v3.90.0

Official Payload changelog summary with source attribution, release tags, and community reactions.

Track this Payload release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Payload·Sep 18, 2026, 02:21 PMChangeMay break your integrationAI-assisted summary

Summary

Critical security fixes: password changes now revoke sessions, password reset clears lockouts, API keys are no longer readable, and tighter controls on external file fetches and upload adapters.
Stricter validation and hardening for SVG/XML uploads, client upload adapters, and uploaded filenames; multipart upload size default capped at 50 MB.
Behavioral breaking changes: scheduled publishing requires re‑creating pending events, form builder defaults read access to admin collection, polymorphic join where constraints now enforce full validation, and Lexical rich‑text upgrade m...

securitybreakingsource healthy

Official source Last checked Sep 20, 2026, 12:00 PM

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource healthyLast checked Sep 20, 2026, 12:00 PM

related channels

Turn this Payload release note into a weekly digest for the tools you actually use.