Starstruk Logo MarkStarstruk

v3.3.5-rc1 v3.90.0

high risk

bespokelabsai/nimbleSep 18, 2026 → Sep 18, 20260 days between releases

What's New

Critical security fixes and auth behavior changes in Payload CMS v3.90.0

Breaking Changes

  • Password changes revoke other sessions
  • Stricter validation for SVG and XML uploads
  • Multipart uploads capped at 50MB by default
  • Client uploads stored in per-upload folders
  • Form Builder defaults form submission read access to admin collection

New Features

  • Security hardening
  • Password reset improvements
  • Upload path restructuring

Bug Fixes

  • Critical security fixes

Upgrade Notes

Regenerate types using `pnpm payload generate:types` and run database migrations if using a relational DB. Watch for the new `resetPasswordRequestedAt` field and Form Builder default access changes.

The Two Releases

v3.3.5-rc1

v3.3.5-rc1

Sep 18, 2026· 1 month ago

Release candidate focusing on security patches, IPv6 support, and ACME configuration persistence.

Full release notes
v3.90.0

v3.90.0

Sep 18, 2026· 1 month ago

Major release with critical security fixes and significant changes to upload handling and authentication behavior.

Full release notes