v4.0.0-beta.5

v4.0.0-beta.5 (2026-10-27)

🐛 Bug Fixes

• pass extra uploadReference fields as clientData (#19033) (cdb8ec4)
• public upload receipts with signed adapterData (#19032) (3355177)
• let plugins replace another plugin's options (#18762) (aebbf75)
• run the password field's validation on reset password (#19006) (0c74c77)
• graphql: exclude hidden fields from mutation inputs (#18862) (e442a3f)
• ui: preserve diagonal pointer travel into popup submenus (#18857) (786dffb)

📚 Documentation

• clarify development environment security expectations (#18829) (c787686)
• adds new batch of ui-component docs for v4 (#18786) (9098890)

🧪 Tests

• richtext-lexical: use accessible link field selectors (#19013) (4bc505c)

📝 Templates

• fix non-existent dependency versions (#18988) (57f3909)

⚙️ CI

• approve templates bump PR so auto-merge completes (#18990) (9301020)
• attach per-package SBOMs to beta releases (#18887) (fe81635)
• use the release environment for the templates PR (#18951) (de9bfa5)

⚠️ BREAKING CHANGES

• pass extra uploadReference fields as clientData (#19033) (cdb8ec4)

With receipts off, Payload used to pass uploadReference to handlers unchanged. Adapters that read extra fields from the top level must now read them from uploadReference.clientData. No first-party adapter is affected; they all use receipts.

🤝 Contributors

• Jake Fletcher (@jacobsfletch)
• Nate Lentz (@nathanlentz)
• Sean Zubrickas (@zubricks)
• Alessio Gravili (@AlessioGr)
• Jarrod Flesch (@JarrodMFlesch)
• Dan Ribbens (@DanRibbens)
• Elliot DeNolf (@denolfe)
• German Jablonski (@GermanJablo)