payloadcms/payload v4.0.0-canary.37

on GitHub

v4.0.0-canary.37 (2026-09-24)

🚀 Features

• default overrideAccess to false in the Local API (#17869) (744bfcf)
• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)
• codemod: add agent-assisted upgrade command (#17825) (c44404c)
• tanstack-start: add devServerExternalPackages option to withPayload (#17631) (346bd50)

🐛 Bug Fixes

• update deprecated mongodb new option (#18277) (9c63438)
• inherit read access for collection versions (#17634) (b0e85ef)
• drizzle: size sqlite batch inserts by widest row (#17234) (9001b93)
• plugin-multi-tenant: avoid refreshing without stale tenant cookie (#18252) (3826748)
• tanstack-start: avoid broad imports in route graph (#18254) (213356c)

🛠 Refactors

• consolidate initReq across framework adapters (#17690) (d1deb35)

📚 Documentation

• adds first batch of v4 ui component docs (#18147) (f35c2b6)

🧪 Tests

• fix vs code run test buttons not working on first try (#18244) (322ccb9)

⚙️ CI

• seed canary and disable canary publishing (#18259) (ba73526)

🏡 Chores

• make overrideAccess explicit in first-party call sites (#17861) (c698135)
• make overrideAccess explicit in tests (#17859) (a8c8bb0)
• migrate AI skills to .agents directory (#18256) (ed96e79)
• migrate to AGENTS.md (#18247) (b2c0b11)
• release: v4.0.0-canary.37 (f88f502)

⚠️ BREAKING CHANGES

• default overrideAccess to false in the Local API (#17869) (744bfcf)

  This changes the Local API default for overrideAccess from true to
  false, including payload.jobs.* operations. An omitted option now
  enforces access control.

• consolidate initReq across framework adapters (#17690) (d1deb35)

  Consolidates initReq in payload core so every framework adapter uses
  the same request initialization behavior.

• publish active locale by default, remove defaultLocalePublishOption (#17874) (5a6d003)

• inherit read access for collection versions (#17634) (b0e85ef)

  Inherits a collection or global's existing read access for version
  operations when readVersions is not configured. Explicit
  readVersions access remains authoritative.

🤝 Contributors

• Nate Lentz (@nathanlentz)
• Sasha (@r1tsuu)
• Alessio Gravili (@AlessioGr)
• Jake Fletcher (@jacobsfletch)
• Elliot DeNolf (@denolfe)
• Paul (@paulpopus)
• Sean Zubrickas (@zubricks)
• Jarrod Flesch (@JarrodMFlesch)