Skip to content
TrustMyStack, home

payload

v3.93.0
payloadcms/payload

Payload is the open-source, fullstack Next.js framework, giving you instant backend superpowers. Get a full TypeScript backend and admin panel instantly. Use Payload as a headless CMS or for building powerful applications.

Version of payloadcms/payload you run

CompareView on GitHub
Maintenance
Active609 commits in 3 months · bus factor 3
License
MITPermissive · OSI-approved
Security
30 advisories2 critical, 14 high, 14 medium · Scorecard 4.5/10
Supported versions
No scheduleendoflife.date does not track this project

45.8k stars · 4.4k forks · 1.6k open issues · last release 10 days ago · data checked 50 minutes ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v3.93.0Nov 4, 2026
    • ⚠️ Contains vital security updates. We encourage updating as soon as possible.
  • v3.92.0Oct 22, 2026

    ⚠️ BREAKING CHANGES

    Raises the minimum supported Node.js version to 22.23.4, retaining

    support for Node.js 24.22.1 and newer.

  • v3.91.0Oct 15, 2026

    ⚠️ BREAKING CHANGES

    BREAKING: Raises the minimum supported Node.js version. NOTE: Node 18 already had issues, this just bumps the value to be what was functionally true.

    • email-nodemailer: upgrade to nodemailer 10 to resolve security advisories (#18736) (e93b7f2)

    If you pass your own transport created with nodemailer 9, upgrade

    nodemailer to ^10 and remove @types/nodemailer. A transport typed

    by @types/nodemailer no longer type-checks against the adapter.

    Runtime behavior does not change.

    • storage-azure: bump @azure/storage-blob to 12.34.0 to fix chunked uploads over 256 MiB (#18469) (99f0fcd)

    Breaking: this bumps the minimum node version required by

    @payloadcms/storage-azure from 20.18.1 to 22.0.0. Due to

    @azure/storage-blob bumping their min. node version to 22.0.0 in a

    minor release, we're not able to avoid this change.

  • v3.90.0Sep 18, 2026
    • ⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

    After upgrading:

    • Regenerate your payload types: pnpm payload generate:types
    • If you are using a relational database, you will need to create and run a migration:
    pnpm payload migrate:create
pnpm payload migrate
  • v3.89.0Sep 10, 2026

    ⚠️ BREAKING CHANGES

    This backports the v4 jobs access changes to Payload v3.

Release history

All releases on GitHub
Atom feed/feed/payloadcms/payload
BadgeLatest version of payloadcms/payload[![version](/badge/payloadcms/payload)](/p/payloadcms/payload)

v4.0.0-beta.9 (2026-11-13)

🚀 Features

  • read the saved crop and focal point from _transforms (#19547) (ae5e1dc)
  • add label, type and details to sessions (#19492) (b3c508f)
  • serve historical upload variants and replay transforms on restore (#19474) (af30c3e)
  • ui: export standalone CSS tokens (#19472) (fd82d9d)

🐛 Bug Fixes

  • respect custom admin routes during upgrades through CPA (#19484) (f2f8ee5)
  • bump minimum node version to 24.22.3 (#19555) (94372c8)
  • preserve transaction failures and clean up sessions (#19159) (397fa9c)
  • pass the request to db.findOne in findByID (#19488) (7a80820)
  • deps: bump the non-major group with 1 updates (#19500) (90b4962)
  • drizzle: limit atomic updates with a locking subquery (#19214) (a5c71f3)
  • ui: await persistence of merged preference writes (#19157) (7fdf644)

🛠 Refactors

📚 Documentation

⚙️ CI

  • allow ubuntu-26.04 runner label in actionlint (#19546) (6251cee)
  • use the breaking changes section of PR bodies in release notes (#19554) (0ec1c0f)

🏡 Chores

  • disable model invocation for triage-ci-flake skill (#19565) (f4662dd)

⚠️ BREAKING CHANGES

Applications on Node.js 24.x before 24.22.3, on Node.js 25.x, or

on Node.js 26.x before 26.13.1 must upgrade their local, CI, and

deployment runtimes. The supported range is now ^24.22.3 || >=26.13.1.

   "engines": {
  -  "node": ">=24.22.1"
  +  "node": "^24.22.3 || >=26.13.1"
   }

On SQL adapters, this adds three columns to each _sessions

table, so existing projects need a database migration. In development

the schema is pushed automatically; in production, run `payload

migrate:create and then payload migrate`. MongoDB needs no migration.

This is in the v4 migration guide under "Sessions say what they are".

🤝 Contributors

  • Nate Lentz (@nathanlentz)
  • Jessica Rynkar (@JessRynkar)
  • Elliot DeNolf (@denolfe)
  • Dan Ribbens (@DanRibbens)
  • Jarrod Flesch (@JarrodMFlesch)
  • Alessio Gravili (@AlessioGr)
  • German Jablonski (@GermanJablo)
  • Jake Fletcher (@jacobsfletch)

Full release notesCompare with previous