fix(deps): update payloadcms monorepo to v3 (major) #68
+2,143
−433
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^1.0.0→^3.0.0^0.11.0→^3.0.0^1.0.0→^3.0.0Release Notes
payloadcms/payload (@payloadcms/db-mongodb)
v3.72.0Compare Source
🚀 Features
Localized Status (Experimental) - Each locale can now track and manage its own publication status independently. Publish or unpublish individual locales without affecting others, with locale-aware UI and version history. Requires enabling at both config and collection level. #14667
Depth Parameter Support (plugin-mcp) - MCP resource tools now support a
depthparameter (0-10) to control relationship population depth. Usedepth: 0for lightweight ID-only responses or higher values for fully populated relationship data. Significantly reduces token count when reading documents. #14931🐛 Bug Fixes
selectinfindByIDwithdraft: truemay return a wrong version (#14742) (49c9fa9)📚 Documentation
🧪 Tests
@payloadcms/storage-s3 clientUploadsintegration test suite (#15194) (4dce061)⚙️ CI
🏡 Chores
@payloadcms/ui(#15195) (54db43d)🤝 Contributors
v3.71.1Compare Source
🐛 Bug Fixes
🤝 Contributors
v3.71.0Compare Source
🚀 Features
Feature Details
Job Queue Concurrency Supersedes - Newer jobs can automatically delete older pending jobs with the same concurrency key. Enables "last queued wins" behavior for scenarios where only the latest state matters. #15179
Exclusive Concurrency Controls - Prevents race conditions when multiple jobs operate on the same resource. Jobs with the same concurrency key will not run in parallel. Requires
enableConcurrencyControl: true(will default totruein v4.0). #15177Job Cancellation from Handlers - Throw
JobCancelledErrorfrom within a task or workflow handler to stop the job without retrying. #15119Custom Status Component - Replace the Status section in document or global edit views without replacing the entire Edit view. Useful for custom locale publishing logic or additional status indicators. #11154
Bulk Operations Single Transaction (db-mongodb) - Handle database transaction limitations when processing large numbers of documents in bulk operations. Useful for DocumentDB and Cosmos DB which have cursor limitations within transactions. #14387
Additional IANA Timezones & Custom UTC Offsets - Support for additional IANA timezone names via
DateTimeFormatAPI validation, custom UTC offsets in±HH:mmformat, and the ability to override the timezone field configuration. #15120Override the timezone field:
Strict Draft Types (typescript) - Opt-in
strictDraftTypesflag for correct type safety when querying drafts. When enabled,findoperations withdraft: truewill correctly type required fields as optional. Will become default in v4.0. #14388Validation Error Context (drizzle) - Unique constraint
ValidationErrors now includedata.collectionordata.globalfor better error context when debugging. #15147Server-Side Cart Logic (plugin-ecommerce) - Cart logic moved to the server with new REST API endpoints. New hooks:
onLogin(merge guest cart with user cart),onLogout(clear session),clearSession,mergeCart, andrefreshCart. Support for custom cart item matchers and MongoDB-style$incoperator for quantity changes. #15142refreshCart Method (plugin-ecommerce) - Manually refresh cart state after direct modifications, allowing the UI to stay in sync without being blocked by
addItem's uniqueness validation. #14767Import Functionality (plugin-import-export) - Complete plugin refactor with new import functionality. Config is now per-collection with required⚠️ BREAKING CHANGE
collectionsarray. Supports disabling import/export per collection and custom collection overrides. #14782Draft Parameter for MCP Find (plugin-mcp) - Query draft/unpublished documents via the MCP plugin's find tool using the new
draftboolean parameter. #14924Globals Support (plugin-mcp) - New MCP tools to
findandupdateglobals. #15091Request Parameter in Nested Docs (plugin-nested-docs) -
reqparameter added togenerateURLandgenerateLabelfunctions for more flexibility (e.g., reading current locale). #14617Skip Sync (plugin-search) - Conditionally skip syncing documents to the search index based on locale, document properties, or other criteria. #14928
Automatic Type Inference (sdk) - The SDK automatically uses your generated types via module augmentation—no need to manually pass
GeneratedTypes. #15167Proper Error Handling (sdk) - The SDK now throws
PayloadSDKErroron failed API requests withstatus,errors,response, andmessageproperties. #15148Japanese Translations (plugin-redirects) - Localized admin UI strings for Japanese users. #15080
🐛 Bug Fixes
$lookupwhen a join field is not selected (#15149) (e39b1b5)existsoperator on fields that have an array value in the db (#15152) (0afe200)altuser-defined values. (#15097) (3290b04)⚡ Performance
🛠 Refactors
📚 Documentation
🧪 Tests
⚙️ CI
🏡 Chores
plugin-import-export: refactor plugin and add import functionality (#14782) (13e6035)
This PR works to refactor the entire plugin so it's easier for us to
work with it going forward and also implements import functionality.
🤝 Contributors
v3.70.0Compare Source
🚀 Features
Multi-Column REST API Sorting
Sort by multiple columns in the REST API using array syntax, aligning REST API behavior with the Local API. Previously only string-based sorting was supported. #15065
Lexical Blocks Documentation & Component Styles (richtext-lexical)
New documentation page for Lexical blocks with comprehensive examples showing usage and customization. Also introduces new block component types and styles for enhanced rich text editing. #14971
See the https://payloadcms.com/docs/rich-text/blocks for full details.
🐛 Bug Fixes
🧪 Tests
🏡 Chores
@payloadcms/storage-s3Only users with custom hooks on S3 upload fields are affected — standard plugin usage is unchanged.
beforeChangetoafterChangeas a result of fix: s3 plugin uploads files before validation (#14988)This change was necessary to ensure that files uploaded to S3 have passed all validations and been saved to the document, preventing orphaned external files.
🤝 Contributors
v3.69.0Compare Source
🚀 Features
Modular Dashboards with Widgets
Introduces customizable admin dashboards with draggable, resizable widgets. Build personalized dashboard layouts with full keyboard accessibility for reordering and resizing. Future updates will add widget fields (props) for configurable widgets and dashboard presets for sharing layouts. #13683
Screen.Recording.2025-11-28.at.17.13.14.mov
See the RFC discussion for background and roadmap.
AI Development Resources (templates)
All templates now ship with
AGENTS.mdand.cursor/rules/directory for improved AI-assisted development with tools like Copilot and Cursor. #14889See more about AGENTS.md
🐛 Bug Fixes
🛠 Refactors
📚 Documentation
🧪 Tests
vitest(#14337) (4e45432)🏡 Chores
🤝 Contributors
v3.68.5Compare Source
🐛 Bug Fixes
🛠 Refactors
🤝 Contributors
v3.68.4Compare Source
🐛 Bug Fixes
📚 Documentation
deps: enforce Next.js 15.4.10 (#14908) (7c675fa)
Address
CVE-2025-67779.
🤝 Contributors
v3.68.3Compare Source
A high-severity Denial of Service (CVE-2025-55184) and a medium-severity Source Code Exposure (CVE-2025-55183) affect React 19 and frameworks that use it, like Next.js.
Full details here: https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app
While this is not a Payload vulnerability, it may affect any Payload project running on the affected versions of Next.js. Payload does not install any of these dependencies directly, it simply enforces their versions through its peer dependencies, which will only warn you of the version incompatibilities.
You will need to upgrade React and Next.js yourself in your own apps to the patched versions listed below in order to receive these updates.
Resolution
You are strongly encouraged to upgrade your own apps to the nearest patched versions of Next.js and deploy immediately.
Quick steps:
If using
pnpmas your package manager, here's a one-liner:For a full breakdown of the vulnerable packages and their patched releases, see https://vercel.com/kb/bulletin/security-bulletin-cve-2025-55184-and-cve-2025-55183#how-to-upgrade-and-protect-your-next.js-app.
🐛 Bug Fixes
🤝 Contributors
v3.68.2[Compa
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.