[dependabot]

Bumps payload from 2.32.3 to 3.90.0.

Release notes

Sourced from payload's releases.

v3.90.0

v3.90.0 (2026-09-18)

⚠️ This release contains a set of critical security fixes. Please review the following notes and upgrade as soon as possible. Even if none of the listed items below affect you, we still recommend updating as soon as possible.

These notes only cover the behavior, configuration, and API-surface changes that projects may need to react to when upgrading. Exploit details, attack surface descriptions, and severity are intentionally omitted.

CVE and GHSA identifiers for the underlying issues are published separately.

How to read this document

Every entry has: Affected if you (concrete conditions - if none apply, no action is required), and Action required.

After upgrading:

• Regenerate your payload types: pnpm payload generate:types
• If you are using a relational database, you will need to create and run a migration:

pnpm payload migrate:create <migration-name>
pnpm payload migrate

Password changes now revoke other sessions

• No action needed.

Password reset now clears lockouts; forgot-password is throttled

• Adds new resetPasswordRequestedAt field to user collections

• Action required:

  • Regenerate types: pnpm payload generate:types
  • If using a relational database, perform migration:

pnpm payload migrate:create add-reset-password-requested-at
pnpm payload migrate

Scheduled publishing preserves the scheduling user's auth collection

Affected if you:

• Have publish or unpublish events queued when upgrading.
• Use multiple admin-capable auth collections.

... (truncated)

Commits

• e10b602 chore(release): v3.90.0 [skip ci]
• 880d2e9 fix!: omit API keys from document reads
• bd4857d fix: contain cloud storage upload prefixes
• 9213d3e fix!: preserve schedule publish user collection
• b4056fe fix: reprocess uploads from stored file data
• 0b93fe2 findDistinct organization
• 6560aa6 fix: reorder code, earlier return if no fieldResult in findDistinct
• 8e880a4 fix: incorrect prefix from client upload
• 5b8af82 fix: validate find distinct relationship access
• de75349 refactor: report field access results
• Additional commits viewable in compare view

[dependabot]

Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request.

[kilemensi]

These are the Payload v2 apps' packages. Moving them to Payload v3 is a migration, not a version bump.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.