payloadcms/payload v4.0.0-beta.7 on GitHub

v4.0.0-beta.7 (2026-11-04)

⚠️ Contains vital security updates. We encourage updating as soon as possible.

add refresh tokens (#19040) (1410829)
add sessionExpiration to addSessionToUser (#19046) (ec35164)
add auth.passwordHashIterations for environments that limit PBKDF2 (#19070) (28f19dc)
ui: add combobox slots and consistent search (#19162) (c332a5b)

enforce pasteURL restrictions on remote URL uploads (7097df5)
enforce block child read access in queries (45e833f)
restrict blocks to each field's configured types (5496b16)
apply xml response policy to xsl content (c21deda)
constrain global view redirects to available tenants (43c32b1)
set _strategy for users logged in by custom auth strategies (#19313) (62ce3e1)
preserve shared localized draft changes (#17367) (be95e1a)
remove -original suffix from retained upload originals (#19210) (fcf090d)
resolve config labels before interpolating them into strings (#19208) (39a9df9)
prevent error in sendEmail due to empty from recepient (#18190) (82f9d94)
stamp global createdBy on first save with field defaults (#19219) (edd6238)
fall back to Referer origin when Sec-Fetch-Site is absent (#17897) (66a7fdb)
db-mongodb: serialize paginated count and docs inside transactions (#17053) (d542ce0)
next: clamp description param on og endpoint (4e2f324)
plugin-multi-tenant: preserve source config across HMR (#19196) (c2a3239)
richtext-lexical: escape stored values in HTML converters (b138053)
ui: omit hidden fields from version diffs (#19163) (f4f5c5c)
ui: address accessibility findings in recently added features (#19207) (c510783)
ui: allow tapping select clear buttons on iOS (#19194) (cf45585)
ui: translate document drawer labels (#17959) (96bc50e)

cleanup guidepup tests for a11y (#18908) (16ba644)
limit breaking changes to the versioning policy exceptions in AGENTS.md (#19216) (09dab7e)

add refresh tokens (#19040) (1410829)
Adds auth.refreshTokens to auth collections. With it, login also
returns a refreshToken, which the refresh operation trades for a new
token and a new refresh token, even after the token expired.
remove -original suffix from retained upload originals (#19210) (fcf090d)
This PR removes the -original filename suffix that v4 beta adds to
retained upload originals.