LoginSign Up
← Back to all sparks
P

Payload CMS

INFRA · APIS
Velocity5.0

Self-hosted headless CMS and application framework

payloadcms.com ↗

Payload's v4 beta.9 keeps every past image crop and raises the Node floor again.

headless-cmsv4-betafile-uploadsauthsessions
◆Current state
Payload has tagged nine v4 betas since October 10. Beta.9 reads saved crops and focal points from the new _transforms store, serves historical upload variants when a version is restored, adds labels and device details to sessions, and exports standalone CSS tokens from the UI package. It also bumps the minimum Node version to 24.22.3, the second Node floor raise in the cycle.
◆Where it's heading
Three betas in a row have reworked file uploads around one stored original plus replayable transforms, and two have tightened sign-in and sessions. The v4 cycle is now finishing those two systems rather than adding new surfaces, which is the usual shape of a beta nearing a release candidate.
◆Prediction
Expect more betas that close out the transforms and session work, with a release candidate once the fix lists shrink; the entries do not show a date.

◆Recent moves

  1. 16h ago

    v4 beta.9: version-aware image transforms, richer session details

    Beta.9 completes the transforms work from beta.8: restoring a version now brings back its original crop and image variants, and sessions carry labels and device details. The Node 24.22.3 minimum is a small breaking change for anyone pinned to an earlier 24.x.

    View source ↗
  2. 3d ago

    v4 beta.8: OAuth login for MCP, request-time image transforms

    Beta.8 gives the MCP plugin its own OAuth server and moves image crops and focal points to request-time transforms that keep only the original file. It continues the auth focus of beta.7, now extended to AI clients connecting over MCP.

    View source ↗
  3. 9d ago

    v4 beta.7: refresh tokens and a batch of security fixes

    beta.7 adds refresh tokens and session expiration, plus fixes for block read access, remote upload URL restrictions and tenant redirects. It is the second security-heavy beta in a row, which points to hardening before a release candidate.

    View source ↗
  4. 15d ago

    v4 beta.6: Lexical 0.53, restores always return as drafts

    beta.6 brings the Lexical 0.53 upgrade, flagged as breaking, plus custom CLI error exit codes and a rule that restored versions always come back as drafts. It is the latest step in hardening the admin UI before stable.

    View source ↗
  5. 17d ago

    v4 beta.5: signed upload receipts, stricter password reset

    beta.5 is a fix release with teeth: signed adapterData on public upload receipts, password validation on reset, and hidden fields dropped from GraphQL mutation inputs. Third-party upload adapters must now read extra fields from uploadReference.clientData.

    View source ↗
  6. 22d ago

    v4 beta.4: Node 24.22.1 minimum and accessibility audit fixes

    beta.4 raises the minimum Node version to 24.22.1 and closes a long list of accessibility audit findings. TanStack Start gets up to 3x faster initial loads in dev, more evidence that it is a first-class target in v4.

    View source ↗