MadeWithPayload.com

v4.0.0-canary.37 (2026-09-24)

default overrideAccess to false in the Local API (#17869) (744bfcf)
publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)
codemod: add agent-assisted upgrade command (#17825) (c44404c)
tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50)

update deprecated mongodb new option (#18277) (9c63438)
inherit read access for collection versions (#17634) (b0e85ef)
drizzle: size sqlite batch inserts by widest row (#17234) (9001b93)
plugin-multi-tenant: avoid refreshing without stale tenant cookie (#18252) (3826748)
tanstack-start: avoid broad imports in route graph (#18254) (213356c)

make overrideAccess explicit in first-party call sites (#17861) (c698135)
make overrideAccess explicit in tests (#17859) (a8c8bb0)
migrate AI skills to .agents directory (#18256) (ed96e79)
migrate to AGENTS.md (#18247) (b2c0b11)
release: v4.0.0-canary.37 (f88f502)

default overrideAccess to false in the Local API (#17869) (744bfcf) This changes the Local API default for overrideAccess from true to false, including payload.jobs.* operations. An omitted option now enforces access control.
consolidate initReq across framework adapters (#17690) (d1deb35) Consolidates initReq in payload core so every framework adapter uses the same request initialization behavior.
publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)
inherit read access for collection versions (#17634) (b0e85ef) Inherits a collection or global's existing read access for version operations when readVersions is not configured. Explicit readVersions access remains authoritative.