Skip to content

fix(deps): update payloadcms monorepo to v3 (major) #68

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update payloadcms monorepo to v3 (major) #68

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 14, 2025 •
edited
Loading

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@payloadcms/db-mongodb (source) ^1.0.0 → ^3.0.0 age confidence
@payloadcms/richtext-lexical (source) ^0.11.0 → ^3.0.0 age confidence
@payloadcms/richtext-slate (source) ^1.0.0 → ^3.0.0 age confidence

Release Notes

payloadcms/payload (@​payloadcms/db-mongodb)

v3.69.0

Compare Source

🚀 Features
Modular Dashboards with Widgets

Introduces customizable admin dashboards with draggable, resizable widgets. Build personalized dashboard layouts with full keyboard accessibility for reordering and resizing. Future updates will add widget fields (props) for configurable widgets and dashboard presets for sharing layouts. #​13683

Screen.Recording.2025-11-28.at.17.13.14.mov

See the RFC discussion for background and roadmap.

AI Development Resources (templates)

All templates now ship with AGENTS.md and .cursor/rules/ directory for improved AI-assisted development with tools like Copilot and Cursor. #​14889

See more about AGENTS.md

🐛 Bug Fixes
  • basePath not working properly with admin routes (#​14967) (fa6b503)
  • get field by path for blocks (#​14984) (519a3c6)
  • improves upload security for PDFs and SVGs (#​14929) (61298c6)
  • missing range headers (#​14887) (ec7c192)
  • next: status component incorrectly shows as published status on new documents saved as drafts when readVersions permissions are false (#​14950) (394c024)
  • plugin-mcp: adds collection and strategy to user (#​14981) (042d7eb)
  • plugin-multi-tenant: relationTo arrays inflating filterOptions where query size (#​14944) (98b6791)
  • richtext-lexical: blocksFeature with relationship exposes other tenants (#​14985) (3025377)
  • storage-s3: encode filename in generated URL (#​14438) (86855e1)
  • ui: use portals for popup to prevent clipping, improve keyboard navigation (#​14910) (af09932)
🛠 Refactors
📚 Documentation
🧪 Tests
🏡 Chores
🤝 Contributors

v3.68.5

Compare Source

🐛 Bug Fixes
🛠 Refactors
🤝 Contributors

v3.68.4

Compare Source

🐛 Bug Fixes
📚 Documentation
  • remove unused variable from custom field label translation (#​14911) (77f96a4)
  • update collection access control reference link on collection config page (#​14905) (3a1eb77)
⚠️ BREAKING CHANGES
🤝 Contributors

v3.68.3

Compare Source

⚠️ Security Issue

A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) affect React 19 and frameworks that use it, like Next.js.

Full details here: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn you of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Resolution

You are strongly encouraged to upgrade your own apps to the nearest patched versions of Next.js and deploy immediately.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add next@15.4.9

For a full breakdown of the vulnerable packages and their patched releases, see https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app.

🐛 Bug Fixes
🤝 Contributors

v3.68.2

Compare Source

🐛 Bug Fixes
  • next: use fileURLToPath for cross-platform path resolution (#​14877) (e86098d)

Fixes Windows users getting ENOENT errors on dev startup.

  • next: unhandled error in renderListView server function when no user present (#​14878) (10a8f0f)
  • next: merge user serverExternalPackages in withPayload (#​14881) (dcecc46)
🛠 Refactors
  • replace generic Error('Unauthorized') with UnauthorizedError (#​14879) (c9a8aa0)
  • next: remove unnecessary react hooks from DefaultTemplate rsc (#​14876) (7a94cc1)
🏡 Chores
🤝 Contributors

v3.68.1

Compare Source

🏡 Chores
  • do not suggest vulnerable Next.js release in turbopack build error message (#​14873) (9e0f593)
🤝 Contributors

v3.68.0

Compare Source

🚀 Features

Turbopack Build Support (next) - Automatically enables Turbopack Build compatibility when using Next.js ≥ 16.1.0-canary.3. The withPayload wrapper now detects supported versions and enables transitive dependency externalization, unlocking significantly faster production builds with Turbopack. #​14845

🐛 Bug Fixes
  • adds read and readDistinct to hook mapping (#​14853) (0da0da8)
  • undefined drafts error in collections with join fields (#​14855) (3a29cec)
  • use hasDraftsEnabled utility instead of direct check (#​14843) (9c9c7c5)
  • file objects being serialized to plain objects in upload form state (#​14818) (d86c174)
  • db-mongodb: correctly pass through collation config in the adapter to be applied in queries via locales (#​11242) (db59cb4)
  • plugin-multi-tenant: simplified getTenantOptions function and added access control for regular users (#​14620) (f7cc078)
  • storage-*: upload filename respects prefix (#​14566) (ccfaee0)
  • ui: component AddNewRelation saves relationTo as first collection instead of selected collection (#​14836) (8c5c1fb)
  • ui: list drawer per-page dropdown resets to 10 instead of showing saved limit (#​14830) (db13a60)
📚 Documentation
  • add note about returning a query from a readVersions access control (#​14822) (0860837)
🧪 Tests
🔨 Build
⚙️ CI
🏡 Chores
🤝 Contributors

v3.67.0

Compare Source

🚀 Features
  • add groupBy support to query presets (#​14808) (2b7aa7a)
  • plugin-ecommerce: add ability to enable guest carts with reworked access config (#​14565) (90c92f4)

GroupBy Support for Query Presets - Query presets now save and restore groupBy state when switching between presets. Previously, groupBy settings would persist across preset switches and weren't saved as part of the preset configuration. #​14808

Preset creation with group-by added

Guest Carts (plugin-ecommerce) - Enable guest users to create and manage carts without authentication. Carts created by guests are secured with a generated secret stored in local storage. Configure with allowGuestCarts (enabled by default). Also adds isLoading status to all hooks for conditional UI state.
#​14565

// Before
ecommercePlugin({
  access: {
    adminOnly,
    adminOnlyFieldAccess,
    adminOrCustomerOwner,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
  }
})

// After
ecommercePlugin({
  access: {
    adminOnlyFieldAccess,
    adminOrPublishedStatus,
    customerOnlyFieldAccess,
    isAdmin,
    isDocumentOwner,
  }
})

🐛 Bug Fixes

  • add missing beforeInput and afterInput properties to UploadAdmin type (#​14775) (22a0255)
  • add missing afterOperation and beforeOperation hook calls (#​14778) (e9cd2a5)
  • sanitized versions type was incorrect (#​14810) (51c951f)
  • plugin-multi-tenant: moves getGlobalViewRedirect from utilities to rsc exports (#​14817) (1340818)
  • ui: autosave not queued while background process is in flight (#​14805) (14f042f)
  • ui: ensure block error css only gets applied to the affected block (#​14826) (7520140)
  • ui: missing translation support in SelectMany component (#​14819) (8fa91a5)

⚡ Performance

⚙️ CI

  • clean up bug report template for auto-labeling (ebee8e1)

🏡 Chores

⚠️ BREAKING CHANGES

  • plugin-ecommerce: add ability to enable guest carts with reworked access config (#​14565) (90c92f4)

This PR introduce a breaking change into the plugin as it was necessary
in order to provide more secure guest carts.

🤝 Contributors

v3.66.0

Compare Source

⚠️ Security Issue

A critical-severity vulnerability in React Server Components (CVE-2025-55182) affects React 19 and frameworks that use it, including Next.js (CVE-2025-66478).

You are strongly encouraged to immediately upgrade your own apps to the nearest patched versions of React and Next.js.

While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of React or Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn of the version incompatibilities.

You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.

Quick steps:

If using pnpm as your package manager, here's a one-liner:

pnpm add react@19.2.1 next@15.4.8

To do this manually:

  1. In your package.json:
    • Bump react to 19.2.1
    • Bump next to 15.4.8
  2. Reinstall node modules, e.g. pnpm i
  3. Redeploy your app

Here's a full breakdown of the vulnerable packages and their patched releases:

Vulnerable package Patched release
React 19.0, 19.1, 19.2 19.0.1, 19.1.2, and 19.2.1
Next.js 14.3.0-canary, 15.x, and 16.x (App Router) 14.3.0-canary.88, 15.0.5, 15.1.9, 15.2.6, 15.3.6, 15.4.8, 15.5.7, 16.0.7

See #​14807 for more details.

🚀 Features
Feature Details

Custom Slugify Functions - Override the default slug field behavior with your own slugify function. Useful for special character encoding, additional language support, or custom slug formatting. Also deprecates fieldToUse in favor of useAsSlug for consistency with useAsTitle. #​14117

import type { CollectionConfig } from 'payload'
import { slugField } from 'payload'
import slugify from 'slugify';

export const MyCollection: CollectionConfig = {
  // ...
  fields: [
    // ...
    slugField({
      slugify: ({ valueToSlugify }) => slugify(valueToSlugify, {
        // ...additional `slugify` options here
      })
    })
  ]
}

Accessibility Testing and Improvements - Adds automated accessibility testing infrastructure including axe a11y scans, focus indicator checks, and horizontal scroll overflow detection. Covers all fields, major views, components, plugins, and Lexical editor. See the a11y report discussion for tracked issues. #​14454

External JSON Schema References in Type Generation - Enables $ref pointers to external .json schema files in typescriptSchema field config. External references are resolved relative to process.cwd(). #​14749

// payload.config.ts
{
  typescript: {
    schema: [
      ({ jsonSchema }) => {
        jsonSchema.definitions.MyType = {
          $ref: './schemas/my-type.json'
        }
        return jsonSchema
      },
    ]
  }
}

Auto-detect D1 Adapter (cpa) - The with-cloudflare-d1 template now automatically assumes the D1 database adapter, eliminating the database selection prompt during project creation. #​14799

Upload Node Alignment (richtext-lexical) - Adds alignment support to upload nodes in the Lexical editor. Upload/media blocks can now be aligned left, center, or right using the FORMAT_ELEMENT_COMMAND. #​14720

Upload alignment support

🐛 Bug Fixes
  • remove "all" from JSDoc comment on supported http methods in endpoints (#​14777) (8c8def9)
  • should exclude svg files from file buffer mime validation (#​14751) (015b363)
  • deps: bump minimum react and next versions (#​14807) (2dfe464)
  • plugin-import-export: incorrect user type in Export causing runtime type mismatch (#​14790) (61f5aee)
  • plugin-multi-tenant: tenant modal not appearing when autosave is off (#​14806) (b96e928)
  • plugin-multi-tenant: auto assign tenant when autosave is enabled (#​14745) (b0674fa)
  • richtext-lexical: copying and pasting a single block in Lexical results in an error due to duplicate ID (#​14738) (cd9addf)
  • richtext-lexical: export serverInlineBlock modules (#​14739) (becceb7)
  • translations: translate slug field actions (#​14784) (5542e56)
  • ui: prevent NaN page parameter in polymorphic relationship pagination (#​14795) (bbdfdb8)
  • ui: reduce spacing between checkbox and first column when few columns shown (#​14776) (6ae1bc8)
📚 Documentation
🧪 Tests
📝 Templates
  • update with-cloudflare-d1 to the latest OpenNext and wrangler (#​14509) (5150388)
⚙️ CI
🏡 Chores
⚠️ BREAKING CHANGES
🤝 Contributors

v3.65.0

Compare Source

🚀 Features
  • add augmentable interfaces for collection and global custom properties (#​14729) (850c252)
  • allow to specify payload instance cache key in handleEndpoints (#​14675) (efa2fd2)
  • db-mongodb: add afterCreateConnection and afterOpenConnection hooks (#​14649) (af6ba86)
  • plugin-mcp: add localization support to MCP resource operations (#​14334) (a3f490b)
  • plugin-mcp: adds a PayloadRequest to custom tool, prompt, and resource handlers (#​14644) (0d14b06)
  • ui: extract block selector from blocks drawer (#​14697) (b9b11f0)

Type-Safe Custom Properties - Add augmentable interfaces for collection and global custom properties: CollectionCustom, CollectionAdminCustom, GlobalCustom, and GlobalAdminCustom. Enables type-safe plugin configuration at the collection/global level with full autocomplete support, matching the existing FieldCustom pattern. #​14729

// Augment interfaces in your plugin or project
declare module 'payload' {
  export interface CollectionAdminCustom {
    disabledFields?: string[]
  }

  export interface CollectionCustom {
    myPluginConfig?: {
      enabled: boolean
      settings: Record<string, any>
    }
  }
}

// Now get full type safety in collections
export const Posts: CollectionConfig = {
  slug: 'posts',
  admin: {
    custom: {
      disabledFields: ['status'] // ✅ Type-safe!
    }
  },
  custom: {
    myPluginConfig: {
      enabled: true,
      settings: {}
    }
  }
}

Payload Instance Cache Key - Specify payloadInstanceCacheKey in handleEndpoints and createPayloadRequest to control which cached Payload instance is used for custom endpoints. Useful for multi-tenant scenarios or when managing multiple Payload instances. #​14675

MongoDB Connection Lifecycle Hooks (db-mongodb) - Add afterCreateConnection and afterOpenConnection hooks to the MongoDB adapter for performing setup logic after connection/pool initialization. Enables use cases like connection pooling in serverless environments. #​14649

export const databaseAdapter = mongooseAdapter({
  // ...
  afterOpenConnection: async (adapter) => {
    const client = adapter.connection.getClient()
    attachDatabasePool(client);
  },
})

MCP Localization Support (plugin-mcp) - Add full localization support to MCP resource operations (create, update, find, delete). All MCP tools now accept locale and fallbackLocale parameters, bringing feature parity with Payload's REST API for multilingual content management. #​14334

// Create content in English
{ "name": "createPosts", "arguments": { "title": "Hello", "locale": "en" }}

// Add Spanish translation
{ "name": "updatePosts", "arguments": { "id": "123", "title": "Hola", "locale": "es" }}

// Retrieve all translations
{ "name": "findPosts", "arguments": { "id": "123", "locale": "all" }}

PayloadRequest in MCP Handlers (plugin-mcp) - Custom tool, prompt, and resource handlers now receive a PayloadRequest object, enabling access to the Payload instance and consistent access control patterns without additional lookups. #​14644

// Previously
handler: async (args: Record<string, unknown>) => {}

// Now with req parameter
handler: async (args: Record<string, unknown>, req: PayloadRequest, _extra) => {
  // Access payload instance, user, locale, etc.
  const { payload, user, locale } = req
}

Reusable Block Selector Component (ui) - Extract BlockSelector component from BlocksDrawer and export for external use. Includes new onSelect callback for custom side effects when blocks are selected. #​14697

🐛 Bug Fixes
⚡ Performance
🛠 Refactors
  • db-mongodb,drizzle: reduce race condition window between retrieving and using a session (#​14653) (bd9f15f)
  • ui: strongly type render-list server action (#​14611) (337409b)
📚 Documentation
🧪 Tests
🏡 Chores
⚠️ BREAKING CHANGES

  • plugin-mcp: removes 'override' config (#​14598) (89ab526)

    • Removes override from the plugin config
    • Updates documentation
🤝 Contributors

v3.64.0

Compare Source

🚀 Features

UTC Timezone Support - Add support for 'UTC' as a timezone value in date fields. Previously unsupported due to validation against Intl API runtime values. Also fixes issue where having only one timezone would make it selected by default. #​14586

import { buildConfig } from 'payload'

const config = buildConfig({
  admin: {
    timezones: {
      supportedTimezones: [
        {
          label: 'UTC',
          value: 'UTC',
        },
      ],
      defaultTimezone: 'UTC',
    },
  },
})

Turbopack Build Support - Full support for Turbopack builds (now default in Next.js 16). Properly externalizes database adapter entry points to prevent production failures. Resolves issues with direct dependency externalization causing runtime errors. #​14475

MCP Context Detection - Detect when Payload API calls originate from MCP context using req.payloadAPI === 'MCP'. Enables conditional logic in hooks based on MCP usage. #​14595

export const Posts: CollectionConfig = {
  slug: 'posts',
  hooks: {
    beforeRead: [
      ({ doc, req }) => {
        if (req.payloadAPI === 'MCP') {
          doc.title = `${doc.title} (MCP Hook Override)`
        }
        return doc
      },
    ],
  },
}

Custom Auth Configuration - Override default API key authentication with custom authorization logic using overrideAuth. Provides granular control over MCP access permissions. #​14538

import { type MCPAccessSettings, mcpPlugin } from '@&#8203;payloadcms/plugin-mcp'

plugins: [
  mcpPlugin({
    overrideAuth: (req) => {
      return {
        posts: { find: true },
        products: { find: true, update: true },
      } as MCPAccessSettings
    },
  })
]

Redirect Plugin Translation Support - Enable translations for plugin fields, eliminating need for verbose field overrides configuration. Configure field labels in multiple languages directly through i18n config. #​14548

export default buildConfig({
  i18n: {
    translations: {
      en: {
        'plugin-redirects': {
          fromUrl: 'Source URL (Custom)',
        },
      },
      de: {
        'plugin-redirects': {
          fromUrl: 'Quell-URL',
          internalLink: 'Interner Link',
        },
      },
    },
  },
  plugins: [redirectsPlugin({ collections: ['pages'] })],
})

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 4 times, most recently from e933300 to c55944d Compare February 21, 2025 14:09
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from e84830b to 4badad4 Compare July 29, 2025 23:34
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from b866623 to f298878 Compare August 10, 2025 14:49
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from ac8ee56 to c3b07df Compare August 19, 2025 13:42
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from ba24489 to 2c50efc Compare August 28, 2025 16:48
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from 2c50efc to 4ab29a5 Compare August 31, 2025 09:26
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from 8898b7c to 3f55a2b Compare September 10, 2025 22:42
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from 3f55a2b to 3d9f2f9 Compare September 17, 2025 17:26
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from cc96513 to fcc687d Compare September 30, 2025 18:58
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from 429bdd1 to eafe103 Compare October 8, 2025 04:08
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 3 times, most recently from 9e9f3d5 to e3351b8 Compare October 23, 2025 16:51
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from b63e383 to ef3e00c Compare October 31, 2025 04:11
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from ef3e00c to d175a20 Compare November 3, 2025 19:04
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 2 times, most recently from b6c9ad3 to f326be0 Compare November 13, 2025 20:40
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from f326be0 to 649aca1 Compare November 18, 2025 11:12
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from 649aca1 to 473f595 Compare November 25, 2025 18:54
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 5 times, most recently from c85e90e to 4f31be6 Compare December 10, 2025 02:43
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch 4 times, most recently from 96c7909 to 256ee26 Compare December 15, 2025 20:54
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from 256ee26 to fbc4ff8 Compare December 19, 2025 21:55
@renovate renovate bot force-pushed the renovate/major-payloadcms-monorepo branch from fbc4ff8 to fae6910 Compare December 31, 2025 13:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

1 min review dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant