Skip to content

Update dependency payload to v3.44.0 [SECURITY] #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency payload to v3.44.0 [SECURITY] #63

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Aug 31, 2025 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
payload (source) 3.34.0 -> 3.44.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2025-4643

Payload uses JSON Web Tokens (JWT) for authentication. After log out JWT is not invalidated, which allows an attacker who has stolen or intercepted token to freely reuse it until expiration date (which is by default set to 2 hours, but can be changed).

This issue has been fixed in version 3.44.0 of Payload.

CVE-2025-4644

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidate the JWT. As a result, the next newly created user would receive the same identifier, allowing the attacker to reuse the JWT to authenticate and perform actions as that user.

This issue has been fixed in version 3.44.0 of Payload.

Release Notes

payloadcms/payload (payload)

v3.44.0

Compare Source

🚨 Notice 🚨

If your project uses the local auth strategy with db-postgres or db-sqlite, a migration is required. This is due to a new security feature (enabled by default) that stores a unique auth session identifier in the database.

To opt out and continue using the previous behavior, you can disable the feature by setting auth.useSessions: false in your users collection config.

For example:

// payload.config.ts
collections: [
  {
    slug: 'users',
    auth: {
      useSessions: false,
    },
    fields: [],
  },
],
🚀 Features
🐛 Bug Fixes
  • richTextField supports beforeInput/afterInput, but these were missing from types.ts (#​12889) (e769550)
  • validate "null" value for point field as true when its not required (#​12908) (2da6d92)
  • get external resource blocked (#​12927) (a7ad573)
  • restore missing properties to live preview client config (#​12904) (bcb10b5)
  • uses valid fractional index for test (#​12942) (8900a38)
  • querying virtual fields deeply with draft: true (#​12868) (bc9b501)
  • use small pill size when viewing version information (#​12844) (6c4dfe4)
  • db-mongodb: strip deleted from the config blocks from the result (#​12869) (54afaf9)
  • db-postgres: joins with custom schema (#​12937) (c1f6297)
  • db-postgres: querying on hasMany: true select field in a relationship (#​12916) (b74969d)
  • drizzle: skip column if undefined in findMany (#​12902) (605c993)
  • live-preview: client-side live preview cannot populate more than 10 relationships at once (#​12929) (7472798)
  • live-preview: foreign postMessage events reset client-side state (#​12925) (67fa5a0)
  • next: live preview popup triggers leave without saving modal (#​12947) (141133a)
  • next: prevent errors in globals version view (#​12920) (39e9519)
  • next: remove error handling from next auth functions (#​12897) (1b5e3fe)
  • next: remove console.error from next auth functions (#​12881) (fe58f03)
  • plugin-import-export: duplicated rows and headers in CSV export when streaming paginated results (#​12941) (5cf9287)
  • plugin-import-export: csv export for polymorphic relationship fields (#​12926) (6d76874)
  • plugin-import-export: omit CSV columns when toCSV returns undefined (#​12923) (751691a)
  • plugin-multi-tenant: updates tenant selector upon tenant creation (#​12936) (c76d839)
  • richtext-lexical: consistent html converter inline padding (#​12848) (11ac230)
  • ui: usePreventLeave should not show alert for exceptions (#​12722) (c3c1614)
  • ui: vertically align table headers to the middle (#​12699) (0e9865c)
  • ui: properly render create new button in polymorphic joins (#​12930) (a1822d2)
  • ui: render DateTime label as instead of (#​12949) (4b9566f)
  • ui: bulk upload losing state when adding additional files (#​12946) (d62d9b4)
  • ui: unreachable custom views when admin route set to '/' (#​12812) (379fc12)
  • ui: toggle list selections off on successful bulk action (#​12861) (9f17db8)
  • ui: align caret on error tooltip for checkbox field (#​12917) (c094b0e)
  • ui: updates auth fields UI to reflect access control (#​12745) (1845669)
  • ui: folder server function must reference exports dir (#​12898) (0d50799)
  • ui: custom row labels on arrays should not be removed on field duplication (#​12895) (37c945b)
  • ui: date format of useAsTitle lost after changing value (#​12928) (20bbbcf)
  • ui: properly differentiate between DOM events and raw values in setValue (#​12892) (c03e9c1)
  • ui: should select document after creation from relationship field (#​12842) (25e3902)
  • ui: support react node content in ConfirmationModal heading and body (#​12841) (dffdee8)
🛠 Refactors
📚 Documentation
🧪 Tests
📝 Templates
📓 Examples
⚙️ CI
🏡 Chores
  • fix jest global teardown incorrectly always returning process exit status 0 (#​12907) (5368440)
  • set trimTrailingWhitespace and insertFinalNewline in vscode settings (#​12939) (b1a57fa)
  • fix withPayload helper jsdoc (#​12503) (57f4fb6)
  • remove neverBuiltDependencies from test/package.json (4831f66)
  • add eslint rule to ignore default exports in test suite configs (#​12655) (9c5adba)
🤝 Contributors

v3.43.0

Compare Source

🚀 Features
🐛 Bug Fixes
⚡ Performance
  • ui: do not re-animate drawer on re-render, reduce useEffects (#​12743) (cb3f9bb)
🛠 Refactors
📚 Documentation
🏡 Chores
🤝 Contributors

v3.42.0

Compare Source

🚀 Features
🐛 Bug Fixes
⚡ Performance
  • richtext-lexical: improve typing performance while toolbars are enabled (#​12669) (aef4f77)
📚 Documentation
  • document how to expose the jobs collection in Admin UI (#​12707) (34fe36b)
  • fix formatting in custom components > edit view paragraph (#​12697) (6466684)
  • improve jobs autorun docs, adds e2e test (#​12196) (7c05c77)
  • enhance drafts documentation with examples for REST, Local, and GraphQL APIs (#​12575) (629e74d)
  • removes duplicate headline in building without a db connection (#​12694) (4ee4aa7)
  • plugin-form-builder: add warning about GraphQL type name collis… (#​12720) (7b21270)
🏡 Chores
🤝 Contributors

v3.41.0

Compare Source

🚀 Features
🐛 Bug Fixes
⚡ Performance
🛠 Refactors
  • translations: correct i18n translation for Mandarin (#​12561) (6f8cff7)
  • ui: improve relationship field option loading reliability using queues (#​12653) (30dd9a2)
📚 Documentation
📝 Templates
⚙️ CI
🏡 Chores
🤝 Contributors

v3.40.0

Compare Source

🚀 Features
🐛 Bug Fixes
⚡ Performance
  • folder views download only images and get best fit from image sizes (#​12514) (11a4a20)
🛠 Refactors
📚 Documentation
📝 Templates
🏡 Chores
🤝 Contributors

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-payload-vulnerability branch from b0b9840 to f63ef10 Compare September 25, 2025 18:55
@renovate renovate bot force-pushed the renovate/npm-payload-vulnerability branch from f63ef10 to 2183f8f Compare October 23, 2025 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant