v3.88.0

HavocFramework/Havocv3.88.0Aug 11, 2026by denolfe

AI Summary

This release addresses security and stability issues, including a fix for multipart content-type backtracking and clipboard prefix matching to prevent data leakage. It also includes a refactor for the plugin-mcp access control and an upgrade to Next.js 16.3.0.

Key Highlights

Fixed multipart content-type backtracking bug
Tightened clipboard prefix matching to prevent sibling row leakage
Refactored plugin-mcp access control defaults
Bumped Next.js to version 16.3.0

Full Release Notes

## [v3.88.0](https://github.com/payloadcms/payload/compare/v3.87.1...v3.88.0) (2026-08-11)


### 🐛 Bug Fixes

* prevent multipart content-type backtracking ([#17679](https://github.com/payloadcms/payload/issues/17679)) ([a742140](https://github.com/payloadcms/payload/commit/a742140))
* **ui:** tighten clipboard prefix matching to prevent sibling row leakage on copy/paste ([#17595](https://github.com/payloadcms/payload/issues/17595)) ([c6477b8](https://github.com/payloadcms/payload/commit/c6477b8))

### 🛠 Refactors

* **plugin-mcp:** better access control defaults for api keys collection ([#17751](https://github.com/payloadcms/payload/issues/17751)) ([025581d](https://github.com/payloadcms/payload/commit/025581d))

### 📝 Templates

* bump next.js to 16.3.0 ([#17683](https://github.com/payloadcms/payload/issues/17683)) ([ee155b7](https://github.com/payloadcms/payload/commit/ee155b7))

### 🤝 Contributors

- Jarrod Flesch (@JarrodMFlesch)
- Alessio Gravili (@AlessioGr)
- Nate Lentz (@nathanlentz)