LoginSign Up
← Back to all sparks
P

Payload CMS

INFRA · APIS
Velocity5.0

Headless CMS and application framework you self-host

payloadcms.com ↗

Payload 4.0 beta 9 keeps old image versions and labels each login session.

headless-cmsmajor-releaseuploadsauthmcp
◆Current state
Payload 4.0 is in public beta. Beta 8 added an OAuth server to the MCP plugin and moved image crops to request-time edits on the original file. Beta 9 builds on both: restoring a version brings back its upload variants and replays its crops, sessions carry labels and device details, and Node 24.22.3 becomes the minimum.
◆Where it's heading
The 4.0 betas are finishing two systems: an auth model with refresh tokens and visible sessions, and an upload model that stores the original and replays edits. Each beta also nudges the minimum Node and framework versions up.
◆Prediction
Expect a sessions management screen in the admin and more upload-transform fixes before a release candidate.

◆Recent moves

  1. 16h ago

    Payload 4.0 beta 9: upload history restores, labelled sessions

    Restoring an old version now restores its images and crops, and each login session gets a label, type and details. It extends beta 8's upload and auth work, and raises the minimum Node to 24.22.3 as a breaking change.

    View source ↗
  2. 3d ago

    Payload 4.0 beta 8: OAuth for MCP, request-time image transforms

    The MCP plugin gains a built-in OAuth server so AI clients can sign in properly, and uploads now store only the original file with crops applied at request time. Both continue the beta's work on auth and the upload model.

    View source ↗
  3. 9d ago

    Payload 4.0 beta 7 adds refresh tokens, security fixes

    Refresh tokens and session controls give 4.0 a fuller auth model, and the security fixes tighten uploads and block access. It continues the beta's shift from features to hardening.

    View source ↗
  4. 15d ago

    Payload 4.0 beta 6: Lexical 0.53 upgrade, restores go to draft

    Beta 6 has more substance than beta 5: a breaking Lexical upgrade and a safer default that restores versions as drafts. It also fixes create-payload-app output for v4, which matters as more people try the beta.

    View source ↗
  5. 17d ago

    Payload 4.0 beta 5: GraphQL, upload and password-reset fixes

    A fix-only beta: password validation on reset, hidden fields dropped from GraphQL inputs, plugin option overrides, and per-package SBOMs on beta releases. The one breaking change only touches third-party upload adapters running without receipts. It continues the shift from features to release readiness.

    View source ↗
  6. 22d ago

    Payload 4.0 beta 4: accessibility fixes, Node 24.22.1 minimum

    Beta 4 closes the remaining accessibility audit findings in the admin, raises the minimum Node to 24.22.1 and fixes version restore and access-control inputs. The beta is shifting from new features to release readiness.

    View source ↗