Release v4.0.0-beta.8 · payloadcms/payload

v4.0.0-beta.8 (2026-11-10)

let endpoints skip automatic authentication (#18761) (0896ae3)
build declared sizes at request time when no transformer stores them (#19299) (ada1d94)
apply saved transforms at request time and store only the original (#19179) (3a35c97)
let transformers claim _transforms keys and require one claimer per key (#19145) (3fe2a2e)
complete the file transformers contract with FileSource and doc (#19122) (f59387f)
save upload crop and focal point edits in _transforms (#19081) (8a6a30f)
plugin-mcp: add a built-in OAuth server (#19036) (35e8198)
plugin-mcp: add oauth auth hook (#18757) (9eb5a88)
plugin-mcp: let clients log in with OAuth (#18722) (e0428b8)

preserve nested arrays in transformPointDataToPayload (#19440) (23cbb98)
await a remote JSON schema before validating (#19438) (475bbb5)
correct search behaviour when using date field (#18456) (6efc439)
deep-copy omitted field values from the original document (#19398) (331b041)
improve telemetry accuracy and widget reporting (#19392) (dc58fe9)
deduplicate expanded hierarchy node IDs before fetching children (#18464) (7446e24)
db-mongodb: join across multiple collections on hasMany relationships (#18819) (138e516)
deps: require React 19.3.1 and Next.js 16.4.1 (#19460) (7425141)
drizzle: preserve input during write transformation (#19483) (ea00c5f)
plugin-mcp: send the oauth challenge for signed-out GET requests (#19319) (5fc8429)
plugin-mcp: allow deleteDocuments to delete trashed documents (#19051) (3c5610b)
plugin-multi-tenant: correct global redirect props (#19471) (b728638)
storage-gcs: signed upload URL expires after 18 seconds instead of 5 hours (#19452) (96eaaf1)
ui: scope rendered locale to the admin page (#19377) (d729fd3)
ui: remove inset highlights from dark modal shadows (#19345) (e71e91c)
ui: show the original file in the upload preview instead of the admin thumbnail (#19362) (3eb46cf)
ui: prevent cross-tenant bulk actions (#19301) (4ab962d)
ui: read the document in the request locale during the stale data check (#18458) (8e93e02)

consolidate Lexical form-state reduction (#19423) (25dfb24)
rename form-state data utilities (#19425) (1ad296e)
ui: let Form completely own the form-state request lifecycle (#19343) (09b6b84)
ui: extract form state into useFormState (#19384) (5d4a76b)
ui: extract form submission into useFormSubmission (#19307) (fac8196)

expect the unsuffixed file name and role in the xsl upload test (#19336) (07e63aa)

use sidebar-only PR demo annotations (#19487) (6040dd6)
lint :has() above a universal subject (#19462) (82072bf)
improve PR demo cursor pacing and responsive layout (#19473) (d339044)
$record-pr-demo add renewable leases for recording jobs (#19419) (cfa7d6e)
$record-pr-demo smaller file sizes for created videos, with better quality (#19415) (391868b)
improve PR demo recordings and step annotations (#19378) (a84cd2f)
regenerate multi-tenant test types (#19306) (9bb8f47)

let endpoints skip automatic authentication (#18761) (0896ae3)

Adds disableAuth to endpoint configs. With it, Payload doesn't run the
auth strategies before the handler, and req.user stays null, so the
handler can authenticate the request itself.
rename form-state data utilities (#19425) (1ad296e)

Renames the getSiblingData and reduceFieldsToValues form-state data
utilities to improve semantics and make their source explicit.
deps: require React 19.3.1 and Next.js 16.4.1 (#19460) (7425141)

Raises the published peer requirements to React and React DOM ^19.3.1,
Next.js >=16.4.1 <17.0.0, and @vitejs/plugin-rsc ^0.5.38.
ui: let Form completely own the form-state request lifecycle (#19343) (09b6b84)

Requires #19307 and #19384.