0.16.8 v3.90.0
payloadcms/payloadSep 16, 2026 → Sep 18, 20262 days between releases
What's New
Major security updates and Lexical editor upgrade replace focus on internal type checking tools.
Breaking Changes
- Password changes now revoke other sessions.
- Password reset now clears lockouts (requires migration).
- Scheduled publishing preserves the scheduling user's auth collection (requires event re-creation).
- Stricter validation for SVG and XML uploads (requires config update).
- Client uploads are stored in a per-upload folder (requires path updates).
New Features
- Added `resetPasswordRequestedAt` field to user collections.
- Introduced `_objectKey` field on upload collections for client uploads.
- Update to Lexical rich text editor (v3).
Improvements
- Hardened client upload processes with stricter SVG/XML validation.
- Stricter `where` validation for polymorphic joins.
- Azure storage defaults changed to private.
- Security updates regarding password management and lockouts.
Upgrade Notes
Regenerate your payload types using `pnpm payload generate:types`. If using a relational database, create and run a migration for the new `resetPasswordRequestedAt` field. Review configuration for stricter SVG/XML validation and updated client upload paths.
The Two Releases
0.16.8
Sep 16, 2026· 1 month ago
This release focuses on enhancing type checking support, specifically for PEP-728 TypedDict and conditional `__lazy_modules__`, alongside various bug fixes and rule updates for linting tools like ruff, flake8-simplify, and pyupgrade.
Full release notesv3.90.0
Sep 18, 2026· 1 month ago
This release focuses on critical security fixes and hardening across authentication, file uploads, and data validation. It introduces stricter controls for password management, client uploads, and external fetches, alongside updates to the Lexical rich text editor and polymorphic join validation.
Full release notes