacper Zawojski (@zawoj)
• Marc Maceira (@marcmaceira)
• Jarrod Flesch (@JarrodMFlesch)
• Sean Zubrickas (@zubricks)
• Raşit Akyol (@rasitakyol)
• Jessica Rynkar (@JessRynkar)
• Elliot DeNolf (@denolfe)

v3.86.0

v3.86.0 (2026-07-10)

🚀 Features

• collection-level disableBulkDelete (#17207) (ca02cdc)
• plugin-form-builder: v3 backport to support translations (#17255) (2cde8c8)
• ui: add livePreview.openByDefault config option (#17213) (f23b693)

🐛 Bug Fixes

• coerce schedulePublish doc.value to collection ID type before update (#17238) (7de11b2)
• escape regex metacharacters in isURLAllowed pathname allow-list (#17237) (2061859)
• respect disabled GraphQL config, v3 backport (#17228) (9e9c35a)
• allow access to files reuploaded on a draft (#17209) (f02d22a)
• plugin-multi-tenant: run tenant delete cleanup inside the request transaction (#17175) (d128fde)
• sdk: use qs-esm allowEmptyArrays parameter (#17208) (c7dc68e)
• ui: presentational fields skipped in form state when admin.condition is false (#17224) (f31f26d)
• ui: prevent slug field error tooltip from hiding lock button (#15885) (908fba1)

⚙️ CI

• upgrade pnpm to v11 (#17169) (ca72620)

🤝 Contributors

• Jessica Rynkar (@JessRynkar)
• Ævar Þór Gunnlaugsson (@aevarOrigo)
• Sasha (@r1tsuu)
• Herman Ciechanowiec (@ciechanowiec)
• Vivek Tyagi (@darkspirit2802)
• Noah Bachmann (@noahbachmann)
• Jake Fletcher (@jacobsfletch)
• Amelia (@LimChorngUan)
• German Jablonski (@GermanJablo)
• Elliot DeNolf (@denolfe)
• Jarrod Flesch (@JarrodMFlesch)

v3.85.2

v3.85.2 (2026-07-01)

🐛 Bug Fixes

• payload bin fails with tsx on node v23.5+ (#17081) (afb0226)
• regenerate reused array and block row IDs during bulk update (3.x) (#17018) (e526c88)
• prevent type generation script from hanging on storage-r2 (#17020) (b681448)
• prevent reordering from unpublishing documents that have a newer draft (#16969) (b4d43c0)
• db-mongodb: remove duplicate IDs in nested relationship queries (#17019) (8533dfb)
• deps: resolve high severity audit vulnerabilities (#17086) (ac000e5)
• deps: override transitive js-cookie to ^3.0.7 (CVE-2026-46625) (#17000) (ef888de)
• drizzle: preserve failing sub-table on unique-constraint ValidationError (3.x) (#17015) (6dfac53)
• plugin-cloud-storage: split client and server utility exports (#17152) (30bc3fd)
• plugin-cloud-storage: prevent draft file reupload from unpublishing the document (3.x) (#17034) (a18ae22)
• richtext-lexical: preserve hard line breaks on markdown import (#17061) (c0affcb)
• translations: replace Malay strings in Burmese (my) locale (3.x) (#17032) (c3ae01d)
• ui: preserve polymorphic upload bulk select relation (#17112) (9691e42)
• ui: list relationship cell shows (Untitled) for draft-only titles (#16979) (16152e2)
• ui: respect admin.condition on row fields (#16954) (29afa77)

⚙️ CI

• backport test service image pinning to ghcr on 3.x (#17162) (d04d47e)
• reintroduce audit script (#17122) (f76d670)

🤝 Contributors

• Jarrod Flesch (@JarrodMFlesch)
• Elliot DeNolf (@denolfe)
• Sasha (@r1tsuu)
• German Jablonski (@GermanJablo)
• Amelia (@LimChorngUan)

v3.85.1

v3.85.1 (2026-06-09)

🐛 Bug Fixes

• fix draft save and duplicate behaviour on upload-enabled collections (#16853) (fad992c)
• bin scripts cannot import dependencies without explicit "type": "module" (backport) (#16848) (6707e85)
• add type declarations for css export (TypeScript 6 compat) (#16348) (6c81355)
• follow redirects when fetching uploaded files for MIME type detection (#16708) (ac46214)
• plugin-import-export: fix CSV import of arrays and richText nest… (#16923) (ccbdcc2)
• ui: use explicit relative paths for internal SCSS imports v3.x (#16827) (c039e55)
• ui: hide entire tabs field when admin.condition is false (#16809) (79b4e4c)

⚡ Performance

• ui: skip rendering custom components hidden by admin.condition (#16819) (0be11b6)

📚 Documentation

• fixes 404 link to monaco editor options (#16877) (5f40868)
• restructure getting started and concepts pages (#16846) (0f384f4)

⚙️ CI

• restore post-release workflow on 3.x (#16748) (f1861c1)

🤝 Contributors

• Paul (@paulpopus)
• Habeeb (@haxllo)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Anders Semb Hermansen (@andershermansen)
• Elliot DeNolf (@denolfe)

v3.85.0

v3.85.0 (2026-05-26)

🚀 Features

• plugin-import-export: out of beta and added support for collection-level and field-level hooks (#16556) (cf9252d)

🐛 Bug Fixes

• bump uuid package to 13.0.2 (#16545) (274af06)
• stop workflows retrying forever when no retries are configured (#16465) (caf9150)
• db-mongodb: bump mongoose to 8.22.1 for GHSA-wpg9-53fq-2r8h (#16688) (4baba91)
• plugin-cloud-storage: propagate custom hook errors during upload (#16632) (055c508)
• plugin-cloud-storage: preserve user-defined prefix.defaultValue (#16529) (8d14915)
• plugin-cloud-storage: dedupe filename in clientUploads signed URL (#16510) (64b2860)
• plugin-multi-tenant: tenant field unselectable in bulk upload "Edit all" (#16466) (695df3c)
• richtext-lexical: cursor kicked out of nested richtext while typing in a block (#16490) (931a349)
• richtext-lexical: drag/drop image into rich text fails when a field name matches the collection slug (#16409) (d6f7b47)
• ui: bulk upload silently counts failed files as saved (#16532) (c31f4ef)
• ui: respect formatDocURL returning null in ListDrawer (#16464) (0facc44)
• ui: show all listSearchableFields in ListDrawer search placeholder (#16467) (3cd4a64)

📚 Documentation

• fix links in admin faq (#16711) (7e4f7af)
• adds relevant videos to docs sections (#16516) (d17298f)

📝 Templates

• bumps next.js to 16.2.6 (#16538) (9b36063)

⚙️ CI

• use postgres 15 for content api tests (#16706) (99d4930)

🏡 Chores

• deps: bump nodemailer minimum version to 8.0.5 (#16664) (efa4afe)

🤝 Contributors

• Sean Zubrickas (@zubricks)
• German Jablonski (@GermanJablo)
• Jake Fletcher (@jacobsfletch)
• Paul (@paulpopus)
• Alessio Gravili (@AlessioGr)

v3.84.1

v3.84.1 (2026-04-23)

Retargeting create-payload-app to pull from 3.x branch.

⚙️ CI

• adjust 3.x branch references (#16358) (b6131f7)

🤝 Contributors

• Elliot DeNolf (@denolfe)

v3.84.0

v3.84.0 (2026-04-22)

🚀 Features

• allow client components to also be used as custom collection views (#16312) (8fe5f04)
• email-nodemailer: add email recipient override config (#16311) (1c1ed97)
• plugin-ecommerce: add locale-aware currency formatting and symbol positioning (#15139) (6731036)
• plugin-form-builder: add support for multi part uploads (#15268) (aa01a45)
• plugin-mcp: add support for server instructions (#15858) (c852d85)

🐛 Bug Fixes

• unique value errors are not displayed properly for localized fields (#16069) (f6e9073)
• correct slugifyTitle hook example in documentation (#16306) (48db8c1)
• handle multipart uploads without content-length (#16301) (c150ef8)
• plugin-ecommerce: verify PaymentIntent succeeded before creating… (#15902) (500e39d)
• richtext-lexical: internal links export as text in markdown transformer (#16302) (3dc6041)
• storage-*: simplify key handling for signed urls and composite prefixes (#16291) (6139508)
• templates: remove tilde SCSS imports and add Sass loadPaths for Windows (#16295) (7ca8b05)
• ui: json and richText fields expose unsupported operators in WhereBuilder (#16353) (a507fcc)
• ui: bulk edit ignores fields in named tabs and shows incorrect labels for unlabeled containers (#16340) (e5bc6be)

📚 Documentation

• add publishing access control example (#16021) (da17810)

🧪 Tests

• add tests for autosave creating new versions and losing draft status on reload (#16335) (60d8678)
• add more integration tests to CI (#15419) (8a470c1)

📝 Templates

• bump plugin template to latest payload version (#16305) (9de13c2)

⚙️ CI

• disable audit-dependencies slack notification (#16329) (eeee018)
• use SLACK_CHANNEL env var for activity notifications (#16323) (a7cc58b)
• use artifacts for e2e prep so job retries don't fail on cache eviction (#16310) (bc590bd)

🏡 Chores

• change other instances of port 3000 being hardcoded in tests (#16290) (7f0b069)
• templates: fix link to one-click deployment (#16337) (5a39afc)
• templates: strengthen types in preview url gen (#14947) (fcbc987)
• templates: remove unused image-3 from website templates (#16155) (f0735b1)

🤝 Contributors

• Patrik (@PatrikKozak)
• Sasha (@r1tsuu)
• Jake Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)
• Marcin Gierada (@teastudiopl)
• Anton Ambarov (@AntonAmbarov)
• Paul (@paulpopus)
• Jens Becker (@jhb-dev)
• Neha Prasad (@nehaaprasad)
• Jarrod Flesch (@JarrodMFlesch)

v3.83.0

v3.83.0 (2026-04-15)

🚀 Features

• expand plugin API (#16247) (54189e1)
• add profiling utilities for performance analysis (#16198) (9391c20)
• add internal plugin priority and slug api for cross-plugin discovery (#16244) (5f5694f)
• hide slug field buttons when field is read-only (#14824) (67c2c47)
• cpa: add --agent flag for coding agent skill installation (#16278) (9f9f343)
• drizzle: add uuidv7 support (#16113) (ac01e82)
• email-resend: add Custom headers for the Resend adapter (#15645) (a7dd17c)
• next: add support for custom collection views (#16243) (835a0ad)
• plugin-form-builder: change checkbox label from 'Default Value' to 'Checked by default' (#15229) (b3d2054)
• plugin-mcp: allow external plugins to extend mcp plugin (#16245) (ac4fc31)
• richtext-lexical: add view override system for custom node rendering (#14244) (1ef43eb)
• storage-*: add useCompositePrefixes option and fix client upload prefix handling (#16230) (74aa825)

---

Expanded Plugin API — New definePlugin helper introduces opt-in execution ordering, cross-plugin discovery via a slug-keyed plugins map, and module augmentation for type-safe plugin options. The existing (config) => config contract remains unchanged. #16247

import { definePlugin } from 'payload'

export const seoPlugin = definePlugin<SEOPluginOptions>({
  slug: 'plugin-seo',
  order: 10,
  plugin: ({ config, plugins, collections, generateTitle }) => ({
    ...config,
    // collections and generateTitle come from SEOPluginOptions
  }),
})

Profiling Utilities — Lightweight timeSync and timeAsync wrappers for measuring function execution time during development. Wrap any function to capture its duration, then call printProfileResults for a formatted timing table. Not intended for production use. #16198

Internal Plugin Priority & Slug API — Plugins can now attach priority, slug, and options properties for execution ordering and cross-plugin discovery. Lower priority runs first; other plugins can find each other by slug via config.plugins without imports. Marked @internal for now. #16244

Hidden Slug Field Buttons on Read-Only — The Generate and Lock/Unlock buttons on slug fields are now automatically hidden when the field is read-only, removing controls that serve no purpose in that state. #14824

Agent Flag for CPA (cpa) — create-payload-app now supports a --agent / -a flag (claude, codex, cursor) that downloads the Payload coding skill from GitHub and installs it in the correct directory for your agent. A root-level CLAUDE.md or AGENTS.md is written for discoverability. Use --no-agent to skip. #16278

UUIDv7 Support (drizzle) — New idType: 'uuidv7' option for Postgres and SQLite adapters generates time-ordered UUIDs that are friendlier for B-tree indexes than random v4 UUIDs, while using the same storage column type. IDs are generated in application code so older Postgres versions are supported. #16113

Custom Email Headers (email-resend) — The Resend adapter now passes custom headers from sendEmail options to the Resend API, enabling features like List-Unsubscribe headers that were previously silently dropped. #15645

await payload.sendEmail({
  from: "Test <test@domain.com>",
  to: "jimmybillbob@example.com",
  subject: "Email with custom headers",
  html: html,
  headers: {
    "List-Unsubscribe": "<https://domain.com/unsubscribe>",
    "List-Unsubscribe-Post": "List-Unsubscribe=One-Click",
  },
});

Custom Collection Views (next) — Register custom views at the collection level via admin.components.views[key] with a Component and path. Folders take routing precedence over custom views on upload collections. #16243

{
  slug: 'products',
  admin: {
    components: {
      views: {
        grid: {
          Component: '/components/GridView',
          path: '/grid',
          exact: true,
        },
      },
    },
  },
}

Checkbox Label Clarity (plugin-form-builder) — The form builder checkbox field label was changed from "Default Value" to "Checked by default" to eliminate confusion about whether the checkbox toggles a default value or sets the initial checked state. #15229

Extensible MCP Plugin (plugin-mcp) — External plugins can now extend plugin-mcp by finding it via slug in config.plugins and injecting custom MCP tools into its options. Also exports the MCPPluginConfig type for type-safe tool injection. #16245

View Override System for Custom Node Rendering (richtext-lexical) — ⚠️ Experimental. Override how any Lexical node type is rendered in the editor via view maps. Supports custom DOM, React components, or HTML strings. Works in both the admin editor and frontend JSX serialization for WYSIWYG consistency. #14244

export const myViews: LexicalEditorViewMap = {
  default: {
    heading: {
      createDOM() {
        const h2 = document.createElement('h2')
        h2.textContent = 'Custom Heading'
        return h2
      },
    },
    horizontalRule: {
      Component: () => <div className="custom-hr">---</div>,
    },
    link: {
      html: '<a href="#">Custom Link</a>',
    },
  },
}

{
  fields: [
    {
      name: 'content',
      type: 'richText',
      editor: lexicalEditor({
        views: '/path/to/views.tsx#myViews',
      }),
    },
  ]
}

Composite Prefixes for Storage Adapters (storage-*) — New useCompositePrefixes option combines collection and document prefixes instead of one overriding the other. Also fixes a bug where client uploads ignored document prefix entirely. Applies to S3, Azure, GCS, R2, and Vercel Blob. #16230

Mode	Collection Prefix	Doc Prefix	Result
false (default)	media-folder	user-123	user-123/file.jpg
true	media-folder	user-123	media-folder/user-123/file.jpg

🐛 Bug Fixes

• restore falling back to current document values for undefined fields (#16272) (4b4d61c)
• enforce mimeTypes restriction when useTempFiles is enabled (#16255) (bb749a5)
• prevent cron from permanently dying after handler errors (#16219) (c5e0e02)
• use safe property assignment in deepMergeSimple (#16271) (2b23010)
• handle concurrent autosave write conflicts gracefully (#16216) (e8502fa)
• use instanceof instead of constructor name in formatErrors (#16089) (216d162)
• parse JSON string where query param (#15745) (2a26b5a)
• expose type for field's position (#14390) (d9b3c07)
• default virtual fields to readOnly in admin UI (#16016) (72396f6)
• localized array,group,blocks fields duplicate with empty values ([#15849](https://github....